系统钩子[01] 准备知识

学习钩子之前，先准备一下即将使用的一些函数和相关内容

在钩子链中安装钩子（具体函数参数作用及解释参考MSDN）

1 HHOOK SetWindowsHookEx(
2   __in  int idHook,
3   __in  HOOKPROC lpfn,
4   __in  HINSTANCE hMod,
5   __in  DWORD dwThreadId
6 );

idHook [in]

int

Specifies the type of hook procedure to be installed. This parameter can be one of the following values.

这个参数指明安装钩子的类型

lpfn [in]

HOOKPROC

Pointer to the hook procedure. If the dwThreadId parameter is zero or specifies the identifier of a thread created by a different process, the lpfn parameter must point to a hook procedure in a DLL. Otherwise, lpfn can point to a hook procedure in the code associated with the current process.

这个参数是钩子函数的指针、如果是系统级钩子则函数必须在DLL中

hMod [in]

HINSTANCE

Handle to the DLL containing the hook procedure pointed to by the lpfn parameter. The hMod parameter must be set to NULL if the dwThreadId parameter specifies a thread created by the current process and if the hook procedure is within the code associated with the current process.

这个没啥好解释、看名字猜猜都知道是什么

dwThreadId [in]

DWORD

Specifies the identifier of the thread with which the hook procedure is to be associated. If this parameter is zero, the hook procedure is associated with all existing threads running in the same desktop as the calling thread.

此参数若为0、则是系统级钩子、否则为模块
函数返回值

Return Value

HHOOK

If the function succeeds, the return value is the handle to the hook procedure.
如果执行成功、返回钩子函数的句柄

If the function fails, the return value is NULL. To get extended error information, call GetLastError.
如果执行失败、返回NULL值（Delphi应该是0）

删除安装的钩子

1 BOOL UnhookWindowsHookEx(
2   __in  HHOOK hhk
3 );

hhk [in]

HHOOK

Handle to the hook to be removed. This parameter is a hook handle obtained by a previous call toSetWindowsHookEx.

此参数传递SetWindowsHookEx的返回值

函数返回值：

如果删除钩子成功返回非零值、否则返回零