很多的教学软件或系统监视软件可以自动记录回放用户的输入文字或点击按钮等操作操作，这个功能的实现是使用 
了Windows的Hook函数。本文介绍如何通过使用VB来实现鼠标键盘操作的纪录和回放。 
    Windows提供API函数SetwindowsHookEx来建立一个Hook，通过这个函数可以将一个程序添加到Hook链中监视Windows 
消息，函数语法为： 
    Public Declare Function SetWindowsHookEx Lib "user32" _ 
        Alias "SetWindowsHookExA" _ 
        (ByVal idHook As Long, _ 
        ByVal lpfn As Long, _ 
        ByVal hmod As Long, _ 
        ByVal dwThreadId As Long) As Long 
    其中参数idHook指定建立的监视函数类型。通过Windows MSDN帮助可以看到，SetwindowsHookEx函数提供15种不同 
的消息监视类型，在这里我们将使用WH_JOURNALRECORD和WH_JOURNALPLAYBACK来监视键盘和鼠标操作。参数lpfn指定消 
息函数，在相应的消息产生后，系统会调用该函数并将消息值传递给该函数供处理。函数的一般形式为： 
    Hookproc (code: Integer; wparam: WPARAM; lparam: LPARAM): LRESULT stdcall; 
    其中code为系统指示标记，wParam和lParam为附加参数，根据不同的消息监视类型而不同。只要在程序中建立这样 
一个函数再通过SetwindowsHookEx函数将它加入到消息监视链中就可以处理消息了。 
    在不需要监视系统消息时需要调用提供UnHookWindowsHookEx来解除对消息的监视。 
    WH_JOURNALRECORD和WH_JOURNALPLAYBACK类型是两种相反的Hook类型，前者获得鼠标、键盘动作消息，后者回放鼠 
标键盘消息。所以在程序中我们需要建立两个消息函数，一个用于纪录鼠标键盘操作并保存到一个数组中，另一个用于 
将保存的操作返给系统回放。 
    下面是具体的程序实现：首先建立一个新工程，在Form1中加入三个CommandButton控件用于控制消息钩子，另外还 
可以增加若干Command或者TextBox控件用于检验操作回放的效果。然后在工程中增加一个模块文件，在模块中加入以下 
定义和代码: 

Option Explicit 

Public Type EVENTMSG 
        message As Long 
        paramL As Long 
        paramH As Long 
        time As Long 
        hwnd As Long 
End Type 

Public Declare Function CallNextHookEx Lib "user32" _ 
        (ByVal hHook As Long, _ 
        ByVal ncode As Long, _ 
        ByVal wParam As Long, _ 
        ByVal lParam As Long) As Long 
Public Declare Function SetWindowsHookEx Lib "user32" _ 
        Alias "SetWindowsHookExA" _ 
        (ByVal idHook As Long, _ 
        ByVal lpfn As Long, _ 
        ByVal hmod As Long, _ 
        ByVal dwThreadId As Long) As Long 
Public Declare Sub CopyMemoryT2H Lib "kernel32" _ 
        Alias "RtlMoveMemory" _ 
        (ByVal Dest As Long, _ 
        Source As EVENTMSG, _ 
        ByVal Length As Long) 
Public Declare Sub CopyMemoryH2T Lib "kernel32" _ 
        Alias "RtlMoveMemory" _ 
        (Dest As EVENTMSG, _ 
        ByVal Source As Long, _ 
        ByVal Length As Long) 
Public Declare Function UnhookWindowsHookEx Lib "user32" _ 
        (ByVal hHook As Long) As Long 

Public Const WH_JOURNALPLAYBACK = 1 
Public Const WH_JOURNALRECORD = 0 
Public Const HC_SYSMODALOFF = 5 
Public Const HC_SYSMODALON = 4 
Public Const HC_SKIP = 2 
Public Const HC_GETNEXT = 1 
Public Const HC_ACTION = 0 

Public EventArr(1000) As EVENTMSG 
Public EventLog As Long 
Public PlayLog As Long 
Public hHook As Long 
Public hPlay As Long 
Public recOK As Long 
Public canPlay As Long 
Public bDelay As Boolean 

Public Function HookProc(ByVal iCode As Long, ByVal wParam As Long, _ 
        ByVal lParam As Long) As Long 
    Dim Result As Long 
     
    recOK = 1 
    Result = 0 

    If iCode < 0 Then   'iCode小于0必须直接调用下一个消息钩子函数 
        Result = CallNextHookEx(hHook, iCode, wParam, lParam) 
    ElseIf iCode = HC_SYSMODALON Then   '不允许纪录 
        recOK = 0 
    ElseIf iCode = HC_SYSMODALOFF Then  '允许纪录 
        recOK = 1 
    ElseIf ((recOK > 0) And (iCode = HC_ACTION)) Then 
        '将消息纪录在纪录队列中 
        CopyMemoryH2T EventArr(EventLog), lParam, Len(EventArr(EventLog)) 
        EventLog = EventLog + 1 
        If EventLog >= 1000 Then 
            '当纪录大于1000后释放消息钩子 
            UnhookWindowsHookEx hHook 
        End If 
    End If 
    HookProc = Result 
End Function 

Public Function PlaybackProc(ByVal iCode As Long, ByVal wParam As Long, _ 
        ByVal lParam As Long) As Long 
    Dim Result As Long 
     
    canPlay = 1 
    Result = 0 

    If iCode < 0 Then   'iCode小于0必须直接调用下一个消息钩子函数 
        Result = CallNextHookEx(hPlay, iCode, wParam, lParam) 
    ElseIf iCode = HC_SYSMODALON Then   '不允许回放 
        canPlay = 0 
    ElseIf iCode = HC_SYSMODALOFF Then  '允许回放 
        canPlay = 1 
    ElseIf ((canPlay = 1) And (iCode = HC_GETNEXT)) Then 
        If bDelay Then 
            bDelay = False 
            Result = 50 
        End If 
        '从纪录队列中取出消息并赋予lParam指针指向的EVENTMSG区域 
        CopyMemoryT2H lParam, EventArr(PlayLog), Len(EventArr(EventLog)) 
    ElseIf ((canPlay = 1) And (iCode = HC_SKIP)) Then 
        bDelay = True 
        PlayLog = PlayLog + 1 
    End If 
     
    If PlayLog >= EventLog Then 
        UnhookWindowsHookEx hPlay 
    End If 
    PlaybackProc = Result 
End Function 

    在Form1的代码窗口中加入以下代码： 
Option Explicit 

Private Sub Command1_Click() 
    EventLog = 0 
    hHook = SetWindowsHookEx(WH_JOURNALRECORD, AddressOf HookProc, _ 
            App.hInstance, 0) 
    Command2.Enabled = True 
    Command1.Enabled = False 
End Sub 

Private Sub Command2_Click() 
    UnhookWindowsHookEx hHook 
    hHook = 0 

    Command1.Enabled = True 
    Command2.Enabled = False 
    Command3.Enabled = True 
End Sub 

Private Sub Command3_Click() 
    PlayLog = 0 
    hPlay = SetWindowsHookEx(WH_JOURNALPLAYBACK, AddressOf PlaybackProc, _ 
            App.hInstance, 0) 
    Command3.Enabled = False 
End Sub 

Private Sub Form_Load() 
    Command1.Caption = "纪录" 
    Command2.Caption = "停止" 
    Command3.Caption = "回放" 
    Command2.Enabled = False 
    Command3.Enabled = False 
End Sub 

    运行程序，点击“纪录”按钮，然后在TextBox中输入一些文字或者在窗口上移动光标后再按“停止”键停止消息 
纪录，然后按“回放”按钮，可以看到刚才鼠标键盘的操作被丝毫不差的回放了出来。 
    从上面的程序可以看到：通过WH_JOURNALRECORD可以建立一个鼠标键盘消息钩子，当每一个鼠标键盘消息产生时被 
钩子函数被调用。在钩子函数中可以将消息保存在消息事件队列中。然后通过WH_JOURNALPLAYBACK建立消息回放钩子， 
当每一次系统可以回放消息时就会调用钩子函数，在钩子函数中就可以从消息队列中取出原来纪录的消息返回给系统。 
这样就实现了鼠标键盘操作的纪录和回放。