WH_KEYBOARD和WH_KEYBOARD_LL的区别

df001

what is the difference between the working of two ? For WH_KEYBOARD_LL i read that it Installs a hook procedure that monitors low-level keyboard input events. What is meant by low-level keyboard events ?

Meh, don't focus too much on the term, it doesn't clarify anything. There's a huge difference between the two. WH_KEYBOARD_LL installs a hook that requires the callback to be implemented in your own program. And you must pump a message loop so that Windows can make the callback whenever it is about to dispatch a keyboard message. Which makes it really easy to get going.

WH_KEYBOARD works very differently, it requires a DLL that can be safely injected into hooked processes. Which makes it notoriously difficult to get going, injecting DLLs without affecting a process isn't easy. Particularly on a 64-bit operating system. Nor is taking care of the inter-process communication you might need if some other process needs to know about the keystroke. Like a key logger.

The advantage of WH_KEYBOARD is that it has access to the keyboard state. Which is a per-process property in Windows. State like the active keyboard layout and the state of the modifier and dead keys matter a great deal when you want to use the hook to translate virtual keys to typing keys yourself. You can't reliably call ToUnicodeEx() from an external process.

You can't swing a cat without running into example code, google will give you plenty. So be sure to use something known-to-work if you have never written such a hook before, it will avoid a lot of grief.

WH_KEYBOARD  一般还是在系统处理后处理，注入式键盘挂钩（注入dll到目标进程估计没人会喜欢），所以像Ctrl+alt+del 系统会先处理掉，WH_KEYBOARD没法截获

WH_KEYBOARD_LL是在系统处理前处理的，所以很容易引起挂起之类的问题，不过操作系统通过LowLevelHooksTimeout控制超时，如果这个时间后HOOK函数还没返回，就直接被忽略了

所以要监视键盘，还是用WH_KEYBOARD_LL吧