C# 可以不可以做出API钩子，请高手指点

钩子(Hook)，是Windows消息处理机制的一个平台,应用程序可以在上面设置子程以监视指定窗口的某种消息，而且所监视的窗口可以是其他进程所创建的。当消息到达后，在目标窗口处理函数之前处理它。钩子机制允许应用程序截获处理window消息或特定事件。关于Hook的详细介绍，在微软的MSDN中有，http://www.microsoft.com/china/community/program/originalarticles/techdoc/hook.mspx下面是我在C#中来应用Hook：实现效果：当用户在TextBox中输入 b 的时候，TextBox 始终显示 a实现过程：1、新建一个C#的WindowsApplication2、在Form1中，添加下面一些变量：           internal enum HookType //枚举，钩子的类型        {            //MsgFilter     = -1,            //JournalRecord    = 0,            //JournalPlayback  = 1,            Keyboard         = 2,             //GetMessage       = 3,            //CallWndProc      = 4,            //CBT              = 5,            //SysMsgFilter     = 6,            //Mouse            = 7,            //Hardware         = 8,            //Debug            = 9,            //Shell           = 10,            //ForegroundIdle  = 11,            //CallWndProcRet  = 12,            //KeyboardLL        = 13,            //MouseLL           = 14,        };         IntPtr _nextHookPtr; //记录Hook编号
3、在Form1中引入必须的API           [DllImport("kernel32.dll")]
        static extern int GetCurrentThreadId(); //取得当前线程编号的API        [DllImport("User32.dll")]        internal extern static void UnhookWindowsHookEx(IntPtr handle); //取消Hook的API                [DllImport("User32.dll")]        internal extern static IntPtr SetWindowsHookEx(int idHook, [MarshalAs(UnmanagedType.FunctionPtr)] HookProc lpfn, IntPtr         hinstance, int threadID);  //设置Hook的API                [DllImport("User32.dll")]        internal extern static IntPtr CallNextHookEx(IntPtr handle, int code, IntPtr wparam, IntPtr lparam); //取得下一个Hook的API4、声明一个实现的委托

        internal delegate IntPtr HookProc(int code, IntPtr wparam, IntPtr lparam);5、添加自己的Hook处理过程
            IntPtr MyHookProc(int code, IntPtr wparam, IntPtr lparam)        {               if( code < 0 ) return CallNextHookEx(_nextHookPtr,code, wparam, lparam); //返回，让后面的程序处理该消息                         if( wparam.ToInt32() == 98 || wparam.ToInt32() == 66 ) //如果用户输入的是 b             {                this.textBox1.Text = "a";                  return   (IntPtr) 1; //直接返回了，该消息就处理结束了            }            else            {                return IntPtr.Zero; //返回，让后面的程序处理该消息            }                    } 6、添加加入Hook链和从Hook链中取消的函数         public void SetHook()        {            if( _nextHookPtr != IntPtr.Zero ) //已经勾过了                            return;             HookProc myhookProc = new HookProc(MyHookProc); //声明一个自己的Hook实现函数的委托对象             _nextHookPtr = SetWindowsHookEx((int)HookType.Keyboard, myhookProc , IntPtr.Zero ,  GetCurrentThreadId()); //加到Hook链中        }         public void UnHook()        {            if( _nextHookPtr != IntPtr.Zero )             {                UnhookWindowsHookEx(_nextHookPtr); //从Hook链中取消                 _nextHookPtr = IntPtr.Zero;            }        } 7、在Form1的Load事件中添加 SetHook() ，在Form1的closing 事件中添加 UnHook()            private void Form1_Load(object sender, System.EventArgs e)        {            SetHook();        }         private void Form1_Closing(object sender, System.ComponentModel.CancelEventArgs e)        {            UnHook();        }8、运行

    输入 b , 发现 textbox 里面显示的是 a 了！
小结:

    这是一个非常简单的Hook应用，当我们在做windows程序的时候，可能会用到这些东西。我正在试图做一个比较通用的类来进行一个封装，以便以后更好的使用。努力ing...

不是键盘鼠标钩子，是API钩子。

顺便贴个通用的键盘鼠标钩子
using System;
using System.Runtime.InteropServices;
using System.Reflection;
using System.Threading;using System.Windows.Forms;
namespace 江湖小挂挂
{

/// <summary>
/// This class allows you to tap keyboard and mouse and / or to detect their activity even when an
/// application runes in background or does not have any user interface at all. This class raises
/// common .NET events with KeyEventArgs and MouseEventArgs so you can easily retrive any information you need.
/// </summary>
/// <res>
/// created by - Georgi
/// created on - 22.05.2004 13:08:01
/// </res>
public class UserActivityHook : object
{

/// <summary>
/// Default constructor - starts hooks automatically
/// </summary>
public UserActivityHook()
{
Start();
}

~UserActivityHook()
{
Stop();
} public event MouseEventHandler OnMouseActivity;
public event KeyEventHandler KeyDown;
public event KeyPressEventHandler KeyPress;
public event KeyEventHandler KeyUp; public delegate int HookProc(int nCode, Int32 wParam, IntPtr lParam); static int hMouseHook = 0; //Declare mouse hook handle as int.
static int hKeyboardHook = 0; //Declare keyboard hook handle as int. //values from Winuser.h in Microsoft SDK.
public const int WH_MOUSE_LL = 14; //mouse hook constant
public const int WH_KEYBOARD_LL = 13; //keyboard hook constant HookProc MouseHookProcedure; //Declare MouseHookProcedure as HookProc type.
HookProc KeyboardHookProcedure; //Declare KeyboardHookProcedure as HookProc type.
//Declare wrapper managed POINT class.
[StructLayout(LayoutKind.Sequential)]
public class POINT
{
public int x;
public int y;
} //Declare wrapper managed MouseHookStruct class.
[StructLayout(LayoutKind.Sequential)]
public class MouseHookStruct
{
public POINT pt;
public int hwnd;
public int wHitTestCode;
public int dwExtraInfo;
} //Declare wrapper managed KeyboardHookStruct class.
[StructLayout(LayoutKind.Sequential)]
public class KeyboardHookStruct
{
public int vkCode; //Specifies a virtual-key code. The code must be a value in the range 1 to 254.
public int scanCode; // Specifies a hardware scan code for the key.
public int flags;  // Specifies the extended-key flag, event-injected flag, context code, and transition-state flag.
public int time; // Specifies the time stamp for this message.
public int dwExtraInfo; // Specifies extra information associated with the message.
}
//Import for SetWindowsHookEx function.
//Use this function to install a hook.
[DllImport("user32.dll",CharSet=CharSet.Auto,
CallingConvention=CallingConvention.StdCall)]
public static extern int SetWindowsHookEx(int idHook, HookProc lpfn,
IntPtr hInstance, int threadId); //Import for UnhookWindowsHookEx.
//Call this function to uninstall the hook.
[DllImport("user32.dll",CharSet=CharSet.Auto,
CallingConvention=CallingConvention.StdCall)]
public static extern bool UnhookWindowsHookEx(int idHook);

//Import for CallNextHookEx.
//Use this function to pass the hook information to next hook procedure in chain.
[DllImport("user32.dll",CharSet=CharSet.Auto,
CallingConvention=CallingConvention.StdCall)]
public static extern int CallNextHookEx(int idHook, int nCode,
Int32 wParam, IntPtr lParam);   public void Start()
{
// install Mouse hook
if(hMouseHook == 0)
{
// Create an instance of HookProc.
MouseHookProcedure = new HookProc(MouseHookProc); hMouseHook = SetWindowsHookEx( WH_MOUSE_LL,
MouseHookProcedure,
Marshal.GetHINSTANCE(
Assembly.GetExecutingAssembly().GetModules()[0]),
0); //If SetWindowsHookEx fails.
if(hMouseHook == 0 )
{
Stop();
throw new Exception("SetWindowsHookEx failed.");
}
}

// install Keyboard hook
if(hKeyboardHook == 0)
{
KeyboardHookProcedure = new HookProc(KeyboardHookProc);
hKeyboardHook = SetWindowsHookEx( WH_KEYBOARD_LL,
KeyboardHookProcedure,
Marshal.GetHINSTANCE(
Assembly.GetExecutingAssembly().GetModules()[0]),
0); //If SetWindowsHookEx fails.
if(hKeyboardHook == 0 )
{
Stop();
throw new Exception("SetWindowsHookEx ist failed.");
}
}
} public void Stop()
{
bool retMouse =true;
bool retKeyboard = true;
if(hMouseHook != 0)
{
retMouse = UnhookWindowsHookEx(hMouseHook);
hMouseHook = 0;
}

if(hKeyboardHook != 0)
{
retKeyboard = UnhookWindowsHookEx(hKeyboardHook);
hKeyboardHook = 0;
}

//If UnhookWindowsHookEx fails.
if (!(retMouse && retKeyboard)) throw new Exception("UnhookWindowsHookEx failed.");
} private const int WM_MOUSEMOVE = 0x200;
private const int WM_LBUTTONDOWN = 0x201;
private const int WM_RBUTTONDOWN = 0x204;
private const int WM_MBUTTONDOWN = 0x207;
private const int WM_LBUTTONUP = 0x202;
private const int WM_RBUTTONUP = 0x205;
private const int WM_MBUTTONUP = 0x208;
private const int WM_LBUTTONDBLCLK = 0x203;
private const int WM_RBUTTONDBLCLK = 0x206;
private const int WM_MBUTTONDBLCLK = 0x209; private int MouseHookProc(int nCode, Int32 wParam, IntPtr lParam)
{
// if ok and someone listens to our events
if ((nCode >= 0) && (OnMouseActivity!=null))
{

MouseButtons button=MouseButtons.None;
switch (wParam)
{
case WM_LBUTTONDOWN:
//case WM_LBUTTONUP:
//case WM_LBUTTONDBLCLK:
button=MouseButtons.Left;
break;
case WM_RBUTTONDOWN:
//case WM_RBUTTONUP:
//case WM_RBUTTONDBLCLK:
button=MouseButtons.Right;
break;
}

int clickCount=0;
if (button!=MouseButtons.None)
if (wParam==WM_LBUTTONDBLCLK || wParam==WM_RBUTTONDBLCLK) clickCount=2;
else clickCount=1;

//Marshall the data from callback.
MouseHookStruct MyMouseHookStruct = (MouseHookStruct) Marshal.PtrToStructure(lParam, typeof(MouseHookStruct));
MouseEventArgs e=new MouseEventArgs(
button,
clickCount,
MyMouseHookStruct.pt.x,
MyMouseHookStruct.pt.y,
0 );
OnMouseActivity(this, e);
}
return CallNextHookEx(hMouseHook, nCode, wParam, lParam);
}
//The ToAscii function translates the specified virtual-key code and keyboard state to the corresponding character or characters. The function translates the code using the input language and physical keyboard layout identified by the keyboard layout handle.
[DllImport("user32")]
public static extern int ToAscii(int uVirtKey, //[in] Specifies the virtual-key code to be translated.
int uScanCode, // [in] Specifies the hardware scan code of the key to be translated. The high-order bit of this value is set if the key is up (not pressed).
byte[] lpbKeyState, // [in] Pointer to a 256-byte array that contains the current keyboard state. Each element (byte) in the array contains the state of one key. If the high-order bit of a byte is set, the key is down (pressed). The low bit, if set, indicates that the key is toggled on. In this function, only the toggle bit of the CAPS LOCK key is relevant. The toggle state of the NUM LOCK and SCROLL LOCK keys is ignored.
byte[] lpwTransKey, // [out] Pointer to the buffer that receives the translated character or characters.
int fuState); // [in] Specifies whether a menu is active. This parameter must be 1 if a menu is active, or 0 otherwise. //The GetKeyboardState function copies the status of the 256 virtual keys to the specified buffer.
[DllImport("user32")]
public static extern int GetKeyboardState(byte[] pbKeyState); private const int WM_KEYDOWN = 0x100;
private const int WM_KEYUP = 0x101;
private const int WM_SYSKEYDOWN = 0x104;
private const int WM_SYSKEYUP = 0x105; private int KeyboardHookProc(int nCode, Int32 wParam, IntPtr lParam)
{
// it was ok and someone listens to events
if ((nCode >= 0) && (KeyDown!=null || KeyUp!=null || KeyPress!=null))
{
KeyboardHookStruct MyKeyboardHookStruct = (KeyboardHookStruct) Marshal.PtrToStructure(lParam, typeof(KeyboardHookStruct));
// raise KeyDown
if ( KeyDown!=null && ( wParam ==WM_KEYDOWN || wParam==WM_SYSKEYDOWN ))
{
Keys keyData=(Keys)MyKeyboardHookStruct.vkCode;
KeyEventArgs e = new KeyEventArgs(keyData);
KeyDown(this, e);
}

// raise KeyPress
if ( KeyPress!=null && wParam ==WM_KEYDOWN )
{
byte[] keyState = new byte[256];
GetKeyboardState(keyState); byte[] inBuffer= new byte[2];
if (ToAscii(MyKeyboardHookStruct.vkCode,
MyKeyboardHookStruct.scanCode,
keyState,
inBuffer,
MyKeyboardHookStruct.flags)==1)
{
KeyPressEventArgs e = new KeyPressEventArgs((char)inBuffer[0]);
KeyPress(this, e);
}
}

// raise KeyUp
if ( KeyUp!=null && ( wParam ==WM_KEYUP || wParam==WM_SYSKEYUP ))
{
Keys keyData=(Keys)MyKeyboardHookStruct.vkCode;
KeyEventArgs e = new KeyEventArgs(keyData);
KeyUp(this, e);
} }
return CallNextHookEx(hKeyboardHook, nCode, wParam, lParam);
}
}
}

C#对于全局的钩子只能做鼠标和键盘的。你说的API是全局的吧，那就考虑用其他语言实现底层钩子，然后用C#调用。

偶觉得这些东东，包括Service什么的还是用VC来比较好

楼主先学会用C实现API拦截吧，不要一步登天哦，不过等你完全弄懂API拦截的原理的话，你也没必要靠C#吃饭了

这种东东你去codeproject上下载一些就是了，在c#版的pinvoke
给你链接：
http://www.codeproject.com/csharp/NetWin32Hooks.asp
pupo(泡泡)的代码来自：
http://www.codeproject.com/csharp/globalsystemhook.asp

C#只能对全局的啊.. 桌面的哪个..对应单个程序的不行..因为哪个需要一个单独的DLL不是C#的dll

lovevsnet(编程一把手) 给出的例子是消息钩子，不是API钩子，消息钩子算简单的了，但C#除了键盘鼠标钩子外，其他钩子都做不出全局钩子，至于API钩子和消息钩子是完全不同的东西，实现起来要难得多，要懂PE格式，驱动开发和汇编语言，http://www.codeproject.com/system/soviet_protector.asp
是个C语言写的例子，估计大家看了会有畏难情绪的

调试易

C# 可以不可以做出API钩子，请高手指点

解决方案 »