0

我试图通过注册 WH_KEYBOARD_LL 和 WH_MOUSE_LL 挂钩来检测所有按键和鼠标事件。显然，这些低级挂钩不需要挂钩过程驻留在单独的 DLL 中。

我在以下示例应用程序（控制台应用程序）中有此工作。

#include <iostream>
#include <Windows.h>
#include <Winuser.h>
#include <thread>
#include <chrono>
#include <sstream>
#include <atomic>
#include <cassert>

LRESULT CALLBACK wndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
{
  std::cout << std::endl << "EVENT: " << hWnd << ", " << message << ", " << wParam << ", " << lParam << std::endl;
  return 0;
}

LRESULT CALLBACK keyboardHook(
  _In_ int    nCode,
  _In_ WPARAM wParam,
  _In_ LPARAM lParam
)
{
  std::cout << "Keyboard: " << nCode << ", " << wParam << ", " << lParam << std::endl;
  return CallNextHookEx(NULL, nCode, wParam, lParam);
}

LRESULT CALLBACK mouseHook(
  _In_ int    nCode,
  _In_ WPARAM wParam,
  _In_ LPARAM lParam
)
{
  std::cout << "Mouse: " << nCode << ", " << wParam << ", " << lParam << std::endl;
  return CallNextHookEx(NULL, nCode, wParam, lParam);
}

int main()
{
  const wchar_t pszClassName[] = L"MyMessageWindow";
  auto hInstance = GetModuleHandle(NULL);

  WNDCLASSEXW wcl;
  ZeroMemory(&wcl, sizeof(WNDCLASSEXW));

  wcl.cbSize = sizeof(WNDCLASSEXW);
  wcl.hInstance = hInstance;
  wcl.lpszClassName = pszClassName;
  wcl.lpfnWndProc = wndProc;

  assert(RegisterClassExW(&wcl) != 0);

  auto hwnd = CreateWindowW(
    pszClassName,
    pszClassName,
    WS_OVERLAPPEDWINDOW,
    CW_USEDEFAULT,
    CW_USEDEFAULT,
    CW_USEDEFAULT,
    CW_USEDEFAULT,
    HWND_MESSAGE,
    NULL,
    NULL,
    NULL
  );

  auto threadId = 0;

  std::thread t([hwnd, threadId]() {
    auto keyboardHookHandle = SetWindowsHookEx(WH_KEYBOARD_LL, keyboardHook, NULL, threadId);
    auto mouseHookHandle = SetWindowsHookEx(WH_MOUSE_LL, mouseHook, NULL, threadId);

    while (true) {
      MSG msg;
      GetMessage(&msg, hwnd, 0, 0);
    }
  });

  t.join();

  return 0;
}

所以这很有效，无论哪些应用程序处于焦点（如果有），我都可以看到打印到控制台的键盘和鼠标事件，这很棒。

但是，当我在 UMDF 驱动程序中执行此操作时，消息不会通过。对 SetWindowsHookEx 的调用似乎成功且没有错误。

我正在考虑创建一个最小的 UMDF 驱动程序来测试它是否可能，但我想我先在这里问一下，以防有人能告诉我它是否可能。如果没有，我会考虑其他一些方法。

谢谢

4

0 回答 0