钩子教程 - 原理(十七) : LowLevelKeyboardProc
原文地址:http://www.zdexe.com/program/201004/591.html
方法12 : LowLevelKeyboardProc Function
The LowLevelKeyboardProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function every time a new keyboard input event is about to be posted into a thread input queue. The keyboard input can come from the local keyboard driver or from calls to the keybd_event function. If the input comes from a call to keybd_event, the input was "injected". However, the WH_KEYBOARD_LL hook is not injected into another process. Instead, the context switches back to the process that installed the hook and it is called in its original context. Then the context switches back to the application that generated the event.
LowLevelKeyboardProc钩子子程是同SetWindowsHookEx方法一起使用的、应用程序定义的或者库定义的回调函数。当每次有新的键盘输入事件即将被传递给一个线程输入队列时，系统会调用该方法。键盘输入可以来自本地键盘驱动，也可以来自对keybd_event事件的调用。如果输入来自对keybd_event事件的调用，那么输入是被“注入”的。然而，WH_KEYBOARD_LL钩子不被注入到其它进程中。因为上下文会切换回安装钩子的进程，该钩子就会在原始的上下文中被调用。然后，上下文切换回生成该事件的应用程序中。
The HOOKPROC type defines a pointer to this callback function.LowLevelKeyboardProc is a placeholder for the application-defined or library-defined function name.
HOOKPROC类型定义了指向该回调函数的指针。LowLevelKeyboardProc是程序定义的或者库定义的方法名字。
Syntax 语法
LRESULT CALLBACK LowLevelKeyboardProc(
int nCode,
WPARAM wParam,
LPARAM lParam
);
Parameters参数
nCode ：[in] Specifies a code the hook procedure uses to determine how to process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.
指定钩子子程使用的代码，钩子子程使用该值决定如何处理消息。如果nCode小于0，钩子子程必须将消息传递给CallNextHookEx方法，自己不做进一步的处理，并且要返回由方法CallNextHookEx返回的的返回值。该参数可以是下列值之一。
1．HC_ACTION ：The wParam and lParam parameters contain information about a keyboard message.参数wParam和lParam包含有和键盘消息相关的信息。
wParam ：[in] Specifies the identifier of the keyboard message. This parameter can be one of the following messages:
WM_KEYDOWN, WM_KEYUP, WM_SYSKEYDOWN, or WM_SYSKEYUP.指定键盘消息的标识符。该参数可以是以下参数之一： WM_KEYDOWN, WM_KEYUP, WM_SYSKEYDOWN, or WM_SYSKEYUP.
lParam ： [in] Pointer to a KBDLLHOOKSTRUCT structure.
指向KBDLLHOOKSTRUCT结构的指针。
Return Value返回值
If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx. If nCode is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_KEYBOARD_LL hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the rest of the hook chain or the target window procedure.
如果nCode小于0，钩子子程必须返回由方法CallNextHookEx返回的返回值。如果nCode大于等于0，并且钩子子程还没有处理消息，强烈建议调用CallNextHookEx方法，返回有它返回的返回值；否则，其它已经安装了WH_KEYBOARD_LL 钩子的应用程序将接收不到钩子通知，可能导致行为的错误。如果钩子子程已经处理了该消息，将返回一个非0值来阻止系统将消息传递给钩子链表中的其他钩子，或者目的窗体程序。
Remarks备注
An application installs the hook procedure by specifying theWH_KEYBOARD_LL hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function.
应用程序通过下面的方法安装钩子子程：指定WH_KEYBOARD_LL钩子类型；指定在调用SetWindowsHookEx的方法中的指向钩子子程的指针，
This hook is called in the context of the thread that installed it. The call is made by sending a message to the thread that installed the hook. Therefore, the thread that installed the hook must have a message loop.
钩子在安装它的线程的上下文中被调用。通过发送消息给安装该钩子的线程来实现调用。因此，安装有该钩子的线程必须有消息循环。
The hook procedure should process a message in less time than the data entry specified in the LowLevelHooksTimeout value in the following registry key:
HKEY_CURRENT_USER\Control Panel\Desktop
The value is in milliseconds. If the hook procedure does not return during this interval, the system will pass the message to the next hook.
Note that debug hooks cannot track this type of hook.
钩子子程应该用比下面时间少的时间来处理消息： 在注册表的HKEY_CURRENT_USER\Control Panel\Desktop键的 LowLevelHooksTimeout值指定的时间，该值是以毫秒为单位的。如果钩子子程在这个间隔内没有返回，系统将把消息传递给下一个钩子。
注意：调试钩子不能跟踪该类型的钩子。
