WH_JOURNALRECORD hook params

WH_JOURNALRECORD hook

I'm writing a control to allow remote monitoring and shadowing of VB apps that uses a WH_JOURNALRECORD hook. All works grand, returning an EVENTMSG structure whenever the user interacts with my app - but I need to convert this to a proprietry message format 'cos the .hwnd on the remote machine is fairly meaningless on the debugging machine...so, I have the following structure:


Type EVENTMSG
message as Long
paramL as Long
paramH as Long
time as Long
hwnd as Long
End Type




From investigation, message is a WM_* message and paramL and paramH vary according to what message it is
(i.e. for all the mouse messages, paramL is the x position and paramH is the y position)
but hwnd is often zero so I have to do an IsWindow around that.

Anyhow - (1) Anyone have any documentation on EVENTMSG that specifies the link between the message and the meaning of the paramH and paramL members or will I have to do all that all by trial and error, and (2) anybody got a better way of getting the control name and index from the .hwnd without iterating the controls collections?

Thanks in advance,
Duncan


-------------------------------------------------
Ex. Datis: Duncan Jones
Merrion Computing Ltd
http://www.merrioncomputing.com/EventVB/Overview.htm - Flatten the API learning curve

nobody?

-------------------------------------------------
Ex. Datis: Duncan Jones
Merrion Computing Ltd
http://www.merrioncomputing.com/EventVB/Overview.htm - Flatten the API learning curve

Investigation so far

Where message is WM_MOUSEMOVE or WM_LBUTTON* then .ParamH is the x position of the event and .ParamL is the y position.For WM_KEY* messages, .ParamH is the keyboard scancode, and LoByte(.ParamL) is the virtual key code.

HTH,
Duncan


-------------------------------------------------
Ex. Datis: Duncan Jones
Merrion Computing Ltd
http://www.merrioncomputing.com/EventVB/Overview.htm - Flatten the API learning curve

You hacking all that stuff??? I'd think the C/C++ folks might have some ideas.

The message element of the EVENTMSG structure is the message ID for the message, the WM_* value. The paramL and paramH values depend on whether the event is a mouse or a keyboard event. If it is a mouse event, the values contain the x and y coordinates of the event. If it is a keyboard event, paramL contains the scan code in the HIBYTE and the virtual-key code in the LOBYTE, and paramH contains the repeat count. Bit 15 of the repeat count specifies whether the event is an extended key. The time element of the EVENTMSG structure contains the system time (when the event occurred), which it obtained from the return value of GetTickCount. The hwnd is the window handle for the event.

The amount of time between events is determined by comparing the time element of an event with the time of subsequent events. This time delta is needed when playing back the recorded events.

Reference:
http://www.anticracking.sk/EliCZ/imp...dn_hooks32.htm



Help us improve our answers by rating them.

I could have done with that reference one long sleepless night ago ...

D.

-------------------------------------------------
Ex. Datis: Duncan Jones
Merrion Computing Ltd
http://www.merrioncomputing.com/EventVB/Overview.htm - Flatten the API learning curve

Hi,

I'm working on a Journal hook, and wish to capture user's Ctrl-C to stop the hook. I can't find doc on how to do that in EVENTMSG. Any help is much appreciated.


Will

WH_JOURNALRECORD cannot alter or remove a keyboard message - only record it. WH_KEYBOARD_LL can, however..suggest you look into that.

Hi,

Thanks for your comment. After some digging I've found a way to handle Ctrl-C.

I revisited Journal hook recently, and to my horror Journal playback doesn't work properly any more;
Problem: Record hook to capture mouse clicks to activate a minimized app, say notepad, at the bottom sys. task bar and some key strokes for text. When playback, the mouse did click on the task bar but notepad didn't restore until the hook finished replaying (very often not at all!). The notepad did restore when I clicked it manually (not using the hook app).

Could someone share ideas why??

Many many thanks.

P.S. I noticed with IE6 running I have proplems switching to other app. by clicking the task bar (sometimes but not every time)


Will