c# 钩子学习笔记

包括系统钩子和线程钩子,或者叫全局钩子和私有钩子。系统钩子需要一个单独的dll,这个地方耽误了不少时间,网上有说可以不用单独dll的。
现在开始贴代码,代码参照了红黑联盟中的一篇文章。

public class sethook
{
public class hooktypes
{
/// <summary>
/// 钩子类型
/// </summary>
public enum hooktype
{
wh_journalrecord = 0,//对寄送至消息队列的输入消息进行记录
wh_getmessage = 3,//对寄送至消息队列的消息进行监视
wh_journalplayback = 1,//对此前由wh_journalrecord 挂钩处理过程纪录的消息进行寄送
wh_callwndproc = 4,//在系统将消息发送至目标窗口处理过程之前，对该消息进行监视
wh_cbt = 5,//接受对cbt应用程序有用的消息
wh_msgfilter = -1,//监视由对话框、消息框、菜单条、或滚动条中的输入事件引发的消息
wh_sysmsgfilter = 6,//监视由对话框,消息框,菜单条,滚动条中的输入事件引发的消息
//8
wh_debug = 9,//对其他钩子处理过程进行调试
wh_shell = 10,//接受对外壳应用程序有用的通知
wh_foregroundidle = 11,//当应用程序的前台线程即将进入空闲状态时被调用,它有助于在空闲时间内执行低优先级的任务
#region 鼠标和键盘事件
/// <summary>
/// 对击键消息进行监视
/// </summary>
wh_keyboard = 2,
/// <summary>
/// 只能在windows nt中被安装,用来对底层的键盘输入事件进行监视
/// </summary>
wh_keyboard_ll = 13,
/// <summary>
/// 对鼠标消息进行监视
/// </summary>
wh_mouse = 7,
/// <summary>
/// 只能在windows nt中被安装,用来对底层鼠标事件进行监视
/// </summary>
wh_mouse_ll = 14,
#endregion
}
}
public abstract class hooks : hooktypes
{
public delegate int hookproc(int ncode, int wparam, intptr iparam);
/// <summary>
/// 安装钩子
/// </summary>
/// <param name="idhook">钩子类型，即它处理的消息类型</param>
/// <param name="lpfn"> 钩子函数地址</param>
/// <param name="hinstance">应用程序实例的句柄。标识包含lpfn所指的子程的dll</param>
/// <param name="threadid">安装钩子后想监控的线程的id号, 如果为0，钩子子程与所有的线程关联，即为全局钩子</param>
/// <returns>返回参数为钩子句柄,失败为null</returns>
[dllimport("user32.dll", callingconvention = callingconvention.stdcall)]
public static extern int setwindowshookex(hooktype hooktype, hookproc lpfn, intptr hinstance, int threadid);
/// <summary>
/// 卸载钩子
/// </summary>
/// <param name="idhook">要卸载的钩子句柄</param>
/// <returns></returns>
[dllimport("user32.dll", callingconvention = callingconvention.stdcall)]
public static extern bool unhookwindowshookex(int idhook);
/// <summary>
/// 继续下一个钩子
/// </summary>
/// <param name="idhook"></param>
/// <param name="ncode"></param>
/// <param name="wparam"></param>
/// <param name="iparam"></param>
/// <returns></returns>
[dllimport("user32.dll", callingconvention = callingconvention.stdcall)]
public static extern int callnexthookex(int idhook, int ncode, int wparam, intptr iparam);
/// <summary>
/// 获取当前线程编号
/// </summary>
/// <returns></returns>
[dllimport("kernel32")]
public static extern int getcurrentthreadid();
#region
/// <summary>
/// 委托对象
/// </summary>
public hookproc proc;
public abstract int setwindowshookex();
#endregion
}
public class addhook : hooks
{
hooktype hooktyp;
hookproc hookproc;
public addhook(hooktype _hooktype, hookproc _hookproc)
{
this.hooktyp = _hooktype;
this.hookproc = _hookproc;
}
public int addprivatehook()
{
return setwindowshookex();
}
/// <summary>
/// 线程钩子
/// </summary>
/// <returns></returns>
public override int setwindowshookex()
{
//int theadid = system.threading.thread.currentthread.managedthreadid(); 应对getcurrentthreadid()的过时
int hookid = 0;
object hookid_ = setwindowshookex(this.hooktyp, this.hookproc, intptr.zero, getcurrentthreadid());
if (hookid_ != null)
{
hookid = (int)hookid_;
}
return hookid;
}
　　　　//系统钩子和这差不多,安装钩子的时候后两个参数不一样
}
}

调用我新建了一个类，方便调用线程或者系统钩子,这里就不贴了