What is hookproc?

An application-defined or library-defined callback function used with the SetWindowsHookEx function. The HOOKPROC type defines a pointer to this callback function. CallWndRetProc is a placeholder for the application-defined or library-defined function name.

What is SetWindowsHookEx?

The SetWindowsHookEx function will install the hook routine into the hook chain of the victim.exe process, which will be invoked whenever certain event is triggered. In our case, the event that needs to be triggered is the action that we’ve inputted into the SetWindowsHookEx function.

What is CallNextHookEx?

Hook procedures are installed in chains for particular hook types. CallNextHookEx calls the next hook in the chain. Calling CallNextHookEx is optional, but it is highly recommended; otherwise, other applications that have installed hooks will not receive hook notifications and may behave incorrectly as a result.

When to use hookproc in Win32 apps?

An application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function after the SendMessage function is called. The hook procedure can examine the message; it cannot modify it. The HOOKPROC type defines a pointer to this callback function.

Which is the pointer to the hookproc function?

The hook procedure can examine the message; it cannot modify it. The HOOKPROC type defines a pointer to this callback function. CallWndRetProc is a placeholder for the application-defined or library-defined function name. HOOKPROC Hookproc; LRESULT Hookproc( int code, WPARAM wParam, LPARAM lParam ) {…}

When does the system call the hook procedure?

The system calls this function after the SendMessage function is called. The hook procedure can examine the message; it cannot modify it. The HOOKPROC type defines a pointer to this callback function. CallWndRetProc is a placeholder for the application-defined or library-defined function name.

How to get access to hook in Hook procedure?

If you can get that address, // then you can pass it to CalcJmpOffset () above and eliminate // THookKeyboardLL::ProxyStub () completely. The important // piece is that the Proxy code above injects this class // instance’s “this” pointer into the call stack before // calling THookKeyboardLL::HookProc ()…