利用Hook技术实现键盘监控

在很多体例中，出于安定或其它因为，往往诉求随时对键盘举行监察和控制，一个专科的监察和控制步调必需完备零点，一是及时；二是动作引导图标运转。本质运用中把运用hook（即钩子）本领编写的运用步调增添到windows的工作栏的引导区中就不妨很好的到达这个手段。我在参考了api扶助文书档案普通上，按照在delphi开拓情况中的简直实行辨别对这两局部举行精细阐明。 一、hook(钩子)的实行： ---- hook是运用步调在microsoft windows 动静处置进程中树立的用来监察和控制动静流而且处置体例中尚未达到手段窗口的某一典型动静进程的体制。即使hook进程在运用步调中实行，若运用步调不是暂时窗口时，该hook就不起效率；即使hook在dll中实行，步调在运转中动静挪用它，它能及时对体例举行监察和控制。按照须要，咱们沿用的是在dll中实行hook的办法。 ---- 1．兴建一个导出两个因变量的dll文献，在hookproc.pas中设置了钩子简直实行进程。代码如次： library keyspy; uses windows, messages, hookproc in 'hookproc.pas'; exports setkeyhook, endkeyhook; begin nexthookproc:=0; procsaveexit:=exitproc; exitproc:=@keyhookexit; end. 2.在hookproc.pas中实行了钩子简直进程： unit hookproc; interface uses windows, messages, sysutils, controls, stdctrls; var nexthookproc:hhook; procsaveexit:pointer; function keyboardhook(icode:integer;wparam:wparam; lparam:lparam):lresult;stdcall;export; function setkeyhook:bool;export;//加载钩子 function endkeyhook:bool;export;//卸载钩子 procedure keyhookexit;far; const afilename='c:\debug.txt';//将键盘输出举措写入文献中 var debugfile:textfile; implementation function keyboardhookhandler(icode:integer;wparam:wparam; lparam:lparam):lresult;stdcall;export; begin if icode<0 then begin result:=callnexthookex(hnexthookproc,icode,wparam,lparam); exit; end; assignfile(debugfile,afilename); append(debugfile); if getkeystate(vk_return)<0 then begin writeln(debugfile,''); write(debugfile,char(wparam)); end else write(debugfile,char(wparam)); closefile(debugfile); result:=0; end; function endkeyhook:bool;export; begin if nexthookproc<>0 then begin unhookwindowshookex(nexthookproc); nexthookproc:=0; messagebeep(0); end; result:=hnexthookproc=0; end; procedure keyhookexit;far; begin if nexthookproc<>0 then endkeyhook; exitproc:=procsaveexit; end; end. ---- 二、win95/98运用工作栏右方引导区来表露运用步调或东西图标对引导区图目标操纵波及了一个api因变量shell_notifyicon，它有两个参数，一个是指向tnotifyicondata构造的南针，另一个是要增添、简略、变换图目标标记。经过该函因变量将运用步调的图标增添到引导区中，使其动作图标运转,减少专科特性。当步调起动后，用鼠标右键点击图标，则弹出一个菜单，可采用sethook或endhook。 unit kb; interface uses windows, messages, sysutils, classes, graphics, controls, forms, dialogs, stdctrls, menus,shellapi; const icon_id=1; mi_iconevent=wm_user+1;//设置一个用户动静 type tform1 = class(tform) popupmenu1: tpopupmenu; sethook1: tmenuitem; endhook1: tmenuitem; n1: tmenuitem; about1: tmenuitem; close1: tmenuitem; gettext1: tmenuitem; procedure formcreate(sender: tobject); procedure sethook1click(sender: tobject); procedure endhook1click(sender: tobject); procedure formdestroy(sender: tobject); procedure close1click(sender: tobject); private { private declarations } nid:tnotifyicondata; normalicon:ticon; public { public declarations } procedure icontray(var msg:tmessage); message mi_iconevent; end; var form1: tform1; implementation {$r *.dfm} function setkeyhook:bool;external 'keyspy.dll'; function endkeyhook:bool;external 'keyspy.dll'; procedure tform1.icontray(var msg:tmessage); var pt:tpoint; begin if msg.lparam=wm_lbuttondown then sethook1click(self); if msg.lparam=wm_rbuttondown then begin getcursorpos(pt); setforegroundwindow(handle); popupmenu1.popup(pt.x,pt.y); end; end; procedure tform1.formcreate(sender: tobject); begin normalicon:=ticon.create; application.title:=caption; nid.cbsize:=sizeof(nid); nid.wnd:=handle; nid.uid:=icon_id; nid.uflags:=nif_icon or nif_message or nif_tip; nid.ucallbackmessage:=mi_iconevent; nid.hicon :=normalicon.handle; strcopy(nid.sztip,pchar(caption)); nid.uflags:=nif_message or nif_icon or nif_tip; shell_notifyicon(nim_add,@nid); setwindowlong(application.handle, gwl_exstyle,ws_ex_toolwindow); end; procedure tform1.sethook1click(sender: tobject); begin setkeyhook; end; procedure tform1.endhook1click(sender: tobject); begin endkeyhook; end; procedure tform1.formdestroy(sender: tobject); begin nid.uflags :=0; shell_notifyicon(nim_delete,@nid); end; procedure tform1.close1click(sender: tobject); begin application.terminate; end; ---- 该步调固然只用了几个shellai因变量，然而它波及到了在delphi中对dll的援用、钩子实行、对引导区的操纵、用户设置动静的处置、文献的读写等比拟要害的实质，我断定这篇作品能对很多delphi的入门者有所扶助。 ---- 该步调在win98、delphi4.0中平常运转。