很多的教學軟件或系統監視軟件可以自動記錄回放用戶的輸入文字或點擊按鈕等操作操作，這個功能的實現是使用 
了Windows的Hook函數。本文介紹如何通過使用VB來實現鼠標鍵盤操作的紀錄和回放。 
    Windows提供API函數SetwindowsHookEx來建立一個Hook，通過這個函數可以將一個程序添加到Hook鏈中監視Windows 
消息，函數語法為： 
    Public Declare Function SetWindowsHookEx Lib "user32" _ 
        Alias "SetWindowsHookExA" _ 
        (ByVal idHook As Long, _ 
        ByVal lpfn As Long, _ 
        ByVal hmod As Long, _ 
        ByVal dwThreadId As Long) As Long 
    其中參數idHook指定建立的監視函數類型。通過Windows MSDN幫助可以看到，SetwindowsHookEx函數提供15種不同 
的消息監視類型，在這里我們將使用WH_JOURNALRECORD和WH_JOURNALPLAYBACK來監視鍵盤和鼠標操作。參數lpfn指定消 
息函數，在相應的消息產生后，系統會調用該函數并將消息值傳遞給該函數供處理。函數的一般形式為： 
    Hookproc (code: Integer; wparam: WPARAM; lparam: LPARAM): LRESULT stdcall; 
    其中code為系統指示標記，wParam和lParam為附加參數，根據不同的消息監視類型而不同。只要在程序中建立這樣 
一個函數再通過SetwindowsHookEx函數將它加入到消息監視鏈中就可以處理消息了。 
    在不需要監視系統消息時需要調用提供UnHookWindowsHookEx來解除對消息的監視。 
    WH_JOURNALRECORD和WH_JOURNALPLAYBACK類型是兩種相反的Hook類型，前者獲得鼠標、鍵盤動作消息，后者回放鼠 
標鍵盤消息。所以在程序中我們需要建立兩個消息函數，一個用于紀錄鼠標鍵盤操作并保存到一個數組中，另一個用于 
將保存的操作返給系統回放。 
    下面是具體的程序實現：首先建立一個新工程，在Form1中加入三個CommandButton控件用于控制消息鉤子，另外還 
可以增加若干Command或者TextBox控件用于檢驗操作回放的效果。然后在工程中增加一個模塊文件，在模塊中加入以下 
定義和代碼: 

Option Explicit 

Public Type EVENTMSG 
        message As Long 
        paramL As Long 
        paramH As Long 
        time As Long 
        hwnd As Long 
End Type 

Public Declare Function CallNextHookEx Lib "user32" _ 
        (ByVal hHook As Long, _ 
        ByVal ncode As Long, _ 
        ByVal wParam As Long, _ 
        ByVal lParam As Long) As Long 
Public Declare Function SetWindowsHookEx Lib "user32" _ 
        Alias "SetWindowsHookExA" _ 
        (ByVal idHook As Long, _ 
        ByVal lpfn As Long, _ 
        ByVal hmod As Long, _ 
        ByVal dwThreadId As Long) As Long 
Public Declare Sub CopyMemoryT2H Lib "kernel32" _ 
        Alias "RtlMoveMemory" _ 
        (ByVal Dest As Long, _ 
        Source As EVENTMSG, _ 
        ByVal Length As Long) 
Public Declare Sub CopyMemoryH2T Lib "kernel32" _ 
        Alias "RtlMoveMemory" _ 
        (Dest As EVENTMSG, _ 
        ByVal Source As Long, _ 
        ByVal Length As Long) 
Public Declare Function UnhookWindowsHookEx Lib "user32" _ 
        (ByVal hHook As Long) As Long 

Public Const WH_JOURNALPLAYBACK = 1 
Public Const WH_JOURNALRECORD = 0 
Public Const HC_SYSMODALOFF = 5 
Public Const HC_SYSMODALON = 4 
Public Const HC_SKIP = 2 
Public Const HC_GETNEXT = 1 
Public Const HC_ACTION = 0 

Public EventArr(1000) As EVENTMSG 
Public EventLog As Long 
Public PlayLog As Long 
Public hHook As Long 
Public hPlay As Long 
Public recOK As Long 
Public canPlay As Long 
Public bDelay As Boolean 

Public Function HookProc(ByVal iCode As Long, ByVal wParam As Long, _ 
        ByVal lParam As Long) As Long 
    Dim Result As Long 
     
    recOK = 1 
    Result = 0 

    If iCode < 0 Then   'iCode小于0必須直接調用下一個消息鉤子函數 
        Result = CallNextHookEx(hHook, iCode, wParam, lParam) 
    ElseIf iCode = HC_SYSMODALON Then   '不允許紀錄 
        recOK = 0 
    ElseIf iCode = HC_SYSMODALOFF Then  '允許紀錄 
        recOK = 1 
    ElseIf ((recOK > 0) And (iCode = HC_ACTION)) Then 
        '將消息紀錄在紀錄隊列中 
        CopyMemoryH2T EventArr(EventLog), lParam, Len(EventArr(EventLog)) 
        EventLog = EventLog + 1 
        If EventLog >= 1000 Then 
            '當紀錄大于1000后釋放消息鉤子 
            UnhookWindowsHookEx hHook 
        End If 
    End If 
    HookProc = Result 
End Function 

Public Function PlaybackProc(ByVal iCode As Long, ByVal wParam As Long, _ 
        ByVal lParam As Long) As Long 
    Dim Result As Long 
     
    canPlay = 1 
    Result = 0 

    If iCode < 0 Then   'iCode小于0必須直接調用下一個消息鉤子函數 
        Result = CallNextHookEx(hPlay, iCode, wParam, lParam) 
    ElseIf iCode = HC_SYSMODALON Then   '不允許回放 
        canPlay = 0 
    ElseIf iCode = HC_SYSMODALOFF Then  '允許回放 
        canPlay = 1 
    ElseIf ((canPlay = 1) And (iCode = HC_GETNEXT)) Then 
        If bDelay Then 
            bDelay = False 
            Result = 50 
        End If 
        '從紀錄隊列中取出消息并賦予lParam指針指向的EVENTMSG區域 
        CopyMemoryT2H lParam, EventArr(PlayLog), Len(EventArr(EventLog)) 
    ElseIf ((canPlay = 1) And (iCode = HC_SKIP)) Then 
        bDelay = True 
        PlayLog = PlayLog + 1 
    End If 
     
    If PlayLog >= EventLog Then 
        UnhookWindowsHookEx hPlay 
    End If 
    PlaybackProc = Result 
End Function 

    在Form1的代碼窗口中加入以下代碼： 
Option Explicit 

Private Sub Command1_Click() 
    EventLog = 0 
    hHook = SetWindowsHookEx(WH_JOURNALRECORD, AddressOf HookProc, _ 
            App.hInstance, 0) 
    Command2.Enabled = True 
    Command1.Enabled = False 
End Sub 

Private Sub Command2_Click() 
    UnhookWindowsHookEx hHook 
    hHook = 0 

    Command1.Enabled = True 
    Command2.Enabled = False 
    Command3.Enabled = True 
End Sub 

Private Sub Command3_Click() 
    PlayLog = 0 
    hPlay = SetWindowsHookEx(WH_JOURNALPLAYBACK, AddressOf PlaybackProc, _ 
            App.hInstance, 0) 
    Command3.Enabled = False 
End Sub 

Private Sub Form_Load() 
    Command1.Caption = "紀錄" 
    Command2.Caption = "停止" 
    Command3.Caption = "回放" 
    Command2.Enabled = False 
    Command3.Enabled = False 
End Sub 

    運行程序，點擊“紀錄”按鈕，然后在TextBox中輸入一些文字或者在窗口上移動光標后再按“停止”鍵停止消息 
紀錄，然后按“回放”按鈕，可以看到剛才鼠標鍵盤的操作被絲毫不差的回放了出來。 
    從上面的程序可以看到：通過WH_JOURNALRECORD可以建立一個鼠標鍵盤消息鉤子，當每一個鼠標鍵盤消息產生時被 
鉤子函數被調用。在鉤子函數中可以將消息保存在消息事件隊列中。然后通過WH_JOURNALPLAYBACK建立消息回放鉤子， 
當每一次系統可以回放消息時就會調用鉤子函數，在鉤子函數中就可以從消息隊列中取出原來紀錄的消息返回給系統。 
這樣就實現了鼠標鍵盤操作的紀錄和回放。