Subclassing and Hooking with Visual Basic

Description of Hooks

The WH_KEYBOARD and WH_KEYBOARD_LL hooks intercept messages that relate to keyboard input. The main difference is that the WH_KEYBOARD_LL hook captures messages sooner in the messaging system than the WH_KEYBOARD hook does. This allows the WH_KEYBOARD_LL hook to capture certain keyboard messages that the WH_KEYBOARD hook cannot capture.

You can use the WH_KEYBOARD hook as a thread-specific hook, or you can place it in a dynamic link library (DLL) and use it as a system-wide hook. You can use the WH_KEYBOARD_LL hook only as a system-wide hook, however. A thread-specific hook intercepts all messages within the thread in which it is installed. When you install a hook as a system-wide hook, you must place it in a DLL. This DLL is injected into every process so that the hook can operate on all messages in the system. Chapter 3 discusses this in detail.

Both hooks can only monitor or remove a keyboard message; neither hook can modify the message. The WH_KEYBOARD hook can intercept two specific messages; they are WM_KEYDOWN and WM_KEYUP. The WH_KEYBOARD_LL hook can intercept these two messages as well as any WM_SYSKEYDOWN and WM_SYSKEYUP messages. There is one key combination that neither hook can remove; this is the CTRL-ALT-DEL key combination. By preventing this key combination from operating, you could open up security holes in the Windows NT/2000 operating systems. The WH_KEYBOARD_LL hook, unlike the WH_KEYBOARD hook, can detect the CTRL-ALT-DEL key combination, ...