[LIB] EWinHook - SetWinEventHook implementation

[cyruz]

Hi guys,
I reimplemented SetWinEventHook in a more general way. This is the code:

Code: Select all

; ----------------------------------------------------------------------------------------------------------------------
; Name .........: EWinHook library
; Description ..: Implement the SetWinEventHook Win32 API
; AHK Version ..: AHK_L 1.1.13.01 x32 Unicode
; Author .......: Cyruz - http://ciroprincipe.info
; License ......: WTFPL - http://www.wtfpl.net/txt/copying/
; Changelog ....: Nov. 20, 2013 - v0.1 - First revision
; ----------------------------------------------------------------------------------------------------------------------

; ----------------------------------------------------------------------------------------------------------------------
; Function .....: EWinHook_SetWinEventHook
; Description ..: Sets an event hook function for a range of events.
; Parameters ...: eventMin         - Lowest event constant to handle. Pass the name as a string (eg: "EVENT_MIN").
; ..............: eventMax         - Highest event constant to handle. Pass the name as a string (eg: "EVENT_MAX").
; ..............: hmodWinEventProc - Handle to the DLL containing the hook function at lpfnWinEventProc or NULL.
; ..............: lpfnWinEventProc - Name or pointer to the hook function. Must be a WinEventProc callback function.
; ..............: idProcess        - PID from which the hook will receive events or 0 for all desktop process.
; ..............: idThread         - Thread ID from which the hook will receive events or 0 for all desktop threads.
; ..............: dwflags          - Flag values specifying hook location and events to skip. Specify the value or
; ..............:                    the combination of values as a string. The accepted values are:
; ..............:                    "WINEVENT_INCONTEXT"
; ..............:                    "WINEVENT_INCONTEXT | WINEVENT_SKIPOWNPROCESS"
; ..............:                    "WINEVENT_INCONTEXT | WINEVENT_SKIPOWNTHREAD"
; ..............:                    "WINEVENT_OUTOFCONTEXT"
; ..............:                    "WINEVENT_OUTOFCONTEXT | WINEVENT_SKIPOWNPROCESS"
; ..............:                    "WINEVENT_OUTOFCONTEXT | WINEVENT_SKIPOWNTHREAD"
; Return .......: -1               - CoInitialize error. Check A_LastError error code:
; ..............:                    E_INVALIDARG  = 0x80070057
; ..............:                    E_OUTOFMEMORY = 0x8007000E
; ..............:                    E_UNEXPECTED  = 0x8000FFFF
; ..............: 0                - Parameters or SetWinEventHook error.
; ..............: HWINEVENTHOOK    - Value identifying the event hook instance.
; Remarks ......: Remember to create a WinEventProc callback function to take care of all the messages.
; ..............: A_LastError is set also in case of success of CoInitialize.
; ..............: The possible success values are: S_OK               = 0x00000000
; ..............:                                  S_FALSE            = 0x00000001
; ..............:                                  RPC_E_CHANGED_MODE = 0x80010106
; Info .........: CoInitialize     - http://goo.gl/UhCKNo
; ..............: SetWinEventHook  - http://goo.gl/DosZa9
; ..............: WinEventProc     - http://goo.gl/wUZU08
; ----------------------------------------------------------------------------------------------------------------------
EWinHook_SetWinEventHook(eventMin, eventMax, hmodWinEventProc, lpfnWinEventProc, idProcess, idThread, dwflags) {
    Static S_OK                              := 0x00000000, S_FALSE                           := 0x00000001
         , RPC_E_CHANGED_MODE                := 0x80010106, E_INVALIDARG                      := 0x80070057
         , E_OUTOFMEMORY                     := 0x8007000E, E_UNEXPECTED                      := 0x8000FFFF
         , EVENT_MIN                         := 0x00000001, EVENT_MAX                         := 0x7FFFFFFF
         , EVENT_SYSTEM_SOUND                := 0x0001,     EVENT_SYSTEM_ALERT                := 0x0002
         , EVENT_SYSTEM_FOREGROUND           := 0x0003,     EVENT_SYSTEM_MENUSTART            := 0x0004
         , EVENT_SYSTEM_MENUEND              := 0x0005,     EVENT_SYSTEM_MENUPOPUPSTART       := 0x0006
         , EVENT_SYSTEM_MENUPOPUPEND         := 0x0007,     EVENT_SYSTEM_CAPTURESTART         := 0x0008
         , EVENT_SYSTEM_CAPTUREEND           := 0x0009,     EVENT_SYSTEM_MOVESIZESTART        := 0x000A
         , EVENT_SYSTEM_MOVESIZEEND          := 0x000B,     EVENT_SYSTEM_CONTEXTHELPSTART     := 0x000C
         , EVENT_SYSTEM_CONTEXTHELPEND       := 0x000D,     EVENT_SYSTEM_DRAGDROPSTART        := 0x000E
         , EVENT_SYSTEM_DRAGDROPEND          := 0x000F,     EVENT_SYSTEM_DIALOGSTART          := 0x0010
         , EVENT_SYSTEM_DIALOGEND            := 0x0011,     EVENT_SYSTEM_SCROLLINGSTART       := 0x0012
         , EVENT_SYSTEM_SCROLLINGEND         := 0x0013,     EVENT_SYSTEM_SWITCHSTART          := 0x0014
         , EVENT_SYSTEM_SWITCHEND            := 0x0015,     EVENT_SYSTEM_MINIMIZESTART        := 0x0016
         , EVENT_SYSTEM_MINIMIZEEND          := 0x0017,     EVENT_SYSTEM_DESKTOPSWITCH        := 0x0020
         , EVENT_SYSTEM_END                  := 0x00FF,     EVENT_OEM_DEFINED_START           := 0x0101
         , EVENT_OEM_DEFINED_END             := 0x01FF,     EVENT_UIA_EVENTID_START           := 0x4E00
         , EVENT_UIA_EVENTID_END             := 0x4EFF,     EVENT_UIA_PROPID_START            := 0x7500
         , EVENT_UIA_PROPID_END              := 0x75FF,     EVENT_CONSOLE_CARET               := 0x4001
         , EVENT_CONSOLE_UPDATE_REGION       := 0x4002,     EVENT_CONSOLE_UPDATE_SIMPLE       := 0x4003
         , EVENT_CONSOLE_UPDATE_SCROLL       := 0x4004,     EVENT_CONSOLE_LAYOUT              := 0x4005
         , EVENT_CONSOLE_START_APPLICATION   := 0x4006,     EVENT_CONSOLE_END_APPLICATION     := 0x4007
         , EVENT_CONSOLE_END                 := 0x40FF,     EVENT_OBJECT_CREATE               := 0x8000
         , EVENT_OBJECT_DESTROY              := 0x8001,     EVENT_OBJECT_SHOW                 := 0x8002
         , EVENT_OBJECT_HIDE                 := 0x8003,     EVENT_OBJECT_REORDER              := 0x8004
         , EVENT_OBJECT_FOCUS                := 0x8005,     EVENT_OBJECT_SELECTION            := 0x8006
         , EVENT_OBJECT_SELECTIONADD         := 0x8007,     EVENT_OBJECT_SELECTIONREMOVE      := 0x8008
         , EVENT_OBJECT_SELECTIONWITHIN      := 0x8009,     EVENT_OBJECT_STATECHANGE          := 0x800A
         , EVENT_OBJECT_LOCATIONCHANGE       := 0x800B,     EVENT_OBJECT_NAMECHANGE           := 0x800C
         , EVENT_OBJECT_DESCRIPTIONCHANGE    := 0x800D,     EVENT_OBJECT_VALUECHANGE          := 0x800E
         , EVENT_OBJECT_PARENTCHANGE         := 0x800F,     EVENT_OBJECT_HELPCHANGE           := 0x8010
         , EVENT_OBJECT_DEFACTIONCHANGE      := 0x8011,     EVENT_OBJECT_ACCELERATORCHANGE    := 0x8012
         , EVENT_OBJECT_INVOKED              := 0x8013,     EVENT_OBJECT_TEXTSELECTIONCHANGED := 0x8014
         , EVENT_OBJECT_CONTENTSCROLLED      := 0x8015,     EVENT_SYSTEM_ARRANGMENTPREVIEW    := 0x8016
         , EVENT_OBJECT_END                  := 0x80FF,     EVENT_AIA_START                   := 0xA000
         , EVENT_AIA_END                     := 0xAFFF,     WINEVENT_OUTOFCONTEXT             := 0x0000
         , WINEVENT_SKIPOWNTHREAD            := 0x0001,     WINEVENT_SKIPOWNPROCESS           := 0x0002
         , WINEVENT_INCONTEXT                := 0x0004 

    ; eventMin/eventMax check
    If ( !%eventMin% || !%eventMax% )
        Return 0

    ; dwflags check
    If ( !RegExMatch( dwflags
                    , "S)^\s*(WINEVENT_(?:INCONTEXT|OUTOFCONTEXT))\s*\|\s*(WINEVENT_SKIPOWN(?:PROCESS|"
                    . "THREAD))[^\S\n\r]*$|^\s*(WINEVENT_(?:INCONTEXT|OUTOFCONTEXT))[^\S\n\r]*$"
                    , dwfArray ) )
        Return 0
    dwflags := (dwfArray1 && dwfArray2) ? %dwfArray1% | %dwfArray2% : %dwfArray3%
        
    nCheck := DllCall( "CoInitialize", Ptr,0       )
              DllCall( "SetLastError", UInt,nCheck ) ; SetLastError in case of success/error
              
    If ( nCheck == E_INVALIDARG || nCheck == E_OUTOFMEMORY ||  nCheck == E_UNEXPECTED )
        Return -1
    
    If ( isFunc(lpfnWinEventProc) )
        lpfnWinEventProc := RegisterCallback(lpfnWinEventProc)
        
    hWinEventHook := DllCall( "SetWinEventHook", UInt,%eventMin%, UInt,%eventMax%, Ptr,hmodWinEventProc
                                               , Ptr,lpfnWinEventProc, UInt,idProcess, UInt,idThread, UInt,dwflags )
    Return (hWinEventHook) ? hWinEventHook : 0
}

; ----------------------------------------------------------------------------------------------------------------------
; Function .....: EWinHook_UnhookWinEvent
; Description ..: Remove a previously istantiated hook.
; Parameters ...: hWinEventHook  - Handle to the event hook returned in the previous call to SetWinEventHook.
; Return .......: 1              - Success
; ..............: 0              - Error
; Info .........: UnhookWinEvent - http://goo.gl/9dDjE3
; ..............: CoUninitialize - http://goo.gl/bWYQ2a
; ----------------------------------------------------------------------------------------------------------------------
EWinHook_UnhookWinEvent(hWinEventHook) {
    nCheck := DllCall( "UnhookWinEvent", Ptr,hWinEventHook )
    DllCall( "CoUninitialize" )
    Return nCheck
}

This is an example:

Code: Select all

hHook := EWinHook_SetWinEventHook("EVENT_OBJECT_CREATE", "EVENT_OBJECT_DESTROY", 0, "WinProcCallback", 0, 0, "WINEVENT_OUTOFCONTEXT")
Run, calc.exe
Sleep, 3000
Process, Close, calc.exe
EWinHook_UnhookWinEvent(hHook)
Return

WinProcCallback(hWinEventHook, event, hwnd, idObject, idChild, dwEventThread, dwmsEventTime) {
    DetectHiddenWindows, On
    WinGetClass, sClass, ahk_id %hwnd%
    If ( sClass == "CalcFrame" )
    FileAppend,
    ( LTrim
        hWinEventHook: %hWinEventHook%
        hwnd:           %hwnd%
        idObject:       %idObject%
        idChild:        %idChild%
        dwEventThread: %dwEventThread%
        dwmsEventTime: %dwmsEventTime%`n`n
    ), test.txt
}

[noname]

Thanks for sharing i use wineventhook a lot so this code will make it a lot easier!

Do you have any idea why the "EVENT_SYSTEM_SOUND " does not seem to be triggered by anything?From the documentation is seems to be straight forward but i tried it with a lot of different sound generating programs/code but none triggered it even the windows alert sounds are ignored.

[cyruz]

Thanks for sharing i use wineventhook a lot so this code will make it a lot easier!

Do you have any idea why the "EVENT_SYSTEM_SOUND " does not seem to be triggered by anything?From the documentation is seems to be straight forward but i tried it with a lot of different sound generating programs/code but none triggered it even the windows alert sounds are ignored.

Hi lain, it works for me. Don't expect to play a sound and trigger the event, as it seems that they are triggered only by the system. To check it, just press ALT in any explorer window, go to Help -> About and on the About dialog press the backspace key. The system default sound will play and the event will trigger.

[noname]

hi cyruz

I tried it but it does not trigger the code.The msgbox triggers the "alert" but trying the systemsounds i can hear them but they are not registered.I use winXP installed in 2004 so i guess the 9 years of misuse must have altered some settings

the code i tried using ahk_l 1.1.13.01

Code: Select all

filedelete,%a_scriptdir%\test.txt
setworkingdir %a_scriptdir%
onexit bye

hHook := EWinHook_SetWinEventHook("EVENT_SYSTEM_SOUND","EVENT_SYSTEM_ALERT",  0, "WinProcCallback", 0, 0, "WINEVENT_OUTOFCONTEXT")

Sleep, 3000
msgbox % A_AhkVersion
Sleep, 3000
msgbox % A_AhkVersion
Sleep, 3000
SoundBeep
Return


esc::
bye:
EWinHook_UnhookWinEvent(hHook)
exitapp

WinProcCallback(hWinEventHook, event, hwnd, idObject, idChild, dwEventThread, dwmsEventTime) {
    DetectHiddenWindows, On

    FileAppend,
    ( LTrim
        hWinEventHook: %event%
        hwnd:          %hwnd%
        idObject:      %idObject%
        idChild:       %idChild%
        dwEventThread: %dwEventThread%
        dwmsEventTime: %dwmsEventTime%`n`n
    ), %a_scriptdir%\test.txt
}

[cyruz]

hi cyruz

I tried it but it does not trigger the code.The msgbox triggers the "alert" but trying the systemsounds i can hear them but they are not registered.I use winXP installed in 2004 so i guess the 9 years of misuse must have altered some settings

the code i tried using ahk_l 1.1.13.01

Code: Select all

filedelete,%a_scriptdir%\test.txt
setworkingdir %a_scriptdir%
onexit bye

hHook := EWinHook_SetWinEventHook("EVENT_SYSTEM_SOUND","EVENT_SYSTEM_ALERT",  0, "WinProcCallback", 0, 0, "WINEVENT_OUTOFCONTEXT")

Sleep, 3000
msgbox % A_AhkVersion
Sleep, 3000
msgbox % A_AhkVersion
Sleep, 3000
SoundBeep
Return


esc::
bye:
EWinHook_UnhookWinEvent(hHook)
exitapp

WinProcCallback(hWinEventHook, event, hwnd, idObject, idChild, dwEventThread, dwmsEventTime) {
    DetectHiddenWindows, On

    FileAppend,
    ( LTrim
        hWinEventHook: %event%
        hwnd:          %hwnd%
        idObject:      %idObject%
        idChild:       %idChild%
        dwEventThread: %dwEventThread%
        dwmsEventTime: %dwmsEventTime%`n`n
    ), %a_scriptdir%\test.txt
}

You cannot trigger with SoundBeep. As I told you only system sounds trigger the event. Try to press backspace when the msgbox appears, the system will play a "System Default Sound" and you will trigger the event!

EDIT:
Looks like SoundPlay can trigger the event. Try with

Code: Select all

SoundPlay, *-1

[noname]

As I told you only system sounds trigger the event.

I tried it the way you suggested "press backspace when the msgbox appears" in my earlier post i only added soundbeep to have another sound and also when the messagebox in the code pops up you hear a system sound but no event triggering occurs.I also tried the systemsounds in the sound settings in the control panel where you can check them out and try them but nothing is recorded.

The SoundPlay, *-1 gives the same beep as a messagebox popup but also nothing is triggered.

This is the test.txt after the tests only the two messageboxes triggered an event.

Code: Select all

hWinEventHook: 2
hwnd:          197876
idObject:      4294967286
idChild:       1
dwEventThread: 2732
dwmsEventTime: 6771109

hWinEventHook: 2
hwnd:          263412
idObject:      4294967286
idChild:       1
dwEventThread: 2732
dwmsEventTime: 6779562

[cyruz]

I understand... I dont think there is something blocking the hook, otherwise you would notice the same behaviour for the other events. It could be something undocumented related to the EVENT_SYSTEM_SOUND and Windows XP, but this goes beyond my knowledge. I'm sorry

[noname]

I will use it mostly for the foreground,destroy,moveresize event ,there is one application where i like to react on it starting ,it gives a beep and a colored indicator so at the moment i use pixelgetcolor but it would be nice to have the sound as event trigger so i do not have to keep its window ontop to get the colorchange (gdip and printwindow are too cpu intensive to be useful here)

Thanks anyway cyrus .

[cyruz]

If you need to catch windows creation is better to use RegisterShellHookWindow and react to the HSHELL_WINDOWCREATED event. You could also use the CBT Hook i posted in this forum, but this will complicate the situation a lot...

Code: Select all

Gui, +LastFound
hWnd := WinExist()

msg := DllCall( "RegisterWindowMessage", Str,"SHELLHOOK" )
OnMessage( msg, "WindowProc" )
DllCall( "RegisterShellHookWindow", Ptr,hWnd )
Return

WindowProc(wParam, lParam, uMsg, hWnd) {
    FileAppend, hWnd: %hwnd%`nuMsg: %uMsg%`nwParam: %wParam%`nlParam: %lParam%`n`n, test.txt
    Return
}

[noname]

Thanks i will take a look at RegisterShellHookWindow.

For a final test of the "EVENT_SYSTEM_SOUND " i installed ahk and the program in a clean original winXP (SP2) installation in a VMWare virtual system.

The result is the same no triggering of the event only the alert was triggered by the msgbox.So the problem is with winXP .

[joedf]

Wow! This is cool!

[slur]

I'm experiencing some kinda glitch with WinEventHook function and ErrorLevel.
To be more on point, the ErrorLevel AHK gives me changes by the codes inside WinEventHook function.
This is especially frustrating with InputBox command because there seems to be no other way (besides ErrorLevel) to determine which button was pressed by the user.

Code: Select all

HookProc(hWinEventHook, Event, hWnd, idObject, idChild, dwEventThread, dwmsEventTime) {
	Static EVENT_SYSTEM_FOREGROUND = 0x03
	If (Event = 0x03) && !WinActive("ahk_class #32770")
		FileGetTime, VarFileTime, %A_WinDir%\explorer.exe
}

Loop, 20
	{
	InputBox, Var
	ToolTip, %ErrorLevel%
	Sleep, 100
	}

!F12:: Reload
^F12:: ExitApp

Anyone got workaround?

[Skrell]

Anyone know what dwflags i'd need to use in order to ONLY record application windows opening and closing using the example provided in OP ?

[cyruz]

Anyone know what dwflags i'd need to use in order to ONLY record application windows opening and closing using the example provided in OP ?

WINEVENT_OUTOFCONTEXT

Read here for info: http://msdn.microsoft.com/en-us/library ... s.85).aspx

[Skrell]

Anyone know what dwflags i'd need to use in order to ONLY record application windows opening and closing using the example provided in OP ?

WINEVENT_OUTOFCONTEXT

Read here for info: http://msdn.microsoft.com/en-us/library ... s.85).aspx

Yea i tried that but i get TONS of messages logged that reference windows without class names (blank) ??
i.e.
hWinEventHook: 569707177
hwnd: 727020
class:
idObject: 0
idChild: 0
dwEventThread: 6508
dwmsEventTime: 545772056

So i'm thinking there are more/different flags that need to be excluded.

[guest3456]

Anyone know what dwflags i'd need to use in order to ONLY record application windows opening and closing using the example provided in OP ?

why not use a Shell Hook?
http://www.autohotkey.com/board/topic/8 ... -messages/

[lexikos]

Skrell,
If you want events only for top-level windows and not controls, or for specific windows, you need to do your own filtering as shown in the first example. Windows will not do it for you, aside from filtering on event number and whether the event came from the script's own process.

All windows have a class name. If WinGetClass is returning a blank value, perhaps you are giving it incorrect parameters, or the window is hidden and you are missing DetectHiddenWindows On.

WINEVENT_OUTOFCONTEXT

This flag should always be used, because the callback you are passing does not reside inside a DLL. So technically you're right, but it does not answer the real question.

why not use a Shell Hook?

This is a good suggestion; I think shell hooks are only called for top-level windows, which seems to be what Skrell wants.

[Skrell]

Skrell,
If you want events only for top-level windows and not controls, or for specific windows, you need to do your own filtering as shown in the first example. Windows will not do it for you, aside from filtering on event number and whether the event came from the script's own process.

All windows have a class name. If WinGetClass is returning a blank value, perhaps you are giving it incorrect parameters, or the window is hidden and you are missing DetectHiddenWindows On.

WINEVENT_OUTOFCONTEXT

This flag should always be used, because the callback you are passing does not reside inside a DLL. So technically you're right, but it does not answer the real question.

why not use a Shell Hook?

This is a good suggestion; I think shell hooks are only called for top-level windows, which seems to be what Skrell wants.

Thanks for the advice guys!

[tmplinshi]

Should specify the dll name Ole32.dll for calling CoInitialize and CoUninitialize.

[Barney]

What happens if I don't remove an event hook before my script exits? I see this being done in other scipts, too, like those ShellHook scripts so I guess it is important. In this thread's example script it is done by this call:

Code: Select all

EWinHook_UnhookWinEvent(hHook)

I wonder if Windows becomes instable or keeps memory allocated for it?