📄 vb的hook简介_mysky.htm
字号:
if(xhr == null){ RelatedDocData = -1; return; } xhr.open("GET", "/sys/search?type=8&word=VB%B5%C4HOOK%BC%F2%BD%E9&item=43c39fefaa059734acafd51a&t=" + new Date().getTime(), true); xhr.onreadystatechange = function(){ if(xhr.readyState == 4){ if(xhr.status == 0 || xhr.status == 200){ if(GetAndEval){ eval(xhr.responseText); }else{ RelatedDocData = xhr.responseText; } } } } xhr.send(null);})();/*]]>*/</SCRIPT>
<META content="MSHTML 6.00.2900.3354" name=GENERATOR></HEAD>
<BODY onload=formatonlinpic();>
<CENTER>
<SCRIPT type=text/javascript>
/*<![CDATA[*/
if(top.location != self.location){
top.location = self.location;
}
var myref = encodeURI("http://hi.baidu.com/gallonchai/blog/item/43c39fefaa059734acafd51a%2Ehtml");
/*]]>*/
</SCRIPT>
<LINK href="VB的HOOK简介_MySky.files/mods.css" type=text/css rel=stylesheet><LINK
href="VB的HOOK简介_MySky.files/bb792b3e6609c93d70cf6c0a.css" type=text/css
rel=stylesheet><LINK href="VB的HOOK简介_MySky.files/space.css" type=text/css
rel=stylesheet>
<STYLE type=text/css>#usrbar {
PADDING-RIGHT: 10px; PADDING-LEFT: 0px; FONT-SIZE: 12px; BACKGROUND: #ffffff; FILTER: alpha(opacity=65); PADDING-BOTTOM: 3px; WIDTH: 100%; COLOR: #000000; LINE-HEIGHT: 19px; PADDING-TOP: 4px; FONT-FAMILY: Arial; LETTER-SPACING: normal; HEIGHT: 19px; TEXT-ALIGN: right; moz-opacity: 0.5
}
#usrbar A {
COLOR: #0000cc; TEXT-DECORATION: underline
}
#usrbar A:link {
COLOR: #0000cc; TEXT-DECORATION: underline
}
#usrbar A:visited {
COLOR: #0000cc; TEXT-DECORATION: underline
}
#ft {
CLEAR: both; FONT-SIZE: 12px; COLOR: #666666; LINE-HEIGHT: 20px; FONT-FAMILY: Arial; HEIGHT: 20px; TEXT-ALIGN: center
}
#ft A {
COLOR: #7777cc; TEXT-DECORATION: underline
}
#ft A:link {
COLOR: #7777cc; TEXT-DECORATION: underline
}
#ft A:visited {
COLOR: #7777cc; TEXT-DECORATION: underline
}
#usrbar {
LETTER-SPACING: normal
}
#usrbar A {
LETTER-SPACING: normal
}
#usrbar A:link {
LETTER-SPACING: normal
}
#usrbar A:visited {
LETTER-SPACING: normal
}
#ft {
LETTER-SPACING: normal
}
#ft A {
LETTER-SPACING: normal
}
#ft A:link {
LETTER-SPACING: normal
}
#ft A:visited {
LETTER-SPACING: normal
}
</STYLE>
<DIV id=usrbar><NOBR><A href="http://www.baidu.com/" target=_blank>百度首页</A> | <A
id=hi_index href="http://hi.baidu.com/" target=_blank>百度空间</A>
<SCRIPT type=text/javascript>
document.write('| <a href="http://passport.baidu.com/?login&tpl=sp&tpl_reg=sp&u=http://hi.baidu.com' + encodeURI('/gallonchai/blog/item/43c39fefaa059734acafd51a%2Ehtml') + '">登录</a>');
</SCRIPT>
</NOBR></DIV>
<DIV id=main align=left><!--[if IE]>
<SCRIPT>
var objmain = document.getElementById("main");
function updatesize(){ var bodyw = window.document.body.offsetWidth; if(bodyw <= 790) objmain.style.width="772px"; else if(bodyw >= 1016) objmain.style.width="996px"; else objmain.style.width="100%"; }
updatesize(); window.onresize = updatesize;
</SCRIPT>
<![endif]-->
<DIV id=header>
<DIV class=lc>
<DIV class=rc></DIV></DIV>
<DIV class=tit><A class=titlink
title="gallonchai的空间 http://hi.baidu.com/gallonchai"
href="http://hi.baidu.com/gallonchai">MySky</A></DIV>
<DIV class=desc>自由空间</DIV>
<DIV id=tabline></DIV>
<DIV id=tab><A href="http://hi.baidu.com/gallonchai">主页</A><A class=on
href="http://hi.baidu.com/gallonchai/blog">博客</A><A
href="http://hi.baidu.com/gallonchai/album">相册</A><SPAN>|</SPAN><A
href="http://hi.baidu.com/gallonchai/profile">个人档案</A> <SPAN>|</SPAN><A
href="http://hi.baidu.com/gallonchai/friend">好友</A> </DIV></DIV>
<DIV class=stage>
<DIV class=stagepad>
<DIV style="WIDTH: 100%">
<TABLE class=modth cellSpacing=0 cellPadding=0 width="100%" border=0>
<TBODY>
<TR>
<TD class=modtl width=7> </TD>
<TD class=modtc noWrap>
<DIV class=modhead><SPAN class=modtit>查看文章</SPAN></DIV></TD>
<TD class=modtc noWrap align=right></TD>
<TD class=modtr width=7> </TD></TR></TBODY></TABLE>
<DIV class=modbox id=m_blog>
<DIV class=tit>VB的HOOK简介</DIV>
<DIV class=date>2007-08-22 09:55</DIV>
<TABLE style="TABLE-LAYOUT: fixed">
<TBODY>
<TR>
<TD>
<DIV class=cnt id=blog_text>
<P>VB的HOOK简介</P>
<P><BR>Hook这个东西有时令人又爱又怕，Hook是用来拦截系统某些讯息之用，例如说，我们想<BR>让系统不管在什麽地方只要按个Ctl-B便执行NotePad，或许您会使用Form的KeyPreview<BR>，设定为True，但在其他Process中按Ctl-B呢？那就没有用，这是就得设一个Keyboard<BR>Hook来拦截所有Key
in的键；再如：MouseMove的Event只在该Form或Control上有效，如镇<BR>果希望在Form的外面也能得知Mouse
Move的讯息，那只好使用Mouse
Hook来栏截Mouse<BR>的讯息。再如：您想记录方才使用者的所有键盘动作或Mosue动作，以便录巨集，那就<BR>使用JournalRecordHook，如果想停止所有Mosue键盘的动作，而放(执行)巨集，那就<BR>使用JournalPlayBack
Hook；Hook呢，可以是整个系统为范围(Remote
Hook)，即其他<BR>Process的动作您也可以拦截，也可以是LocalHook，它的拦截范围只有Process本身。<BR>Remote
Hook的Hook Function要在.Dll之中，Local
Hook则在.Bas中。<BR>在VB如何设定Hook呢？使用SetWindowsHookEx()</P>
<P>Declare Function SetWindowsHookEx Lib "user32" Alias
"SetWindowsHookExA" _<BR> (ByVal
idHook As Long, _<BR>
ByVal lpfn As Long,
_<BR> ByVal hmod As
Long,
_<BR> ByVal dwThreadId As
Long) As Long</P>
<P>idHook代表是何种Hook，有以下几种<BR> Public Const
WH_CALLWNDPROC = 4<BR> Public Const
WH_CALLWNDPROCRET = 12<BR> Public Const WH_CBT =
5<BR> Public Const WH_DEBUG =
9<BR> Public Const WH_FOREGROUNDIDLE =
11<BR> Public Const WH_GETMESSAGE =
3<BR> Public Const WH_HARDWARE =
8<BR> Public Const WH_JOURNALPLAYBACK =
1<BR> Public Const WH_JOURNALRECORD =
0<BR> Public Const WH_KEYBOARD =
2<BR> Public Const WH_MOUSE =
7<BR> Public Const WH_MSGFILTER =
(-1)<BR> Public Const WH_SHELL =
10<BR> Public Const WH_SYSMSGFILTER = 6</P>
<P>lpfn代表Hook Function所在的Address，这是一个CallBack
Fucnction，当挂上某个<BR>
Hook时，我们便得定义一个Function来当作某个讯息产生时，来处理它的Function<BR>
，这个Hook Function有一定的叁数格式</P>
<P> Private Function HookFunc(ByVal nCode As Long,
_<BR>
ByVal wParam As Long,
_<BR>
ByVal lParam As Long ) As Long</P>
<P> nCode
代表是什麽请况之下所产生的Hook，随Hook的不同而有不同组的可能值<BR>
wParam lParam 传回值则随Hook的种类和nCode的值之不同而不同。</P>
<P> 因这个叁数是一个 Function的Address所以我们固定将Hook
Function放在.Bas中，<BR> 并以AddressOf HookFunc传入。至於Hook
Function的名称我们可以任意给定，不一<BR> 定叫 HookFunc</P>
<P>hmod 代表.DLL的hInstance，如果是Local
Hook，该值可以是Null(VB中可传0进去)，<BR> 而如果是Remote
Hook，则可以使用GetModuleHandle(".dll名称")来传入。</P>
<P>dwThreadId
代表执行这个Hook的ThreadId，如果不设定是那个Thread来做，则传0(所以<BR>
一般来说，Remote Hook传0进去)，而VB的Local Hook一般可传App.ThreadId进去</P>
<P>值回值
如果SetWindowsHookEx()成功，它会传回一个值，代表目前的Hook的Handle，<BR>
这个值要记录下来。</P>
<P>因为A程式可以有一个System Hook(Remote Hook)，如KeyBoard
Hook，而B程式也来设一<BR>个Remote的KeyBoard
Hook，那麽到底KeyBoard的讯息谁所拦截？答案是，最後的那一个<BR>所拦截，也就是说A先做keyboard
Hook，而後B才做，那讯息被B拦截，那A呢？就看B的<BR>Hook Function如何做。如果B想让A的Hook
Function也得这个讯息，那B就得呼叫<BR>CallNextHookEx()将这讯息Pass给A，於是产生Hook的一个连线。如果B中不想Pass这讯息<BR>给A，那就不要呼叫CallNextHookEx()。</P>
<P>Declare Function CallNextHookEx Lib "user32" Alias "CallNextHookEx"
_<BR> (ByVal hHook As
Long, _<BR> ByVal
ncode As Long, _<BR>
ByVal wParam As Long,
_<BR> lParam As Any)
As Long</P>
<P>hHook值是SetWindowsHookEx()的传回值，nCode, wParam, lParam则是Hook
Procedure<BR>中的三个叁数。</P>
<P>最後是将这Hook去除掉，请呼叫UnHookWindowHookEx()</P>
<P>Declare Function UnhookWindowsHookEx Lib "user32" Alias
"UnhookWindowsHookEx"
_<BR> (ByVal hHook As
Long) As Long</P>
<P>hHook便是SetWindowsHookEx()的传回值。此时，以上例来说，B程式结束Hook，则换A可<BR>以直接拦截讯息。</P>
<P><BR>KeyBoard Hook的范例</P>
<P>Hook Function的三个叁数</P>
<P>nCode
wParam
lParam
传回值<BR>=========== ==========================
==============
================<BR>HC_ACTION 表按键Virtual
Key
与WM_KEYDOWN同
若讯息要被处理传0<BR>或
反之传1<BR>HC_NOREMOVE</P>
<P><BR>Public hHook as Long</P>
<P>Public Sub UnHookKBD()<BR>If hnexthookproc <> 0
Then<BR> UnhookWindowsHookEx
hHook<BR> hHook = 0<BR>End If<BR>End Sub</P>
<P>Public Function EnableKBDHook()<BR>If hHook <> 0
Then<BR> Exit Function<BR>End If<BR>hhook =
SetWindowsHookEx(WH_KEYBOARD, AddressOf
_<BR>
MyKBHFunc, App.hInstance, App.ThreadId)<BR>End Function</P>
<P>Public Function MyKBHFunc(ByVal iCode As Long,
_<BR> ByVal wParam As Long, ByVal lParam As
Long) As Long<BR> MyKBHfunc = 0 '表示要处理这个讯息</P>
<P> If wParam = vbKeySnapshot Then '侦测
有没有按到PrintScreen键<BR> MyKBHFunc = 1
'在这个Hook便吃掉这个讯息<BR> End If<BR> Call
CallNextHookEx(hHook, iCode, wParam, lParam) '传给下一个Hook<BR>End
Function</P>
<P>至於其他的 Hook的详细资料与nCode,wParam, lParam的意义，请查Win32 Help<BR>或Windows 95: A
Developer's Guide (Jeffrey Richter着)(中译本:<BR>基峰 李书良译 侯俊杰总监
Windows95程式设计指南)</P>
<P></P>
<P></P>
<P><BR>按下HotKey以叫起视窗<BR>来源:cww<BR>如何做到在任何一个程式之下，按下某个HotKey组合键，便将我们的视窗Activate起来，<BR>这便得使用
WM_SETHOTKEY 来达成</P>
<P>WM_SETHOTKEY所需的叁数如下：<BR>wParam = (WPARAM) MAKEWORD(vkey,
modifiers) <BR>lParam = 0</P>
<P>vkey 指的是virtual-key code，它是在低位元组，modifier是以下四种键的组合，它是<BR>在高位元组。</P>
<P>HOTKEYF_ALT ALT key<BR>HOTKEYF_CONTROL
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -