系统钩子

曾经有一段时间特别迷恋外挂程序，因此有所了解，但仅限于皮毛，由于缺乏的知识太多就放弃了，最近有个私活需要用到钩子，所以重行来研究一番，其实也谈不上研究，我是一个C#程序员，本来就没有多少系统的知识（并不是每个C#程序员都是这样），使用win32 api对我来说还是有些困难的，所以不能给出多么高深的讲解，这里仅限于我是如何使用C#调用win32 api来实现系统钩子的。

实现一个程序来禁用所有鼠标按键，禁用任务管理器，禁用注册表等。

public class Hook
{
    // 设置钩子
    [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
    public static extern IntPtr SetWindowsHookEx(int idHook, HookHandlerDelegate lpfn, IntPtr hmod, uint dwThreadID);

    // 卸载钩子 
    [DllImport("user32.dll")]
    public static extern bool UnhookWindowsHookEx(IntPtr idHook);

    // 获取模块句柄
    [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
    public static extern IntPtr GetModuleHandle(String modulename);
    public const int WM_KEYDOWN = 0x0100;
    public const int WH_KEYBOARD_LL = 13;
    public const int WM_SYSKEYDOWN = 0x0104;
    public struct KBDLLHOOKSTRUCT
    {
        public int vkCode;
        public int scanCode;
        public int flags;
        public int time;
        public int dwExtraInfo;
    }
    public delegate int HookHandlerDelegate(int nCode, IntPtr wparam, ref KBDLLHOOKSTRUCT lparam);
    //钩子回掉委托实例
    private static HookHandlerDelegate proc;
    //钩子句柄
    private static IntPtr hKeyboardHook;

    private static int HookCallback(int nCode, IntPtr wparam, ref KBDLLHOOKSTRUCT lparam)
    {
        if (
            nCode >= 0
            &&
            (wparam == (IntPtr)WM_KEYDOWN
            ||
            wparam == (IntPtr)WM_SYSKEYDOWN)
            )
        {
            if (lparam.vkCode == 91 || lparam.vkCode == 164 || lparam.vkCode == 9 || lparam.vkCode == 115)
            {
                return 1;
            }
            else
            {
                return 0;
            }
        }
        return 0;
    }

    public static void HookStart()
    {
        if (hKeyboardHook == IntPtr.Zero)
        {
            // 创建HookProc实例 
            proc = new HookHandlerDelegate(HookCallback);
            using (Process curPro = Process.GetCurrentProcess())
            using (ProcessModule curMod = curPro.MainModule)
            {
                //定义全局钩子 
                hKeyboardHook = SetWindowsHookEx(WH_KEYBOARD_LL, proc,GetModuleHandle(curMod.FileName), 0);
            }

            if (hKeyboardHook == IntPtr.Zero)
            {
                HookStop();
                throw new Exception("钩子设置失败");
            }
        }

    }

    public static void HookStop()
    {
        bool retKeyboard = true;
        if (hKeyboardHook != IntPtr.Zero)
        {
            retKeyboard = UnhookWindowsHookEx(hKeyboardHook);
            hKeyboardHook = IntPtr.Zero;
        }
        if (!(retKeyboard)) throw new Exception("卸载钩子失败");

    }
}