通過SetWindowsHookEx方法安裝鉤子，該函式指定處理攔截訊息的鉤子函式（回撥函式），可在鉤子函式中自定義訊息的處理，可修改訊息或遮蔽訊息。鉤子函式的格式是固定為：
LRESULT CALLBACK CallBackProc(      
          Int nCode,
          WPARAM wParam,
          LPARAM lParam);

    nCode引數說明:
    [in] Specifies whether the hook procedure must process the message. If nCode is HC_ACTION, the hook procedure must process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and must return the value returned by CallNextHookEx.

    指定鉤子子程是否必須處理該訊息。如果nCode是HC_ACTION，鉤子子程就必須處理該訊息。如果nCode小於0，鉤子子程就必須將該訊息傳遞給CallNextHookEx，自己不對訊息進行進一步的處理，必須返回由CallNextHookEx 方法返回的返回值。

    對於不同型別的鉤子，其傳入的引數也不一樣，以下為各類鉤子的引數說明：

1、WH_CALLWNDPROC
引數說明：
    wParam ：[in] Specifies whether the message was sent by the current thread. If the message was sent by the current thread, it is nonzero; otherwise, it is zero. 
    指定訊息是否由當前執行緒發出。如果訊息是由當前執行緒發出的，該值就是非0；否則，就是0。

    lParam ：[in] Pointer to a CWPSTRUCT structure that contains details about the message.
    指向CWPSTRUCT結構的指標，該結構含有訊息的細節資訊。

返回值
    If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx.  If nCode is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_CALLWNDPROC hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero. 
    如果nCode小於0，鉤子子程必須返回由CallNextHookE方法返回的返回值。如果nCode大於等於0，強烈要求呼叫CallNextHookEx方法，並返回由它返回的返回值；否則，其他已經安裝了WH_CALLWNDPROC鉤子的應用程式將收不到鉤子通知，可能導致行為的錯誤。如果鉤子子程沒有呼叫CallNextHookEx方法,返回值應該為 0。

備註
    The CallWndProc hook procedure can examine the message, but it cannot modify it. After the hook procedure returns control to the system, the message is passed to the window procedure. 
    CallWndProc鉤子子程能夠檢查訊息，但是不能修改訊息。當鉤子子程將控制權交還給系統之後，訊息被傳遞給窗體程式。

2、WH_ CALLWNDPROCRET
    在SendMessage方法被呼叫之後，系統呼叫CallWndRetProc方法。鉤子子程能夠檢查、但是不能修改訊息。

引數說明
    wParam ：[in] Specifies whether the message is sent by the current process. If the message is sent by the current process, it is nonzero; otherwise, it is NULL. 
    指定訊息是否由當前程序發出。如果訊息是由當前程序發出的，wParam為非0；否則，為空。

    lParam ：[in] Pointer to a CWPRETSTRUCT structure that contains details about the message. 
    指向CWPSTRUCT結構的指標，該結構含有訊息的細節資訊。

返回值
    If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx.  If nCode is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_CALLWNDPROCRET hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero. 
    如果nCode小於0，鉤子子程必須返回由CallNextHookE返回的返回值。如果nCode大於等於0，強烈要求呼叫CallNextHookEx方法，並返回由它返回的返回值；否則，其他已經安裝了WH_ CALLWNDPROCRET鉤子的程式將收不到鉤子通知，可能導致行為的錯誤。如果鉤子子程沒有呼叫CallNextHookEx方法,返回值應該為0。
    
   

3、WH_CBT
    系統在下列事件發生之前呼叫該方法：
    1.啟用、建立、銷燬、最小化、最大化、移動窗體、改變窗體大小；
    2.完成系統命令；
    3.從系統訊息佇列中移除滑鼠或者鍵盤事件；
    4.設定鍵盤焦點；
    5.同步系統訊息佇列。
    
    CBT應用程式使用該鉤子子程接收來自系統的有用的通知。

引數說明:
    nCode  ：[in] Specifies a code that the hook procedure uses to determine how to process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values. 
    指定一個碼值，鉤子子程使用該值來決定如何處理訊息。如果nCode小於0，鉤子子程就必須將該訊息傳遞給CallNextHookEx方法，自己不對訊息做進一步的處理，並且應該返回由CallNextHookEx方法返回的返回值。該引數可以是以下值中的一個：
    1．HCBT_ACTIVATE  ：The system is about to activate a window. 
      系統即將建立一個窗體。
    2．HCBT_CLICKSKIPPED  ：The system has removed a mouse message from the system message queue. Upon receiving this hook code, a CBT application must install a WH_JOURNALPLAYBACK hook procedure in response to the mouse message.
      系統已經將一個滑鼠訊息從系統訊息佇列中移除。一旦收到該鉤子程式碼，CBT應用程式必須安裝一個WH_JOURNALPLAYBAC鉤子子程來響應滑鼠訊息。
    3．HCBT_CREATEWND ： A window is about to be created. The system calls the hook procedure before sending the WM_CREATE or WM_NCCREATE message to the window. If the hook procedure returns a nonzero value, the system destroys the window; the CreateWindow function returns NULL, but the WM_DESTROY message is not sent to the window. If the hook procedure returns zero, the window is created normally. 
      窗體即將被建立。系統在向窗體發出WM_CREATE 或者 WM_NCCREATE訊息之前，呼叫該鉤子子程。如果鉤子子程返回非0值，表示系統銷燬了窗體；CreateWindow方法返回Null，但是WM_DESTROY訊息並不傳送給窗體。如果鉤子子程返回0，表示窗體正常被建立。
      At the time of the HCBT_CREATEWND notification, the window has been created, but its final size and position may not have been determined and its parent window may not have been established. It is possible to send messages to the newly created window, although it has not yet received WM_NCCREATE or WM_CREATE messages. It is also possible to change the position in the z-order of the newly created window by modifying the hwndInsertAfter member of the CBT_CREATEWND structure. 
      在 HCBT_CREATEWND通知的時候，窗體已經被建立了，但是它的最終的大小和位置可能還沒有被確定，它的父窗體也可能沒有被建立起來。雖然一個新建立的窗體可能還沒有接收到WM_NCCREATE或者WM_CREATE訊息，但是向它傳送訊息是可能的。通過修改CBT_CREATEWND 結構體的hwndInsertAfter成員，改變新建立窗體的在Z軸次序的位置也是可能的。
    4．HCBT_DESTROYWND ：A window is about to be destroyed. 
      窗體即將被銷燬。
    5．HCBT_KEYSKIPPED ：The system has removed a keyboard message from the system message queue. Upon receiving this hook code, a CBT application must install a WH_JOURNALPLAYBACK hook procedure in response to the keyboard message. 
      系統已經從系統的訊息佇列中移除了一個鍵盤訊息。一旦接收到該鉤子程式碼，CBT應用程式必須安裝一個WH_JOURNALPLAYBAC鉤子來響應鍵盤訊息。
    6．HCBT_MINMAX ：A window is about to be minimized or maximized. 
      窗體即將被最小化或者最大化。
    7．HCBT_MOVESIZE ：A window is about to be moved or sized. 
      窗體即將被移動或者重置大小。
    8．HCBT_QS  ：The system has retrieved a WM_QUEUESYNC message from the system message queue. 
      系統已經收到了一個來自系統訊息佇列的WM_QUEUESYNC訊息。
    9．HCBT_SETFOCUS  ：A window is about to receive the keyboard focus. 
      窗體即將接收鍵盤焦點。
    10．HCBT_SYSCOMMAND ：A system command is about to be carried out. This allows a CBT application to prevent task switching by means of hot keys.
      系統命令即將被執行。這允許CBT程式阻止通過快捷鍵來進行任務切換。
      
    wParam ：[in] Depends on the nCode parameter. 
      取決於引數 nCode

    lParam ：[in] Depends on the nCode parameter. 
      取決於引數 nCode

返回值
    The value returned by the hook procedure determines whether the system allows or prevents one of these operations. For operations corresponding to the following CBT hook codes, the return value must be 0 to allow the operation, or 1 to prevent it: 
    鉤子子程的返回值取決於系統允許還是阻止這種操作。對於下列這些操作的CBT鉤子程式碼，如果允許則返回值必須是0，如果阻止返回值必須是1。
    HCBT_ACTIVATE ；HCBT_CREATEWND ；HCBT_DESTROYWND ；HCBT_MINMAX ；HCBT_MOVESIZE ；HCBT_SETFOCUS ；HCBT_SYSCOMMAND
    
    For operations corresponding to the following CBT hook codes, the return value is ignored: 
    對於下列這些操作的CBT鉤子程式碼，返回值被忽略
        HCBT_CLICKSKIPPED ；HCBT_KEYSKIPPED ；HCBT_QS

4、WH_DEBUG
    The DebugProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function before calling the hook procedures associated with any type of hook. The system passes information about the hook to be called to the DebugProc hook procedure, which examines the information and determines whether to allow the hook to be called. 
    DebugProc鉤子子程是和SetWindowsHookEx方法一起使用的、程式定義的或者庫定義的回撥函式。系統在呼叫和任何型別鉤子相關聯的鉤子子程之前呼叫該方法。系統將即將被呼叫的鉤子的資訊傳遞給DebugProc鉤子子程，DebugProc鉤子子程檢查該資訊，決定是否允許該鉤子被呼叫。

引數說明：
    nCode ：[in] Specifies whether the hook procedure must process the message. If nCode is HC_ACTION, the hook procedure must process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. 
    指定鉤子子程是否必須處理該訊息。如果nCode是HC_ACTION，鉤子子程就必須處理該訊息。如果nCode小於0，鉤子子程就必須將該訊息傳遞給CallNextHookEx方法，自己對訊息不做進一步處理，並且應該返回由CallNextHookEx方法返回的返回值。
    
    wParam ：[in] Specifies the type of hook about to be called. This parameter can be one of the following values. 
    指定即將被呼叫的鉤子型別。引數可以是下列之一：
    1．WH_CALLWNDPROC ：Installs a hook procedure that monitors messages sent to a window procedure. 
       安裝一個鉤子子程來監視傳送給窗體程式的訊息。
    2．WH_CALLWNDPROCRET ：Installs a hook procedure that monitors messages that have just been processed by a window procedure. 
       安裝一個鉤子子程來監視剛剛被窗體程式處理完的訊息。
    3．WH_CBT ：Installs a hook procedure that receives notifications useful to a computer-based training (CBT) application. 
       安裝一個鉤子子程來接收對CBT應用程式有用的通知。
    4．WH_DEBUG ：Installs a hook procedure useful for debugging other hook procedures. 
       安裝一個有用的鉤子子程來除錯其他鉤子子程。
    5．WH_GETMESSAGE ：Installs a hook procedure that monitors messages posted to a message queue. 
       安裝一個鉤子子程來監視傳遞給訊息佇列的訊息。
    6．WH_JOURNALPLAYBACK ：Installs a hook procedure that posts messages previously recorded by a WH_JOURNALRECORD hook procedure. 
       安裝一個鉤子子程來傳遞先前使用WH_JOURNALRECORD鉤子子程記錄的訊息。
    7．WH_JOURNALRECORD ：Installs a hook procedure that records input messages posted to the system message queue. This hook is useful for recording macros. 
       安裝一個鉤子子程來記錄傳遞給系統訊息佇列的輸入訊息。該鉤子用來記錄巨集很有用。
    8．WH_KEYBOARD ：Installs a hook procedure that monitors keystroke messages. 
       安裝一個鉤子子程來監視鍵盤敲擊訊息。
    9．WH_MOUSE Installs a hook procedure that monitors mouse messages. 
       安裝一個鉤子子程來監視滑鼠訊息。
    10．WH_MSGFILTER ：Installs a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar. The hook procedure monitors these messages only for the application that installed the hook procedure. 
       安裝一個鉤子子程來監視下列輸入事件的結果而產生的訊息：對話方塊、訊息框、選單、滾動條。該鉤子子程僅僅為安裝該鉤子子程的應用程式監視這些訊息。
    11．WH_SHELL ：Installs a hook procedure that receives notifications useful to a Shell application. 
       安裝一個鉤子子程來接收對加殼類應用程式有用的通知。
    12．WH_SYSMSGFILTER ：Installs a hook procedure that monitors messages generated as a result of an input event in a dialog box, message box, menu, or scroll bar. The hook procedure monitors these messages for all applications in the system. 
       安裝一個鉤子子程來監視下列輸入事件的結果而產生的訊息：對話方塊，訊息框，選單，滾動條。該鉤子子程為系統中所有的應用程式監視這些訊息。

    lParam  ：[in] Pointer to a DEBUGHOOKINFO structure that contains the parameters to be passed to the destination hook procedure. 
    指向DEBUGHOOKINFO結構的指標，該結構中含有傳遞給目標鉤子子程的引數。

返回值
    To prevent the system from calling the hook, the hook procedure must return a nonzero value. Otherwise, the hook procedure must call CallNextHookEx. 
    為了阻止系統呼叫該鉤子，鉤子子程必須返回一個非0值。否則，鉤子子程必須呼叫CallNextHookEx方法。

5、WH_FOREGROUNDIDLE
    The ForegroundIdleProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function whenever the foreground thread is about to become idle. 
    ForegroundIdleProc鉤子子程是和SetWindowsHookEx方法一起使用的、程式定義的或者庫定義的回撥函式。當前臺執行緒即將變成空閒時，系統將呼叫該方法。

Parameters 引數
    code ：[in] Specifies whether the hook procedure must process the message. If code is HC_ACTION, the hook procedure must process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. 
    指定鉤子子程是否必須處理訊息。如果nCode是HC_ACTION，鉤子子程就必須處理該訊息。如果nCode小於0，鉤子子程就必須將該訊息傳遞給CallNextHookEx方法，自己對訊息不做進一步處理，並且應該返回由CallNextHookEx方法返回的返回值。

    wParam ：This parameter is not used. 未使用

    lParam  ：This parameter is not used. 未使用

Return Value 返回值
    If code is less than zero, the hook procedure must return the value returned by CallNextHookEx. If code is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_FOREGROUNDIDLE hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero. 
    如果nCode小於0，鉤子子程必須返回由CallNextHookEx返回的返回值。如果nCode大於等於0，強烈要求呼叫CallNextHookEx方法，並返回由它返回的返回值；否則，其他已經安裝了WH_ CALLWNDPROCRET鉤子的程式將收不到鉤子通知，可能導致行為的錯誤。如果鉤子子程沒有呼叫CallNextHookEx方法,返回值應該是0。

6、WH_GETMESSAGE
    The GetMsgProc function is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function whenever the GetMessage or PeekMessage function has retrieved a message from an application message queue. Before returning the retrieved message to the caller, the system passes the message to the hook procedure. 
    GetMsgProc是和SetWindowsHookEx方法一起使用的、程式定義的或者庫定義的回撥函式。無論什麼時候，當GetMessage 或者 PeekMessage方法接收到來自應用程式訊息佇列的訊息時，系統都會呼叫該方法。在將收到的訊息返回給呼叫者之前，系統將訊息傳遞給鉤子子程。

Parameters 引數
    code  ： [in] Specifies whether the hook procedure must process the message. If code is HC_ACTION, the hook procedure must process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. 
    指定鉤子子程是否必須處理訊息。如果nCode是HC_ACTION，鉤子子程就必須處理該訊息。如果nCode小於0，鉤子子程就必須將該訊息傳遞給CallNextHookEx方法，自己對訊息不做進一步處理，並且應該返回由CallNextHookEx方法返回的返回值。

    wParam  ：[in] Specifies whether the message has been removed from the queue. This parameter can be one of the following values. 
    指定訊息是否已經被從佇列中移除了。該引數可以是下列值中的一個：
      1．PM_NOREMOVE ：Specifies that the message has not been removed from the queue. (An application called the function, specifying the PM_NOREMOVE flag.) 
      指定訊息尚未從佇列中移出。(應用程式在呼叫該方法的同時指定PM_NOREMOVE標誌)
      2．PM_REMOVE Specifies that the message has been removed from the queue. (An application called GetMessage, or it called the PeekMessage function, specifying the PM_REMOVE flag.) 
      指定訊息已經被從佇列中移除了。(程式呼叫GetMessage 或者PeekMessage方法的同時指定PM_REMOVE標誌)

    lParam ：[in] Pointer to an MSG structure that contains details about the message. 
    指向MSG結構的指標，結構中包含和訊息相關的細節。

Return Value 返回值
    If code is less than zero, the hook procedure must return the value returned by CallNextHookEx. If code is greater than or equal to zero, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_GETMESSAGE hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure does not call CallNextHookEx, the return value should be zero. 
    如果引數code小於0，鉤子子程必須返回由CallNextHookEx返回的返回值。如果引數code大於等於0，強烈要求呼叫CallNextHookEx方法，並返回由該方法返回的返回值；否則，其他已經安裝了WH_GETMESSAGE鉤子的程式將收不到鉤子通知，可能導致行為的錯誤。如果鉤子子程沒有呼叫CallNextHookEx方法,返回值應該是0

Remarks 備註
    The GetMsgProc hook procedure can examine or modify the message. After the hook procedure returns control to the system, the GetMessage or PeekMessage function returns the message, along with any modifications, to the application that originally called it. 
    GetMsgProc鉤子子程能夠檢查或者修改訊息。在鉤子子程將控制權交還給系統之後，GetMessage 或者PeekMessage方法將該訊息以及任何修改都一起返回給最初呼叫它的應用程式。

7、WH_JOURNALPLAYBACK
    The JournalPlaybackProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. Typically, an application uses this function to play back a series of mouse and keyboard messages recorded previously by the JournalRecordProc hook procedure. As long as a JournalPlaybackProc hook procedure is installed, regular mouse and keyboard input is disabled. 
    JournalPlaybackProc鉤子子程是和SetWindowsHookEx方法一起使用的、程式定義的或者庫定義的回撥函式。典型的，應用程式使用該方法回放前期由JournalRecordProc鉤子子程記錄下來的一系列滑鼠和鍵盤訊息。只要JournalPlaybackProc鉤子子程被安裝，常規的滑鼠和鍵盤輸入將被禁用。

Parameters 引數
    code ：[in] Specifies a code the hook procedure uses to determine how to process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values. 
    指定鉤子子程使用的程式碼，以決定如何處理該訊息。如果引數code小於0，鉤子子程不對其進行任何進一步的處理，必須將訊息傳遞給CallNextHookEx方法，返回由CallNextHookEx方法返回的返回值。該引數可以是下列值之一：
    1．HC_GETNEXT ：The hook procedure must copy the current mouse or keyboard message to the EVENTMSG structure pointed to by the lParam parameter. 
    鉤子子程必須將當前滑鼠或者鍵盤訊息拷貝給由引數lParam指向的EVENTMSG結構。
    2．HC_NOREMOVE ：An application has called the PeekMessage function with wRemoveMsg set to PM_NOREMOVE, indicating that the message is not removed from the message queue after PeekMessage processing.
    應用程式已經呼叫帶有指向PM_NOREMOVE的 wRemoveMsg 集合的PeekMessage方法，指示該訊息在PeekMessage處理完畢後，沒有從訊息佇列中移除。
    3．HC_SKIP  ：The hook procedure must prepare to copy the next mouse or keyboard message to the EVENTMSG structure pointed to by lParam. Upon receiving the HC_GETNEXT code, the hook procedure must copy the message to the structure. 
    鉤子子程必須準備拷貝下一個滑鼠或者鍵盤訊息到由lParam 指向的 EVENTMSG結構。一旦接收到HC_GETNEXT程式碼，鉤子子程必須將訊息拷貝到結構體中。
    4．HC_SYSMODALOFF ： A system-modal dialog box has been destroyed. The hook procedure must resume playing back the messages. 
    系統模式的對話方塊已經被銷燬。鉤子子程應該恢復回放訊息。
    5．HC_SYSMODALON  ： A system-modal dialog box is being displayed. Until the dialog box is destroyed, the hook procedure must stop playing back messages.
    系統模式的對話方塊正在被顯示。鉤子子程應該停止回放訊息，直到對話方塊被銷燬。

    wParam ：This parameter is not used. 該引數未使用。

    lParam  ：[in] Pointer to an EVENTMSG structure that represents a message being processed by the hook procedure. This parameter is valid only when the code parameter is HC_GETNEXT.  
    指向EVENTMSG結構的指標，該結構代表正在被鉤子子程處理的訊息。只有當引數code是HC_GETNEXT時該引數才有效。

Return Value返回值
    To have the system wait before processing the message, the return value must be the amount of time, in clock ticks, that the system should wait. (This value can be computed by calculating the difference between the time members in the current and previous input messages.) To process the message immediately, the return value should be zero. The return value is used only if the hook code is HC_GETNEXT; otherwise, it is ignored. 
    為了使系統在處理訊息之前等待，該返回值應該是系統應該等待的時間數量，該值以時鐘嘀嗒為單位（該值可以通過當前和前一個輸入訊息的time成員的差值來計算）。為了快速的處理該訊息，返回值應該是0。只有當鉤子程式碼是HC_GETNEXT時，返回值才有意義；否則，該引數被忽略。

Remarks 備註
    A JournalPlaybackProc hook procedure should copy an input message to the lParam parameter. The message must have been previously recorded by using a JournalRecordProc hook procedure, which should not modify the message. 
   JournalPlaybackProc鉤子子程應該拷貝一個輸入訊息到lparm引數。訊息必須在先前已經使用JournalRecordProc鉤子子程被記錄了下來，JournalRecordProc鉤子子程不應修改訊息。

    To retrieve the same message over and over, the hook procedure can be called several times with the code parameter set to HC_GETNEXT without an intervening call with code set to HC_SKIP. 
    為了一遍又一遍的得到同樣的訊息，鉤子子程在將code引數設定為HC_GETNEXT的情況下，可以被呼叫多次，而不涉及將code引數設定為HC_SKIP的呼叫。

    If code is HC_GETNEXT and the return value is greater than zero, the system sleeps for the number of milliseconds specified by the return value. When the system continues, it calls the hook procedure again with code set to HC_GETNEXT to retrieve the same message. The return value from this new call to JournalPlaybackProc should be zero; otherwise, the system will go back to sleep for the number of milliseconds specified by the return value, call JournalPlaybackProc again, and so on. The system will appear to be not responding. 
    如果引數code 是 HC_GETNEXT，而且返回值大於0，系統將休眠，休眠時間是返回值指定的毫秒數。當系統繼續的時候，呼叫鉤子子程，鉤子子程通過將code設定為HC_GETNEXT來重新得到同一個的訊息。從新的JournalPlaybackProc呼叫得到的返回值應該是0；否則，系統將回到休眠狀態，休眠時間是返回值指定的毫秒數，休眠過後再次呼叫JournalPlaybackProc，以此類推。系統看起來像沒有響應一樣。

    Unlike most other global hook procedures, the JournalRecordProc and JournalPlaybackProc hook procedures are always called in the context of the thread that set the hook. 
    和其他全域性的鉤子子程不一樣，JournalRecordProc 和JournalPlaybackProc鉤子子程永遠在設定該鉤子的執行緒的上下文中被呼叫。

    After the hook procedure returns control to the system, the message continues to be processed. If code is HC_SKIP, the hook procedure must prepare to return the next recorded event message on its next call. 
    在鉤子子程將控制權交還給系統之後，訊息被繼續處理。如果code引數是HC_SKIP ,鉤子子程必須準備在下一次呼叫時返回下一條記錄的事件訊息。

    Install the JournalPlaybackProc hook procedure by specifying the WH_JOURNALPLAYBACK hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function. 
    通過指定WH_JOURNALPLAYBACK鉤子型別，以及一個鉤子子程的指標(該子程在SetWindowsHookEx方法中被呼叫)來安裝JournalPlaybackProc鉤子子程。

    If the user presses CTRL+ESC OR CTRL+ALT+DEL during journal playback, the system stops the playback, unhooks the journal playback procedure, and posts a WM_CANCELJOURNAL message to the journaling application.
    在回放過程中，如果使用者按下了 CTRL+ESC 或者 CTRL+ALT+DEL組合鍵，系統將停止回放，解除安裝回放鉤子子程，傳遞一個WM_CANCELJOURNAL訊息給記錄應用程式。

    If the hook procedure returns a message in the range WM_KEYFIRST to WM_KEYLAST, the following conditions apply: 
    如果鉤子子程返回一個在WM_KEYFIRST到WM_KEYLAST範圍內的訊息，下列條件應用：

    The paramL member of the EVENTMSG structure specifies the virtual key code of the key that was pressed. 
    EVENTMSG結構的paramL成員指定被按下鍵的虛擬鍵碼。

    The paramH member of the EVENTMSG structure specifies the scan code. 
    EVENTMSG結構的paramL成員指定掃描碼。

    There's no way to specify a repeat count. The event is always taken to represent one key event. 
    沒有辦法指定重複的計數。事件總是趨於代表一個鍵事件。

8、WH_JOURNALRECORD
    The JournalRecordProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The function records messages the system removes from the system message queue. Later, an application can use a JournalPlaybackProc hook procedure to play back the messages. 
    JournalRecordProc鉤子子程是與SetWindowsHookEx一起使用的、程式定義的或者庫定義的回撥函式。該方法記錄系統從系統訊息佇列中移除的訊息。過後，應用程式可以使用JournalPlaybackProc鉤子子程回放這些訊息。

Parameters 引數
    code  ：[in] Specifies how to process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values.
    指定如何處理訊息。如果code小於0，鉤子子程不對其進行任何進一步的處理，必須將訊息傳遞給CallNextHookEx方法，並返回由CallNextHookEx方法返回的返回值。該引數可以是以下值之一：
    1．HC_ACTION  ： The lParam parameter is a pointer to an EVENTMSG structure containing information about a message removed from the system queue. The hook procedure must record the contents of the structure by copying them to a buffer or file. 
    引數lParam 是一個指向EVENTMSG結構的指標，該結構包含從系統佇列中移除的訊息的資訊。鉤子子程應該通過將訊息資訊拷貝到緩衝區中或者檔案中來記錄內容。
    2．HC_SYSMODALOFF ：A system-modal dialog box has been destroyed. The hook procedure must resume recording. 
    系統模式對話方塊已經被銷燬。鉤子子程必須恢復紀錄。
    3．HC_SYSMODALON ：A system-modal dialog box is being displayed. Until the dialog box is destroyed, the hook procedure must stop recording. 
    系統模式對話方塊正在被顯示。鉤子子程應該停止記錄，直到對話方塊被銷燬。

    wParam ：This parameter is not used. 該引數未使用。

    lParam ：[in] Pointer to an EVENTMSG structure that contains the message to be recorded. 
    指向EVENTMSG結構的指標，其中包含即將被記錄的訊息。

Return Value  返回值
    The return value is ignored. 被忽略。

Remarks 備註
    A JournalRecordProc hook procedure must copy but not modify the messages. After the hook procedure returns control to the system, the message continues to be processed. 
    JournalRecordProc鉤子子程應該複製而不是不修改訊息。在鉤子子程將控制全交還給系統後，訊息將被繼續處理。

    A JournalRecordProc hook procedure does not need to live in a dynamic-link library. A JournalRecordProc hook procedure can live in the application itself. 
    JournalRecordProc鉤子子程沒必要生存在動態連結庫中，可以在應用程式自身中生存。

    Unlike most other global hook procedures, the JournalRecordProc and JournalPlaybackProc hook procedures are always called in the context of the thread that set the hook. 
    和其它全域性鉤子子程不一樣，JournalRecordProca和 JournalPlaybackProc鉤子子程總是在設定鉤子的執行緒的上下文中被呼叫。

    An application that has installed a JournalRecordProc hook procedure should watch for the VK_CANCEL virtual key code (which is implemented as the CTRL+BREAK key combination on most keyboards). This virtual key code should be interpreted by the application as a signal that the user wishes to stop journal recording. The application should respond by ending the recording sequence and removing the JournalRecordProc hook procedure. Removal is important. It prevents a journaling application from locking up the system by hanging inside a hook procedure. 
    安裝有JournalRecordProc鉤子子程的應用程式應該監視VK_CANCEL虛擬鍵碼（在多數鍵盤上就是像CTRL+BREAK一樣實現的組合鍵）。虛擬鍵值應該被應用程式解釋為使用者希望停止日誌記錄的訊號。應用程式應該通過結束記錄佇列或者移除JournalRecordProc鉤子子程來響應使用者的訊號。可移除性是重要的，可以防止日誌應用程式由於鉤子子程內部的掛起而引起的系統鎖死。

    This role as a signal to stop journal recording means that a CTRL+BREAK key combination cannot itself be recorded. Since the CTRL+C key combination has no such role as a journaling signal, it can be recorded. There are two other key combinations that cannot be recorded: CTRL+ESC and CTRL+ALT+DEL. Those two key combinations cause the system to stop all journaling activities (record or playback), remove all journaling hooks, and post a WM_CANCELJOURNAL message to the journaling application. 
    CTRL+BREAK組合鍵扮演著停止日誌記錄的訊號的角色，這意味著CTRL+BREAK組合鍵不能被自我記錄。既然CTRL+C組合鍵沒有扮演這樣的角色，它就可以被記錄。還有其它2種組合鍵不能被記錄： CTRL+ESC 和 CTRL+ALT+DEL。.這2種組合鍵引起系統停止所有日誌活動(記錄或者回放)，移除所有日誌鉤子，傳遞WM_CANCELJOURNAL訊息給日誌記錄應用程式。

9、WH_KEYBOARD_LL
    The LowLevelKeyboardProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function every time a new keyboard input event is about to be posted into a thread input queue. The keyboard input can come from the local keyboard driver or from calls to the keybd_event function. If the input comes from a call to keybd_event, the input was "injected". However, the WH_KEYBOARD_LL hook is not injected into another process. Instead, the context switches back to the process that installed the hook and it is called in its original context. Then the context switches back to the application that generated the event.
    LowLevelKeyboardProc鉤子子程是同SetWindowsHookEx方法一起使用的、應用程式定義的或者庫定義的回撥函式。當每次有新的鍵盤輸入事件即將被傳遞給一個執行緒輸入佇列時，系統會呼叫該方法。鍵盤輸入可以來自本地鍵盤驅動，也可以來自對keybd_event事件的呼叫。如果輸入來自對keybd_event事件的呼叫，那麼輸入是被“注入”的。然而，WH_KEYBOARD_LL鉤子不被注入到其它程序中。因為上下文會切換回安裝鉤子的程序，該鉤子就會在原始的上下文中被呼叫。然後，上下文切換回生成該事件的應用程式中。

Parameters引數
    nCode ：[in] Specifies a code the hook procedure uses to determine how to process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values. 
    指定鉤子子程使用的程式碼，鉤子子程使用該值決定如何處理訊息。如果nCode小於0，鉤子子程必須將訊息傳遞給CallNextHookEx方法，自己不做進一步的處理，並且要返回由方法CallNextHookEx返回的的返回值。該引數可以是下列值之一。
    1．HC_ACTION ：The wParam and lParam parameters contain information about a keyboard message.
    引數wParam和lParam包含有和鍵盤訊息相關的資訊。

    wParam ：[in] Specifies the identifier of the keyboard message. This parameter can be one of the following messages: WM_KEYDOWN, WM_KEYUP, WM_SYSKEYDOWN, or WM_SYSKEYUP.
    指定鍵盤訊息的識別符號。該引數可以是以下引數之一： WM_KEYDOWN, WM_KEYUP, WM_SYSKEYDOWN, or WM_SYSKEYUP.

    lParam  ： [in] Pointer to a KBDLLHOOKSTRUCT structure. 
    指向KBDLLHOOKSTRUCT結構的指標。

Return Value返回值
    If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx. If nCode is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_KEYBOARD_LL hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the rest of the hook chain or the target window procedure. 
    如果nCode小於0，鉤子子程必須返回由方法CallNextHookEx返回的返回值。如果nCode大於等於0，並且鉤子子程還沒有處理訊息，強烈建議呼叫CallNextHookEx方法，返回有它返回的返回值；否則，其它已經安裝了WH_KEYBOARD_LL 鉤子的應用程式將接收不到鉤子通知，可能導致行為的錯誤。如果鉤子子程已經處理了該訊息，將返回一個非0值來阻止系統將訊息傳遞給鉤子連結串列中的其他鉤子，或者目的窗體程式。

Remarks備註
    This hook is called in the context of the thread that installed it. The call is made by sending a message to the thread that installed the hook. Therefore, the thread that installed the hook must have a message loop. 
    鉤子在安裝它的執行緒的上下文中被呼叫。通過傳送訊息給安裝該鉤子的執行緒來實現呼叫。因此，安裝有該鉤子的執行緒必須有訊息迴圈。

    The hook procedure should process a message in less time than the data entry specified in the LowLevelHooksTimeout value in the following registry key: 
    HKEY_CURRENT_USER\Control Panel\Desktop
    The value is in milliseconds. If the hook procedure does not return during this interval, the system will pass the message to the next hook.
    Note that debug hooks cannot track this type of hook.
    鉤子子程應該用比下面時間少的時間來處理訊息： 在登錄檔的HKEY_CURRENT_USER\Control Panel\Desktop鍵的 LowLevelHooksTimeout值指定的時間，該值是以毫秒為單位的。如果鉤子子程在這個間隔內沒有返回，系統將把訊息傳遞給下一個鉤子。
    注意：除錯鉤子不能跟蹤該型別的鉤子。

10、WH_KEYBOARD
    The KeyboardProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function whenever an application calls the GetMessage or PeekMessage function and there is a keyboard message (WM_KEYUP or WM_KEYDOWN) to be processed. 
    KeyboardProc鉤子子程是同SetWindowsHookEx方法一起使用的、使用者定義的或者庫定義的回撥函式。無論什麼時候，當應用程式呼叫GetMessage 或者 PeekMessage方法時，系統都呼叫該方法，將有一個鍵盤訊息(WM_KEYUP或者 WM_KEYDOWN)被處理。
    
Parameters引數
    code  ： [in] Specifies a code the hook procedure uses to determine how to process the message. If code is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values. 
    指定鉤子子程使用的程式碼，來決定如何處理該訊息。如果code小於0，鉤子子程必須將該訊息傳遞給CallNextHookEx方法，自己不進行任何進一步的處理，並且返回由CallNextHookEx方法返回的返回值。該引數可以是以下值之一：
    1．HC_ACTION ：The wParam and lParam parameters contain information about a keystroke message. 
    引數 wParam 和 lParam 包含有鍵盤敲擊訊息的資訊。
    2．HC_NOREMOVE ：The wParam and lParam parameters contain information about a keystroke message, and the keystroke message has not been removed from the message queue. (An application called the PeekMessage function, specifying the PM_NOREMOVE flag.)
    引數wParam和lParam包含有鍵盤敲擊訊息的資訊，鍵盤敲擊訊息還沒有被從訊息佇列中移除。(應用程式呼叫PeekMessage方法，同時指定PM_NOREMOVE標誌。)

    wParam ：[in] Specifies the virtual-key code of the key that generated the keystroke message. 
    指定生成鍵盤敲擊訊息的鍵的虛擬鍵碼值。

    lParam ：[in] Specifies the repeat count, scan code, extended-key flag, context code, previous key-state flag, and transition-state flag. This parameter can be one or more of the following values. 
    指定重複次數，掃描程式碼，擴充套件鍵標誌，上下文程式碼，前期的鍵狀態標誌，轉換狀態標誌。該引數可下列的一個或者多個值。
    0-15  ： Specifies the repeat count. The value is the number of times the keystroke is repeated as a result of the user's holding down the key. 
    指定重複的次數。該值是，當用戶持續按住一個鍵時，鍵盤敲擊被重複的次數。
    16-23  ：Specifies the scan code. The value depends on the OEM. 
    指定掃描程式碼。該值依賴於OEM。
    24  ：Specifies whether the key is an extended key, such as a function key or a key on the numeric keypad. The value is 1 if the key is an extended key; otherwise, it is 0. 
    指定該值是否是一個擴充套件鍵，例如功能鍵或者數字鍵盤上的鍵。如果是擴充套件鍵，該值為1，否則為0。
    25-28 ： Reserved.保留 
    29  ：Specifies the context code. The value is 1 if the ALT key is down; otherwise, it is 0. 
    指定上下文程式碼。如果ALT鍵被按下，該值為1，否則為0。
    30  : Specifies the previous key state. The value is 1 if the key is down before the message is sent; it is 0 if the key is up. 
    指定前面的鍵狀態。如果在訊息發出之前該鍵被按下，值為1；如果鍵彈起，值為0。
    31  ： Specifies the transition state. The value is 0 if the key is being pressed and 1 if it is being released. 
    指定轉換狀態。如果鍵正在被按下，該值為0，如果正在被釋放，則為1。

Return Value 返回值
    If code is less than zero, the hook procedure must return the value returned by CallNextHookEx. If code is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_KEYBOARD hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the rest of the hook chain or the target window procedure.
    如果code小於0，鉤子子程必須返回由CallNextHookEx返回的返回值。如果code大於等於0，表示鉤子子程沒有處理該訊息，強烈要求呼叫CallNextHookEx方法，並返回由它返回的返回值；否則，其它已經安裝有WH_KEYBOARD鉤子的應用程式將收不到鉤子通知，可能導致行為的錯誤。如果鉤子子程處理了該訊息，可能返回一個非0值，用來阻止系統將該訊息傳遞給鉤子連結串列中的其它鉤子或者目的窗體程式。

11、WH_MOUSE_LL
    The LowLevelMouseProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system call this function every time a new mouse input event is about to be posted into a thread input queue. The mouse input can come from the local mouse driver or from calls to the mouse_event function. If the input comes from a call to mouse_event, the input was "injected". However, the WH_MOUSE_LL hook is not injected into another process. Instead, the context switches back to the process that installed the hook and it is called in its original context. Then the context switches back to the application that generated the event. 
    LowLevelMouseProc鉤子子程是同SetWindowsHookEx方法一起使用的、應用程式定義的或者庫定義的回撥函式。系統在每次有新的滑鼠輸入事件即將被傳遞給執行緒輸入佇列時，呼叫該方法。滑鼠輸入可以來自本地滑鼠驅動或者對mouse_event方法的呼叫。如果輸入來自對mouse_event的呼叫，該輸入就是被“注入”。 然而，WH_MOUSE_LL鉤子不能被注入到其他程序。因為上下文會切換回安裝該鉤子的程序，該鉤子會在原始的上下文中被呼叫。然後，上下文切換回生成該事件的應用程式中。

Parameters 引數
    nCode ：[in] Specifies a code the hook procedure uses to determine how to process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values. 
    指定鉤子子程使用的程式碼，用來決定如何處理訊息。如果nCode小於0，鉤子子程必須將訊息傳遞給CallNextHookEx方法，自己不進行進一步的處理，並且應該返回由方法CallNextHookEx返回的返回值。引數可以是下列值之一：
    1．HC_ACTION ：The wParam and lParam parameters contain information about a mouse message.
    wParam 和 lParam 引數包含有滑鼠訊息的資訊。

    wParam ：[in] Specifies the identifier of the mouse message. This parameter can be one of the following messages: WM_LBUTTONDOWN, WM_LBUTTONUP, WM_MOUSEMOVE, WM_MOUSEWHEEL, WM_RBUTTONDOWN, or WM_RBUTTONUP. 
    指定滑鼠訊息的識別符號。引數可以是以下訊息之一： WM_LBUTTONDOWN, WM_LBUTTONUP, WM_MOUSEMOVE, WM_MOUSEWHEEL, WM_RBUTTONDOWN, WM_RBUTTONUP.

    lParam ：[in] Pointer to an MSLLHOOKSTRUCT structure. 
    指向MSLLHOOKSTRUCT結構的指標。

Return Value 返回值
    If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx. 
    如果nCode小於0，鉤子子程必須返回由方法CallNextHookEx返回的返回值。

    If nCode is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_MOUSE_LL hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the rest of the hook chain or the target window procedure. 
    如果nCode大於等於0，而且鉤子子程沒有處理該訊息，那麼強烈要求呼叫方法CallNextHookEx並返回由它返回的返回值；否則，其它已經安裝了WH_MOUSE_LL鉤子的應用程式將收不到鉤子通知，可能導致行為的錯誤。如果鉤子子程已經處理了該訊息，將返回一個非0值，用來阻止系統將訊息傳遞給鉤子連結串列中的其它鉤子或者目標窗體程式。

Remarks 備註
    An application installs the hook procedure by specifying the WH_MOUSE_LL hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function. 
    應用程式通過下面的方法安裝該鉤子子程：指定WH_MOUSE_LL鉤子型別；指定在呼叫SetWindowsHookEx的方法中的指向鉤子子程的指標。

    This hook is called in the context of the thread that installed it. The call is made by sending a message to the thread that installed the hook. Therefore, the thread that installed the hook must have a message loop. 
    該鉤子在安裝它的執行緒的上下文中被呼叫。通過傳送訊息給安裝鉤子的執行緒來實現呼叫。因此，安裝鉤子的執行緒必須有訊息迴圈。

    The hook procedure should process a message in less time than the data entry specified in the LowLevelHooksTimeout value in the following registry key: 
    HKEY_CURRENT_USER\Control Panel\Desktop
    The value is in milliseconds. If the hook procedure does not return during this interval, the system will pass the message to the next hook.
    Note that debug hooks cannot track this type of hook.
    鉤子子程應該用比下面時間少的時間來處理訊息： 在登錄檔的HKEY_CURRENT_USER\Control Panel\Desktop鍵的 LowLevelHooksTimeout值指定的時間。該值是以毫秒為單位的。如果鉤子子程在這個間隔沒有返回，系統將把訊息傳遞給下一個鉤子。注意：除錯鉤子不能追蹤該型別的鉤子。

12、WH_MOUSE
    The MouseProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function whenever an application calls the GetMessage or PeekMessage function and there is a mouse message to be processed. 
    MouseProc鉤子子程是同SetWindowsHookEx方法一起使用的、應用程式定義的或者庫定義的回撥函式。無論什麼時候，當應用程式一呼叫GetMessage 或者 PeekMessage方法，有滑鼠訊息即將被處理時，系統呼叫該方法。

Parameters 引數
    nCode ：[in] Specifies a code the hook procedure uses to determine how to process the message. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values. 
    指定鉤子子程使用的用來決定如何處理訊息的碼值。如果nCode小於0，鉤子子程必須將訊息傳遞給CallNextHookEx方法，自己不進行進一步的處理，並且要返回由CallNextHookEx方法返回的返回值。該引數可以是下列值之一： 
    1．HC_ACTION ：The wParam and lParam parameters contain information about a mouse message. 
    引數wParam 和 lParam包含和滑鼠訊息相關的資訊。
    2．HC_NOREMOVE ：The wParam and lParam parameters contain information about a mouse message, and the mouse message has not been removed from the message queue. (An application called the PeekMessage function, specifying the PM_NOREMOVE flag.)
    引數wParam 和 lParam包含和滑鼠訊息相關的資訊，滑鼠訊息還沒有從訊息佇列中移除。

    wParam ：[in] Specifies the identifier of the mouse message. 
    指定滑鼠訊息的識別符號。
    
    lParam：[in] Pointer to a MOUSEHOOKSTRUCT structure. 
    指向MOUSEHOOKSTRUCT結構的指標。

Return Value 返回值
    If nCode is less than zero, the hook procedure must return the value returned by CallNextHookEx. If nCode is greater than or equal to zero, and the hook procedure did not process the message, it is highly recommended that you call CallNextHookEx and return the value it returns; otherwise, other applications that have installed WH_MOUSE hooks will not receive hook notifications and may behave incorrectly as a result. If the hook procedure processed the message, it may return a nonzero value to prevent the system from passing the message to the target window procedure. 
    如果code小於0，鉤子子程必須返回由CallNextHookEx方法返回的返回值。如果code大於等於0，鉤子子程還沒有處理該訊息，強烈要求呼叫CallNextHookEx方法並返回由它返回的返回值；否則，其它已經安裝了WH_MOUSE鉤子的應用程式將收不到鉤子通知，可能導致行為的錯誤。如果鉤子子程已經處理了該訊息，應該返回非0值，以阻止系統將訊息傳遞給鉤子連結串列中剩餘的鉤子或者目標窗體程式。

Remarks備註
    An application installs the hook procedure by specifying the WH_MOUSE hook type and a pointer to the hook procedure in a call to the SetWindowsHookEx function. The hook procedure must not install a WH_JOURNALPLAYBACK Hook callback function.
    應用程式通過下面方法來安裝鉤子：指定WH_MOUSE鉤子型別；指定在呼叫SetWindowsHookEx的方法中指向鉤子子程的指標。該鉤子子程不應安裝WH_JOURNALPLAYBACK鉤子的回撥函式。

 
 
13、WH_SHELL 
    The ShellProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The function receives notifications of Shell events from the system. 
    The HOOKPROC type defines a pointer to this callback function. ShellProc is a placeholder for the application-defined or library-defined function name.
    ShellProc鉤子子程是同SetWindowsHookEx一起使用的、應用程式定義的或者庫定義的回撥函式。該方法接收來自系統的加殼事件通知。HOOKPROC型別定義了指向該方法的指標。ShellProc是應用程式定義的或者庫定義的方法的名字。

Parameters引數
    nCode ：[in] Specifies the hook code. If nCode is less than zero, the hook procedure must pass the message to the CallNextHookEx function without further processing and should return the value returned by CallNextHookEx. This parameter can be one of the following values. 
    指定鉤子程式碼。如果nCode小於0，鉤子子程必須將訊息傳遞給CallNextHookEx方法，自己不進行進一步的處理，並且應該返回由CallNextHookEx方法返回的返回值。該引數可以是下列值：
    1．HSHELL_ACCESSIBILITYSTATE 
    Windows 2000/XP: The accessibility state has changed. 可訪問性已經改
    
    2．HSHELL_ACTIVATESHELLWINDOW 
    The shell should activate its main window. 外殼應該啟用它的主視窗。
    
    3．HSHELL_APPCOMMAND 
    Windows 2000/XP: The user completed an input event (for example, pressed an application command button on the mouse or an application command key on the keyboard), and the application did not handle the WM_APPCOMMAND message generated by that input. 
    使用者完成一個輸入事件(例如，按下應用程式滑鼠上的命令按鈕或者鍵盤上的命令鍵)，應用程式沒有處理由該輸入產生的WM_APPCOMMAND 訊息。
    If the Shell procedure handles the WM_COMMAND message, it should not call CallNextHookEx. See the Return Value section for more information.
    如果Shell子程獲得了WM_COMMAND訊息的控制代碼，不應該呼叫CallNextHookEx 。
    
    4．HSHELL_GETMINRECT 
    A window is being minimized or maximized. The system needs the coordinates of the minimized rectangle for the window. 
    視窗正在被最小化或者最大化。系統需要窗體的最小矩形框的座標。

    5．HSHELL_LANGUAGE 
    Keyboard language was changed or a new keyboard layout was loaded.
    鍵盤語言被改變了或者新的鍵盤佈局被載入了。

    6．HSHELL_REDRAW 
    The title of a window in the task bar has been redrawn. 
    工作列中的視窗標題被重繪了。

    7．HSHELL_TASKMAN 
    The user has selected the task list. A shell application that provides a task list should return TRUE to prevent Microsoft Windows from starting its task list. 
    使用者選擇了任務列表。提供了任務列表的加殼應用程式應該返回TRUE,來阻止windows啟動任務列表。

    8．HSHELL_WINDOWACTIVATED 
    The activation has changed to a different top-level, unowned window. 
    啟用動作變成了不同的top-level，unowned 的視窗。(即，激活了不同的不明視窗，使其處於最上層。)

    9．HSHELL_WINDOWCREATED 
    A top-level, unowned window has been created. The window exists when the system calls this hook. 
    頂層的、不受控制的窗體已經被建立。當系統呼叫該鉤子時，視窗存在。

    10．HSHELL_WINDOWDESTROYED 
    A top-level, unowned window is about to be destroyed. The window still exists when the system calls this hook. 
    頂層的、不受控制的窗體即將被銷燬。當系統呼叫該鉤子的時候該窗體依然存在。

    11．HSHELL_WINDOWREPLACED 
    Windows XP: A top-level window is being replaced. The window exists when the system calls this hook. 
    在Windows XP環境下，頂層的窗體正在被替換掉。當系統呼叫該鉤子時，視窗存在。

    wParam [in] The value depends on the value of the nCode parameter, as shown in the following table.
    該值取決於引數 nCode