Make your own free website on
Hook Framework (addins + full implementations)

Home| Main Subjects| Documentation| Downloads| Misscelaneous| FAQ| Search
Email me
Amir Israeli October 2000  Hook Framework (addins + full implementations)

Hooks Article List |  CHook class (Base Framework class : type 1) |  CHHook class (Base Framework class : type 2) |  Downloads

Definition of Hook
A Hook by definition is an ability of a window to get the messages that are directed to another window. There are several ways to do that , some are clear some require more understanding . There are enourmous uses for that feature : from tracking massages,contitions and whatever other windows are doing . You can also modify those messages : behave differently or do else then original window do : by that you modify behaviour of original tracked window. You can either return the message to original window or not.
It all depends on you.
Some commercial implementaions of hooks are Menubars (which use HHOOK hook) , Splash screen (which acquire the address of WindowProc of tracked window) , SPY is a great example of using hooks.

There are 2 ways to implement a hook : through WindowProc , or using Window resource called HHOOK.

Hooks using WindowProc
The idea is to get (if not stealing) the address of the tracked-window window procedure , when you get its address you get ALL messages that the same window does. In order to be more occurate you should replace the window proc of tracked window with a callback function (with the same prototype-signature) : The function is of shape :
. you save original address of function , and tracked window now has a new address. On doing so ALL messages that are directed to original window procedure come FIRST at your function , (but still only messages that come thorough window proc) on each message you decide whether to send it to the true targer (original tracked window) or not. A schematic overview of a function like that is :
This function if the owner supplied callback function : messages enter this function when replacing addresses of window procedures , the original window get the address of "HookWndProc" after you keep original address.

HookWndProc(HWND hwnd, UINT msg, WPARAM wp, LPARAM lp)
#ifdef _USRDLL
	// If this is a DLL, need to set up MFC state

	// Set up MFC message state just in case anyone wants it
	// This is just like AfxCallWindowProc, but we can't use that because
	// a CSubclassWnd is not a CWnd.
	MSG& curMsg = AfxGetThreadState()->m_lastSentMsg;
	MSG  oldMsg = curMsg;   // save for nesting
	curMsg.hwnd	= hwnd;
	curMsg.message = msg;
	curMsg.wParam  = wp;
	curMsg.lParam  = lp;

	LRESULT lr = 0;

	CHookWndMap& map = CHook::GetHookMap(); //get CHook relevant pointer to message
	CHook *pHook = NULL;
	map.Lookup( hwnd, pHook);
	ASSERT(pHook!=NULL); //if message here then hooked or ??? (another method ?)

	if (msg == WM_NCDESTROY) {
		// Window is being destroyed: unhook all hooks (for this window)
		// and pass msg to orginal window proc
		WNDPROC wndproc = NULL;
		if (pHook) wndproc = pHook->m_pOldWndProc;
		lr = ::CallWindowProc( wndproc, hwnd, msg, wp, lp);
	else {
		// pass to msg hook
		lr = pHook->WindowProc2(msg, wp, lp);

	curMsg = oldMsg; // pop state
	return lr;
This function is taken from CHook class which is the base class for any framwork class in this section hooks. For detailed imformation how this class works see its documentation.

Hooks using HHOOK
On this method you use an operating system resource called HHOOK . You set a hook by calling SetWindowsHookEx( ...) , You need to specify the type of hook : this means that in contrast to previous case : you DONT get messages that are equivalent to WindowProc messages but get messages of group type. Moreover you're not limited to single WindowProc hook (as in the previous case that you hook a single Window on one action) . You can get a wide hook that tracks all system.
Common types of hooks are MSG_FILTER which filters messages that dialog+message boxes ,menus etc. Mouse hooks : WH_MOUSE, WH_MOUSE_LL (for NT) : thes hooks track mouse events that occur in the system . WH_SHELL : tracks shell activity. WH_CALLWNDPROC hook has the same effect as the previous type of hook.
For each type of hook the user should supply a callbak function where messages will pass through first . Then on certain conditions you pass them back to the original destination . by calling CallNextHookEx(...) .
In both cases you need to unhook the WindowProc/resource (free it) You unhook a window procedure when the original owner window is about to destroy (usually when you get WM_NCDESTROY). You unhook HHOOK object whenever the window (owner) is about to destroy : in case hook acts on window. If you hook service messages : for example WH_SHELL you need to unhook before you're done : about to destroy.

For a list of articles regarding Window hooks press here .The list contains a short description of Hook and a picture (if available) of supplied app.

Hooks Article List
CHook class (Base Framework class : type 1)
CHHook class (Base Framework class : type 2)

Home  |  Links  |  About