学步园

为了显示效果，在钩子的DLL中我们会获取挂钩函数的窗体句柄，这里的主程序窗体名为"TestMain"，通过FindWindow查找。

KeyBoardHook.dll代码

library KeyBoardHook;</p> <p>{ Important note about DLL memory management: ShareMem must be the<br /> first unit in your library's USES clause AND your project's (select<br /> Project-View Source) USES clause if your DLL exports any procedures or<br /> functions that pass strings as parameters or function results. This<br /> applies to all strings passed to and from your DLL--even those that<br /> are nested in records and classes. ShareMem is the interface unit to<br /> the BORLNDMM.DLL shared memory manager, which must be deployed along<br /> with your DLL. To avoid using BORLNDMM.DLL, pass string information<br /> using PChar or ShortString parameters. }</p> <p>uses<br /> SysUtils,Windows,Messages,<br /> Classes;</p> <p>var<br /> fHook:HHOOK;<br /> //执行挂钩程序的窗体句柄<br /> CallHandle:HWND;</p> <p>{$R *.res}</p> <p>//回调过程<br /> function HookProc(code:Integer;wParam:WPARAM;lParam:LPARAM):LRESULT;stdcall;<br /> var<br /> processid:Cardinal;<br /> begin<br /> //如果有键盘动作<br /> if code = HC_Action then<br /> begin<br /> //获取注入进程的进程id<br /> processid := GetCurrentProcessId;<br /> //如果CallHandle，则查找TestMain窗体句柄<br /> if CallHandle = 0 then<br /> CallHandle := FindWindow(nil,'TestMain');<br /> //获取按键状态 小于0表示按下，如果不做判断，按键按下或抬起都会执行SendMessage<br /> //下面发送WM_USER+101消息，此消息可以用自定义的消息标识发送<br /> if GetKeyState(wParam) < 0 then<br /> SendMessage(CallHandle,WM_USER+101,wParam,processid);<br /> end<br /> else<br /> //下一个钩子<br /> Result := CallNextHookEx(fHook,code,wParam,lParam);<br /> end;</p> <p>procedure SetHook;stdcall;<br /> begin<br /> //挂钩，这里没有做挂钩失败的提示<br /> fHook := SetWindowsHookEx(WH_KEYBOARD,@HookProc,HInstance,0);<br /> end;</p> <p>procedure StopHook;stdcall;<br /> begin<br /> //摘钩<br /> if fHook <> 0 then<br /> UnhookWindowsHookEx(fHook);<br /> end;</p> <p>exports<br /> SetHook name 'SetHook',<br /> StopHook name 'StopHook';</p> <p>begin<br /> //初始CallHandle为0<br /> CallHandle := 0;<br /> end.

TestKeyBoardHook主程序代码

{<br /> 此窗体用来执行挂钩，为了方便起见，我们把系统的按键返回到该窗体的Memo组件中进行<br /> 显示，所以在dll中，做了获取主窗体的句柄的工作，以便发消息给主窗体，告诉它是哪个<br /> 按键被按下<br /> }<br /> unit TestMain;</p> <p>interface</p> <p>uses<br /> Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,<br /> Dialogs, StdCtrls,TlHelp32;</p> <p>type<br /> TfrmTestMain = class(TForm)<br /> Memo1: TMemo;<br /> btn_SetHook: TButton;<br /> btn_StopHook: TButton;<br /> procedure btn_SetHookClick(Sender: TObject);<br /> procedure btn_StopHookClick(Sender: TObject);<br /> procedure FormClose(Sender: TObject; var Action: TCloseAction);<br /> private<br /> { Private declarations }<br /> procedure WndProc(var Message: TMessage);override;<br /> public<br /> { Public declarations }<br /> end;</p> <p>var<br /> frmTestMain: TfrmTestMain;</p> <p>implementation</p> <p>procedure SetHook;stdcall;external 'KeyBoardHook';<br /> procedure StopHook;stdcall;external 'KeyBoardHook';</p> <p>{$R *.dfm}</p> <p>procedure TfrmTestMain.btn_SetHookClick(Sender: TObject);<br /> begin<br /> SetHook;<br /> end;</p> <p>procedure TfrmTestMain.btn_StopHookClick(Sender: TObject);<br /> begin<br /> StopHook;<br /> end;</p> <p>procedure TfrmTestMain.WndProc(var Message: TMessage);<br /> var<br /> hSnapShot:THandle;<br /> pEntry:TProcessEntry32;<br /> find:Boolean;<br /> proName:string;<br /> begin<br /> if Message.Msg = WM_USER+101 then<br /> begin<br /> //创建进程快照<br /> hSnapShot := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);<br /> pEntry.dwSize := SizeOf(pEntry);<br /> find := Process32First(hSnapShot,pEntry);<br /> while find do<br /> begin<br /> //取进程名字<br /> proName := pEntry.szExeFile;<br /> if pEntry.th32ProcessID = Message.LParam then Break;<br /> find := Process32Next(hSnapShot,pEntry);<br /> end;<br /> Memo1.Lines.Add('进程：' + proName + ',ID：' +IntToStr(Message.LParam)+'按下按键：'+Chr(Message.WParam));<br /> CloseHandle(hSnapShot);<br /> end;<br /> inherited;<br /> end;</p> <p>procedure TfrmTestMain.FormClose(Sender: TObject;<br /> var Action: TCloseAction);<br /> begin<br /> StopHook;<br /> end;</p> <p>end.

运行结果