The JournalRecordProc hook procedure is a callback function that records messages the system removes from the system message queue. Later, an application can use a JournalPlaybackProc hook procedure to play back the messages.
LRESULT CALLBACK JournalRecordProc(
|
int code, |
// hook code |
|
WPARAM wParam, |
// undefined |
|
LPARAM lParam |
// address of message being processed |
|
); |
|
Value |
Meaning |
|
HC_ACTION |
The lParam parameter points to an EVENTMSG structure containing information about a message removed from the system queue. The hook procedure must record the contents of the structure by copying them to a buffer or file. |
|
HC_SYSMODALOFF |
A system-modal dialog box has been destroyed. The hook procedure must resume recording. |
|
HC_SYSMODALON |
A system-modal dialog box is being displayed. Until the dialog box is destroyed, the hook procedure must stop recording. |
If code is less than zero, the hook procedure must pass the message to
the CallNextHookEx function without
further processing and should return the value returned by CallNextHookEx.
The return value is ignored.
A JournalRecordProc hook procedure must copy but not modify the messages. After the hook procedure returns control to the system, the message continues to be processed.
An application installs a JournalRecordProc hook procedure by specifying the WH_JOURNALRECORD hook type and the address of the hook procedure in a call to the SetWindowsHookEx function.
A Win32 JournalRecordProc hook procedure does not need to live in a dynamic-link library. A Win32 JournalRecordProc hook procedure can live in the application itself.
Unlike most other global hook procedures, the JournalRecordProc and JournalPlaybackProc hook procedures are always called in the context of the thread that set the hook.
An application that has installed a JournalRecordProc hook procedure should watch for the VK_CANCEL virtual keycode (which is implemented as the Ctrl+BREAK key combination on most keyboards). This virtual keycode should be interpreted by the application as a signal that the user wishes to stop journal recording. The application should respond by ending the recording sequence and removing the JournalRecordProc hook procedure. Removal is important. It prevents a journaling application from locking up the system by hanging inside a hook procedure.
This role as a signal to stop journal recording means that a Ctrl+BREAK key combination cannot itself be recorded. Since the Ctrl+C key combination has no such role as a journaling signal, it can be recorded. There are two other key combinations that cannot be recorded: Ctrl+Esc and Ctrl+Alt+Del. Those two key combinations cause the system to stop all journaling activities (record or playback), remove all journaling hooks, and post a WM_CANCELJOURNAL message to the journaling application.
JournalRecordProc is a placeholder for an application-defined or library-defined function name.
CallNextHookEx, EVENTMSG, JournalPlaybackProc, SetWindowsHookEx, WM_CANCELJOURNAL