有没有比系统范围的 WH_CBT 挂钩更好的方法来监视击键？
我目前正在研究一种在计算机上记录用户操作的可靠方法。我创建了一个简单的应用程序，可以在全局范围内挂钩 WH_CBT 事件，目前看来工作正常。我读过有关应用程序拥有自己的 WH_CBT 事件处理程序并且在处理后不会调用 CallNextHookEx() 函数的情况。我认为这种情况会阻止我自己使用系统范围的钩子处理该应用程序中的任何事件。
是否有其他（也许更好）的方法来劫持应用程序中的击键事件？也许与手动向进程注入 DLL 有关，如下所示：
- Pick process。
- 使用
CreateRemoteThreadEx()注入DLL。 - DLL 挂钩（绕道）一些 winapi 函数并从中收集有关击键或其他事件的信息。
在这种情况下，挂钩 GetMessage() 或 TranslateMessage() 函数就足够了吗？我是否正确，任何使用消息循环的进程都必须使用这些函数才能处理创建的窗口的事件？
I am currently researching a good reliable way of logging user actions on the computer. I created a simple app that hooks WH_CBT events globally and it seems to work fine for now. I've read about situations when an application would've their own WH_CBT event handler and would not call CallNextHookEx() function after handling it. I assume that scenario would prevent me from handling any events in that application myself with a system wide hook.
Is there any other (maybe better) way to hijack keystroke events in applications? Maybe something related to manually injecting a DLL to processes like this:
- Pick process.
- Inject DLL using
CreateRemoteThreadEx(). - DLL hooks (detours) some winapi functions and gathers information from them about keystrokes or other events.
Would hooking GetMessage() or TranslateMessage() functions be enough in that case? Am I right that any process using a Message Loop would have to use these functions in order to process events for created windows?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
使用 WH_KEYBOARD_LL 的低级键盘挂钩将是最好的（因为它会捕获所有内容），但还存在其他更具体的解决方案，例如 对父级别进行子分类任何应用程序的窗口，以捕获关键相关窗口消息，这避免了进行任何代码篡改或系统范围的过滤。
回到更全局的范围，您还可以使用基于
WH_KEYBOARD、WH_CALLWNDPROC或WH_GETMESSAGE的钩子来执行此操作，这可以在全局或线程中完成等级。这完全取决于您想要捕捉什么以及捕捉多少。A low level keyboard hooking using
WH_KEYBOARD_LLwould be the best (as it would capture everything), but other more specific solutions exist, such as sub-classing the parent level window of whatever application you targeting to capture the key related window messages, which avoids having to do any code tampering or system wide filtering.Back to a more global scope, you can also do this using
WH_KEYBOARD,WH_CALLWNDPROCorWH_GETMESSAGEbased hooks, which can be done globally or at thread level. It all depends on what and how much you are trying to capture.