yts-hook技术.docVIP

Hook技术 关键函数 HHOOK WINAPI SetWindowsHookEx _In_ int idHook, _In_ HOOKPROC lpfn, _In_ HINSTANCE hMod, _In_ DWORD dwThreadId ; LRESULT WINAPI CallNextHookEx _In_opt_ HHOOK hhk, _In_ int nCode, _In_ WPARAM wParam, _In_ LPARAM lParam ; Hook类型 1.WH_MOUSE 处理函数： LRESULT CALLBACK MouseProc _In_ int nCode, _In_ WPARAM wParam, _In_ LPARAM lParam ; 2.WH_GETMESSAGE 2.1处理函数： LRESULT CALLBACK GetMsgProc _In_ int code, _In_ WPARAM wParam, _In_ LPARAM lParam ; 2.2参数： code [in] Type: int Specifies whether the hook procedure must process the message. If code is HC_ACTION, the hook procedure must process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. wParam [in] Type: WPARAM Specifies whether the message has been removed from the queue. This parameter can be one of the following values. lParam [in] Type: LPARAM A pointer to an MSG structure that contains details about the message. 2.3返回值 Type: LRESULT If code is less than zero, the hook procedure must return the value returned by CallNextHookEx. If code is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_GETMESSAGE hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero. WH_CBT 3.1处理函数： LRESULT CALLBACK CBTProc _In_ int nCode, _In_ WPARAM wParam, _In_ LPARAM lParam ; 3.2参数： nCode [in] Type: int The code that the hook procedure uses to determine how to process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values. wParam [i