KeyBoard Hooks

• Download demo project - 18 Kb

Introduction

Hooks are one of the most powerful features of Windows. We can hooks to trp all the events in the Windows environment. This example shows how to trap keyboard events and save the keys to a text file.

In the Microsoft® Windows™ operating system, a hook is a mechanism by which a function can intercept events (messages, mouse actions, keystrokes) before they reach an application. The function can act on events and, in some cases, modify or discard them. Functions that receive events are called filter functions and are classified according to the type of event they intercept. For example, a filter function might want to receive all keyboard or mouse events. For Windows to call a filter function, the filter function must be installed — that is, attached to a Windows hook (for example, to a keyboard hook). Attaching one or more filter functions to a hook is known as setting a hook. If a hook has more than one filter function attached, Windows maintains a chain of filter functions. The most recently installed function is at the beginning of the chain, and the least recently installed function is at the end.

When a hook has one or more filter functions attached and an event occurs that triggers the hook, Windows calls the first filter function in the filter function chain. This action is known as calling the hook. For example, if a filter function is attached to the Computer Based Training (CBT) hook and an event that triggers the hook occurs (for example, a window is about to be created), Windows calls the CBT hook by calling the first function in the filter function chain.

To maintain and access filter functions, applications use the SetWindowsHookEx and the UnhookWindowsHookEx functions.

An Example

The CALLBACK function in my example is given below..

LRESULT __declspec(dllexport)__stdcall  CALLBACK KeyboardProc(int nCode,WPARAM wParam, 
                            LPARAM lParam)
{
    char ch;            
    if (((DWORD)lParam & 0x40000000) &&(HC_ACTION==nCode))
    {        
        if ((wParam==VK_SPACE)||(wParam==VK_RETURN)||(wParam>=0x2f ) &&(wParam<=0x100)) 
        {
            f1=fopen("c:\\report.txt","a+");
            if (wParam==VK_RETURN)
            {
                ch='\n';
                fwrite(&ch,1,1,f1);
            }
            else
            {
                   BYTE ks[256];
                GetKeyboardState(ks);

                WORD w;
                UINT scan=0;
                ToAscii(wParam,scan,ks,&w,0);
                ch = char(w); 
                fwrite(&ch,1,1,f1);
            }
        fclose(f1);
        }
    }

    LRESULT RetVal = CallNextHookEx( hkb, nCode, wParam, lParam );
    return  RetVal;
}

The installhook function that is installing the hook function in my example is given below.

BOOL __declspec(dllexport)__stdcall installhook()
{
    f1=fopen("c:\\report.txt","w");
    fclose(f1);
    hkb=SetWindowsHookEx(WH_KEYBOARD,(HOOKPROC)KeyboardProc,hins,0);

    return TRUE;
}