C# 的HOOK问题

[zx136365192]

要做一个hook进程的程序，所搜到了鼠标键盘的，但是创建安装hook的时候返回都是0（安装失败），什么原因，我看源代码是 framework 3.5 用vs2008打不开 用vs2012打开可以正常运行钩子也正常，我改成2.0的还是可以正常运行，但是一样的代码到了vs2008环境下我自己新建的项目就不能用，钩子返回就变成0.大家有什么想法，


下面是我的钩子代码，欢迎指正，是一个单纯的鼠标钩子：
这里是form后台

namespace dis_pose
{
public partial class testHook : Form
{
public testHook()
{
InitializeComponent();
}
private GlobalHook hook;
[DllImport("user32")]
private static extern IntPtr GetForegroundWindow();
private void testHook_Load(object sender, EventArgs e)
{
hook = new GlobalHook();
hook.OnMouseActivity += new MouseEventHandler(this.MyMouseClick);
hook.Start();
}
private void MyMouseClick(object sender, System.Windows.Forms.MouseEventArgs e)
{
if (e.Button == System.Windows.Forms.MouseButtons.Left)
this.textBox1.Text += "坐标：X= " + e.X + " Y=" + e.Y + "--------";
}

private void testHook_FormClosing(object sender, FormClosingEventArgs e)
{
if (hook != null)
hook.Stop();
}

}
}


下面是hook类：


namespace dis_pose
{
[StructLayout(LayoutKind.Sequential)]
public class MouseHookStruct //鼠标钩子结构管理
{
public POINT pt;
public int hwnd;
public int wHitTestCode;
public int dwExtraInfo;
}
[StructLayout(LayoutKind.Sequential)]
public class POINT
{
public int x;
public int y;
}
public class GlobalHook
{
//安装钩子
[DllImport("user32.dll", CharSet = CharSet.Auto, CallingConvention = CallingConvention.StdCall)]
public static extern int SetWindowsHookEx(int idHook, GlobalHookProc lpfn,
IntPtr hInstance, int threadId);
//进行到下一步
[DllImport("user32.dll", CharSet = CharSet.Auto, CallingConvention = CallingConvention.StdCall)]
public static extern int CallNextHookEx(int idHook, int nCode,
Int32 wParam, IntPtr lParam);
//卸载钩子
[DllImport("user32.dll", CharSet = CharSet.Auto, CallingConvention = CallingConvention.StdCall)]
public static extern bool UnhookWindowsHookEx(int idHook);

public event MouseEventHandler OnMouseActivity;//鼠标事件
static int hMouseHook = 0;//钩子句柄为int
public delegate int GlobalHookProc(int nCode, Int32 wParam, IntPtr lParam);
public delegate int HookProc(int code, Int32 wparm, IntPtr iparem);
GlobalHookProc MouseHookProcedure; //委托实例
public GlobalHook()
{
Start();
}
~GlobalHook()
{
Stop();
}
public const int WH_MOUSE_LL = 14;//常数
public void Start()
{
if (hMouseHook == 0)
{
MouseHookProcedure = new GlobalHookProc(MouseHookProc);//实例化委托
hMouseHook = SetWindowsHookEx(WH_MOUSE_LL, MouseHookProcedure, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]), 0);//得钩子句柄过程
if (hMouseHook == 0)
Stop();//写入钩子失败
}
}
public void Stop()
{
bool retMouse = true;
if (hMouseHook != 0)
{
retMouse = UnhookWindowsHookEx(hMouseHook);
hMouseHook = 0;
}
}
private const int WM_LBUTTONDOWN = 0x201;//左
private const int WM_RBUTTONDOWN = 0x204;//右
private const int WM_LBUTTONDBLCLK = 0x203;//左双击
private const int WM_RBUTTONDBLCLK = 0x206;//右双击

private int MouseHookProc(int ncode, Int32 wparam, IntPtr iparam)
{
if (ncode >= 0 && OnMouseActivity != null)
{
MouseButtons button = MouseButtons.None;
switch (wparam)
{
case WM_LBUTTONDOWN:
button = MouseButtons.Left;
break;
case WM_RBUTTONDOWN:
button = MouseButtons.Right;
break;
}
int clickcount = 0;
if (button != MouseButtons.None)
if (wparam == WM_LBUTTONDBLCLK || wparam == WM_RBUTTONDBLCLK)
clickcount = 2;
else
clickcount = 1;
MouseHookStruct myMouseHookStruct = (MouseHookStruct)Marshal.PtrToStructure(iparam, typeof(MouseHookStruct));
MouseEventArgs e = new MouseEventArgs(button,clickcount,myMouseHookStruct.pt.x,myMouseHookStruct.pt.y,0);
OnMouseActivity(this, e);
}
return CallNextHookEx(hMouseHook, ncode, wparam, iparam);
}
}
}



重点是 如何hook NTcreateProcessEx ,愁

[zx136365192]

来点人瞧瞧啊啊啊啊

[1987andy]

可以参考下我的文章 http://www.cnblogs.com/andy1987/p/3311111.html http://www.cnblogs.com/andy1987/p/3313724.html 我的Hook 是C++写的，其实我原先的SetWidowHookEx..挂钩的过程也是在C#中作的，只是后面索性放到C++里面了。 钩子挂钩失败，可以看看是SetWindowHookEx的第三个参数不对？ 我没有具体的看代码，因为他太乱了，而且看楼主的描述，在VS2010能正常跑起来在VS2008中不行，说明代码是没有问题的，应该是在转到2008工程时候是不是少了什么，自己查看下~ 因为楼主的目的是Hook NtCreateProcessEx所以我给出了上面两个链接可能会表适合你

[1987andy]

如果在Hook NtCreateProcessEx时候由什么问题，可以给我邮件或者给我博客留言

[zx136365192]

引用 3 楼 u011573693 的回复:

如果在Hook NtCreateProcessEx时候由什么问题，可以给我邮件或者给我博客留言

感谢，，我去看看博客然后再研究下，有问题在找你，

[PaulyJiang]

标注一个，有研究这方面的想法一直没时间去搞

[zx136365192]

如何hook NTcreateProcessEx ， 就是如何hook到要启动的进程，我来决定让不让它进行启动，winform下 C# 楼上的看不懂。

[zx136365192]

自己写了一些，写不下去了，大家给点想法。

[zx136365192]

public class GlobalHook { public GlobalHook() { } [DllImport("user32.dll", CharSet = CharSet.Auto, CallingConvention = CallingConvention.StdCall)] public static extern int SetWindowsHookEx(int idHook, ShellHookProc lpfn, IntPtr hInstance, int threadId); [DllImport("user32.dll", CharSet = CharSet.Auto, CallingConvention = CallingConvention.StdCall)] public static extern bool UnhookWindowsHookEx(int idHook); [DllImport("user32.dll", CharSet = CharSet.Auto, CallingConvention = CallingConvention.StdCall)] public static extern int CallNextHookEx(int idHook, int nCode, Int32 wParam, IntPtr lParam); static int hHook = 0;//钩子句柄设置为0 //public event OnProcessActivity;//拦截事件 public delegate int ShellHookProc(int nCode, Int32 wParam, IntPtr lParam);//这里用到委托 ShellHookProc HookProcedure; private const int WH_SHELL = 10;//常数 public void Start() { HookProcedure = new ShellHookProc(HookProc); try { hHook = SetWindowsHookEx(WH_SHELL,HookProcedure,Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]),0); } catch (Exception){ } if (hHook == 0) { Stop(); } } public void Stop() { bool retProcess = true; if (hHook != 0) { retProcess = UnhookWindowsHookEx(hHook); hHook = 0; } if (!retProcess) { //fails } } private int HookProc(int nCode, Int32 wParam, IntPtr lParam) { return CallNextHookEx(hHook, nCode, wParam, lParam); } }