Advanced MFC Programming

Chapter 13. Adding Special Features to Application
Events recording can be implemented by journal record hook, events playback can be implemented by
journal playback hook. Both of the hooks are system wide, and the hook procedures can reside in either a
DLL or EXE file. The installation of the two hooks is the same with that of keyboard hook, except that we
need to use WH_JOURNALRECORD or WH_JOURNALPLAYBACK parameter when calling function
::SetWindowHookEx(…). Similarly, we need to provide a hook procedure for each installed hook. Usually
the names of journal hook procedures are JournalPlaybackProc(…) and JournalRecordProc(…)
respectively. Like procedure KeyboardProc(…), both functions have three parameters, however, their
meanings are different here:
LRESULT CALLBACK JournalPlaybackProc(int code, WPARAM wParam, LPARAM lParam);
LRESULT CALLBACK JournalRecordProc(int code, WPARAM wParam, LPARAM lParam);
For journal record procedure, we need to record event only when parameter code is HC_ACTION. At this
time, the event message is stored in an EVENTMSG type object, whose address can be obtained from
parameter lParam. Structure EVENTMSG stores hardware message sent to the system message queue, along
with time stamp indicating when the message was posted. We can use the information contained in this
structure to implement playback.
Analyzing Events
Another thing we need to pay attention to is that we need to provide a way of letting the user stop
recording and rendering playback at any time. By default, Windows allows journal hook to be stopped by
any of the following key stroking: CTRL+ESC, ALT+ESC and CTRL+ALT+DEL. Besides the default
feature, it is desirable to provide a build-in function for stopping the journal hook. We can predefine a key
for this purpose. The key pressing events can be trapped by analyzing EVENTMSG type object, which has the
following format:
typedef struct tagEVENTMSG{
UINT message;
UINT paramL;
UINT paramH;
DWORD time;
HWND hwnd;
}EVENTMSG;
Member message specifies event type. In order to trap keystroke, we need to respond to WM_KEYDOWN
activities. In this case, the virtual key code is stored in the lower byte of member paramL.
Sample 13.11\Hook demonstrates journal record and playback hook implementation. Like previous
section, here hook functions are also implemented in the DLL. For this sample, 13.11\Hook is based on
13.10\Hook, and 13.11\HookLib is based on 13.10\HookLib.
For events other than specified key stroke, we need to allocate enough buffers for storing an EVENTMSG
type object and bind them together using linked list. To implement this, we can define a new structure of
our own:
typedef struct tagEVENTNODE
{
EVENTMSG Event;
struct tagEVENTNODE *lpNextEvent;
}EVENTNODE, *LPEVENTNODE;
Pointer lpNextEvent will point to the next EVENTMSG structure. This will form a singly linked list.
The following code fragment shows how events are recorded in journal record hook procedure. Like
other types of hooks, we need to call CallNextHookEx() to pass the event to other hooks if parameter code
is less than 0:
LRESULT CALLBACK JournalRecordProc(int code, WPARAM wParam, LPARAM lParam)
{
LPEVENTNODE lpEventNode;
LPEVENTMSG lpEvent;
420