钩子是WINDOWS中消息处理机制的一个要点，通过安装各种钩子，应用程序能够设置相应的子例程来监视系统里的消息传递以及在这些消息到达目标窗口程序之前处理它们。钩子的种类很多，每种钩子可以截获并处理相应的消息，如键盘钩子可以截获键盘消息，鼠标钩子可以截获鼠标消息，外壳钩子可以截获启动和关闭应用程序的消息，日志钩子可以监视和记录输入事件。钩子分为线程专用钩子和全局钩子，线程专用钩子只监视指定的线程，要监视系统中的所有线程，必须用到全局钩子。对于全局钩子，钩子函数必须包含在独立的动态链接库(DLL)中，这样才能被各种相关联的应用程序调用。在WINDOWS中，日志钩子是个很特别的钩子，它只有全局钩子一种，是键盘鼠标等输入设备的消息在系统消息队列被取出时发生的，而且系统中只能存在一个这样的日志钩子，更重要是，它不必用在动态链接库中，这样可以省却了为安装一个全局钩子而建立一个动态链接库的麻烦。利用日志钩子，我们可以监视各种输入事件，下面的示例可以用来记录键盘的输入，当有按键发生时，自动记录按键动作的日期和时间以及当前激活的窗口名称。



根据网上教程编写并调试通过.-WINDOWS hook are message handling mechanism in a point, by installing a variety of hooks, the application can set the appropriate subroutine to monitor the messaging system, as well as the message arrive at these objectives deal with them before the window. A lot of the type of hook, each hook can be intercepted and processed the corresponding message, such as a keyboard hook keyboard can be intercepted message, the mouse can be intercepted mouse message hook, hook shell can be intercepted by the application to start and turn off the message, log hook can monitor and record input case. Hook into thread-specific hook and global hook, thread-specific hook to monitor only the specified thread, it is necessary to monitor the system all the threads must be used in the overall hook. The overall hook, hook function must be included in a separate dynamic-link library (DLL), this can be a variety of applications associated call. In WINDOWS, the log is a very special hook the hook, it is only a