c# 钩子学习笔记

包括系统钩子和线程钩子,或者叫全局钩子和私有钩子。系统钩子需要一个单独的DLL,这个地方耽误了不少时间,网上有说可以不用单独DLL的。
现在开始贴代码,代码参照了红黑联盟中的一篇文章。

public class SetHook
{
public class HookTypes
{
/// <summary>
/// 钩子类型
/// </summary>
public enum HookType
{
WH_JOURNALRECORD = 0,//对寄送至消息队列的输入消息进行记录
WH_GETMESSAGE = 3,//对寄送至消息队列的消息进行监视
WH_JOURNALPLAYBACK = 1,//对此前由WH_JOURNALRECORD 挂钩处理过程纪录的消息进行寄送
WH_CALLWNDPROC = 4,//在系统将消息发送至目标窗口处理过程之前，对该消息进行监视
WH_CBT = 5,//接受对CBT应用程序有用的消息
WH_MSGFILTER = -1,//监视由对话框、消息框、菜单条、或滚动条中的输入事件引发的消息
WH_SYSMSGFILTER = 6,//监视由对话框,消息框,菜单条,滚动条中的输入事件引发的消息
//8
WH_DEBUG = 9,//对其他钩子处理过程进行调试
WH_SHELL = 10,//接受对外壳应用程序有用的通知
WH_FOREGROUNDIDLE = 11,//当应用程序的前台线程即将进入空闲状态时被调用,它有助于在空闲时间内执行低优先级的任务
#region 鼠标和键盘事件
/// <summary>
/// 对击键消息进行监视
/// </summary>
WH_KEYBOARD = 2,
/// <summary>
/// 只能在windows NT中被安装,用来对底层的键盘输入事件进行监视
/// </summary>
WH_KEYBOARD_LL = 13,
/// <summary>
/// 对鼠标消息进行监视
/// </summary>
WH_MOUSE = 7,
/// <summary>
/// 只能在windows NT中被安装,用来对底层鼠标事件进行监视
/// </summary>
WH_MOUSE_LL = 14,
#endregion
}
}
public abstract class Hooks : HookTypes
{
public delegate int HookProc(int nCode, int wParam, IntPtr IParam);
/// <summary>
/// 安装钩子
/// </summary>
/// <param name="idHook">钩子类型，即它处理的消息类型</param>
/// <param name="lpfn"> 钩子函数地址</param>
/// <param name="hInstance">应用程序实例的句柄。标识包含lpfn所指的子程的DLL</param>
/// <param name="threadId">安装钩子后想监控的线程的ID号, 如果为0，钩子子程与所有的线程关联，即为全局钩子</param>
/// <returns>返回参数为钩子句柄,失败为NULL</returns>
[DllImport("user32.dll", CallingConvention = CallingConvention.StdCall)]
public static extern int SetWindowsHookEx(HookType hooktype, HookProc lpfn, IntPtr hInstance, int threadId);
/// <summary>
/// 卸载钩子
/// </summary>
/// <param name="idHook">要卸载的钩子句柄</param>
/// <returns></returns>
[DllImport("user32.dll", CallingConvention = CallingConvention.StdCall)]
public static extern bool UnhookWindowsHookEx(int idHook);
/// <summary>
/// 继续下一个钩子
/// </summary>
/// <param name="idHook"></param>
/// <param name="nCode"></param>
/// <param name="wParam"></param>
/// <param name="IParam"></param>
/// <returns></returns>
[DllImport("user32.dll", CallingConvention = CallingConvention.StdCall)]
public static extern int CallNextHookEx(int idHook, int nCode, int wParam, IntPtr IParam);
/// <summary>
/// 获取当前线程编号
/// </summary>
/// <returns></returns>
[DllImport("kernel32")]
public static extern int GetCurrentThreadId();
#region
/// <summary>
/// 委托对象
/// </summary>
public HookProc proc;
public abstract int SetWindowsHookEx();
#endregion
}
public class AddHook : Hooks
{
HookType hooktyp;
HookProc hookproc;
public AddHook(HookType _hooktype, HookProc _hookproc)
{
this.hooktyp = _hooktype;
this.hookproc = _hookproc;
}
public int AddPrivateHook()
{
return SetWindowsHookEx();
}
/// <summary>
/// 线程钩子
/// </summary>
/// <returns></returns>
public override int SetWindowsHookEx()
{
//int theadId = System.Threading.Thread.CurrentThread.ManagedThreadId(); 应对GetCurrentThreadId()的过时
int hookId = 0;
object hookId_ = SetWindowsHookEx(this.hooktyp, this.hookproc, IntPtr.Zero, GetCurrentThreadId());
if (hookId_ != null)
{
hookId = (int)hookId_;
}
return hookId;
}
//系统钩子和这差不多,安装钩子的时候后两个参数不一样
}
}

调用我新建了一个类，方便调用线程或者系统钩子,这里就不贴了