很多的教学软件或系统监视软件可以自动记录回放用户的输入文字或点击按钮等操作操作，这个功能的实现是使用
了Windows的Hook函数。本文介绍如何通过使用VB来实现鼠标键盘操作的纪录和回放。
    Windows提供API函数SetwindowsHookEx来建立一个Hook，通过这个函数可以将一个程序添加到Hook链中监视Windows
消息，函数语法为：
    Public Declare Function SetWindowsHookEx Lib "user32" _
        Alias "SetWindowsHookExA" _
        (ByVal idHook As Long, _
        ByVal lpfn As Long, _
        ByVal hmod As Long, _
        ByVal dwThreadId As Long) As Long
    其中参数idHook指定建立的监视函数类型。通过Windows MSDN帮助可以看到，SetwindowsHookEx函数提供15种不同
的消息监视类型，在这里我们将使用WH_JOURNALRECORD和WH_JOURNALPLAYBACK来监视键盘和鼠标操作。参数lpfn指定消
息函数，在相应的消息产生后，系统会调用该函数并将消息值传递给该函数供处理。函数的一般形式为：
    Hookproc (code: Integer; wparam: WPARAM; lparam: LPARAM): LRESULT stdcall;
    其中code为系统指示标记，wParam和lParam为附加参数，根据不同的消息监视类型而不同。只要在程序中建立这样
一个函数再通过SetwindowsHookEx函数将它加入到消息监视链中就可以处理消息了。
    在不需要监视系统消息时需要调用提供UnHookWindowsHookEx来解除对消息的监视。
    WH_JOURNALRECORD和WH_JOURNALPLAYBACK类型是两种相反的Hook类型，前者获得鼠标、键盘动作消息，后者回放鼠
标键盘消息。所以在程序中我们需要建立两个消息函数，一个用于纪录鼠标键盘操作并保存到一个数组中，另一个用于
将保存的操作返给系统回放。
    下面是具体的程序实现：首先建立一个新工程，在Form1中加入三个CommandButton控件用于控制消息钩子，另外还
可以增加若干Command或者TextBox控件用于检验操作回放的效果。然后在工程中增加一个模块文件，在模块中加入以下
定义和代码:

Option Explicit

Public Type EVENTMSG
        message As Long
        paramL As Long
        paramH As Long
        time As Long
        hwnd As Long
End Type

Public Declare Function CallNextHookEx Lib "user32" _
        (ByVal hHook As Long, _
        ByVal ncode As Long, _
        ByVal wParam As Long, _
        ByVal lParam As Long) As Long
Public Declare Function SetWindowsHookEx Lib "user32" _
        Alias "SetWindowsHookExA" _
        (ByVal idHook As Long, _
        ByVal lpfn As Long, _
        ByVal hmod As Long, _
        ByVal dwThreadId As Long) As Long
Public Declare Sub CopyMemoryT2H Lib "kernel32" _
        Alias "RtlMoveMemory" _
        (ByVal Dest As Long, _
        Source As EVENTMSG, _
        ByVal Length As Long)
Public Declare Sub CopyMemoryH2T Lib "kernel32" _
        Alias "RtlMoveMemory" _
        (Dest As EVENTMSG, _
        ByVal Source As Long, _
        ByVal Length As Long)
Public Declare Function UnhookWindowsHookEx Lib "user32" _
        (ByVal hHook As Long) As Long

Public Const WH_JOURNALPLAYBACK = 1
Public Const WH_JOURNALRECORD = 0
Public Const HC_SYSMODALOFF = 5
Public Const HC_SYSMODALON = 4
Public Const HC_SKIP = 2
Public Const HC_GETNEXT = 1
Public Const HC_ACTION = 0

Public EventArr(1000) As EVENTMSG
Public EventLog As Long
Public PlayLog As Long
Public hHook As Long
Public hPlay As Long
Public recOK As Long
Public canPlay As Long
Public bDelay As Boolean

Public Function HookProc(ByVal iCode As Long, ByVal wParam As Long, _
        ByVal lParam As Long) As Long
    Dim Result As Long
     
    recOK = 1
    Result = 0

    If iCode < 0 Then   'iCode小于0必须直接调用下一个消息钩子函数
        Result = CallNextHookEx(hHook, iCode, wParam, lParam)
    ElseIf iCode = HC_SYSMODALON Then   '不允许纪录
        recOK = 0
    ElseIf iCode = HC_SYSMODALOFF Then  '允许纪录
        recOK = 1
    ElseIf ((recOK > 0) And (iCode = HC_ACTION)) Then
        '将消息纪录在纪录队列中
        CopyMemoryH2T EventArr(EventLog), lParam, Len(EventArr(EventLog))
        EventLog = EventLog + 1
        If EventLog >= 1000 Then
            '当纪录大于1000后释放消息钩子
            UnhookWindowsHookEx hHook
        End If
    End If
    HookProc = Result
End Function

Public Function PlaybackProc(ByVal iCode As Long, ByVal wParam As Long, _
        ByVal lParam As Long) As Long
    Dim Result As Long
     
    canPlay = 1
    Result = 0

    If iCode < 0 Then   'iCode小于0必须直接调用下一个消息钩子函数
        Result = CallNextHookEx(hPlay, iCode, wParam, lParam)
    ElseIf iCode = HC_SYSMODALON Then   '不允许回放
        canPlay = 0
    ElseIf iCode = HC_SYSMODALOFF Then  '允许回放
        canPlay = 1
    ElseIf ((canPlay = 1) And (iCode = HC_GETNEXT)) Then
        If bDelay Then
            bDelay = False
            Result = 50
        End If
        '从纪录队列中取出消息并赋予lParam指针指向的EVENTMSG区域
        CopyMemoryT2H lParam, EventArr(PlayLog), Len(EventArr(EventLog))
    ElseIf ((canPlay = 1) And (iCode = HC_SKIP)) Then
        bDelay = True
        PlayLog = PlayLog + 1
    End If
     
    If PlayLog >= EventLog Then
        UnhookWindowsHookEx hPlay
    End If
    PlaybackProc = Result
End Function

    在Form1的代码窗口中加入以下代码：
Option Explicit

Private Sub Command1_Click()
    EventLog = 0
    hHook = SetWindowsHookEx(WH_JOURNALRECORD, AddressOf HookProc, _
            App.hInstance, 0)
    Command2.Enabled = True
    Command1.Enabled = False
End Sub

Private Sub Command2_Click()
    UnhookWindowsHookEx hHook
    hHook = 0

    Command1.Enabled = True
    Command2.Enabled = False
    Command3.Enabled = True
End Sub

Private Sub Command3_Click()
    PlayLog = 0
    hPlay = SetWindowsHookEx(WH_JOURNALPLAYBACK, AddressOf PlaybackProc, _
            App.hInstance, 0)
    Command3.Enabled = False
End Sub

Private Sub Form_Load()
    Command1.Caption = "纪录"
    Command2.Caption = "停止"
    Command3.Caption = "回放"
    Command2.Enabled = False
    Command3.Enabled = False
End Sub

    运行程序，点击“纪录”按钮，然后在TextBox中输入一些文字或者在窗口上移动光标后再按“停止”键停止消息
纪录，然后按“回放”按钮，可以看到刚才鼠标键盘的操作被丝毫不差的回放了出来。
    从上面的程序可以看到：通过WH_JOURNALRECORD可以建立一个鼠标键盘消息钩子，当每一个鼠标键盘消息产生时被
钩子函数被调用。在钩子函数中可以将消息保存在消息事件队列中。然后通过WH_JOURNALPLAYBACK建立消息回放钩子，
当每一次系统可以回放消息时就会调用钩子函数，在钩子函数中就可以从消息队列中取出原来纪录的消息返回给系统。
这样就实现了鼠标键盘操作的纪录和回放。