Subclassing and Hooking with Visual Basic

Description

The WH_CBT hook captures a wide variety of information about the actions a user is performing on the system. The system notifies the WH_CBT hook before any of the following actions occur:

• A window is created.

• A window is destroyed.

• A window is activated.

• A window is moved.

• A window is sized.

• A window is minimized.

• A window is maximized.

• The input focus is set to a different window.

• A user completes a system command. System commands originate from a window’s system menu, maximize button, minimize button, restore button, or close button.

• A mouse message is removed from the raw input thread (RIT).

• A keyboard message is removed from the RIT.

• The current thread is synchronized with the RIT.

Because this notification occurs before any of these actions, you can prevent the action from occurring by passing back a nonzero return value from the filter function.

You can use this hook as a thread-specific hook, or you can place it in a dynamic link library (DLL) and use it as a system-wide hook. A thread-specific hook intercepts all messages within the thread in which it is installed. When you install a hook as a system-wide hook, you must place it in a DLL. This DLL is injected into every process so that the hook can operate on all messages in the system. Chapter 3 discusses this in detail.

Filter Function Definition

The filter function for the WH_CBT hook is defined as follows:

Public Function CBTProc(ByVal uCode As Long, ByVal wParam As Long, _
                         ByVal lParam As Long) As Long

The filter function’s ...