最近做的一个winform类型的项目中需要屏蔽系统热键,在网上搜索了一下,基本上都是调用api来进行hook操作,下面的代码就可以完成功能
![](https://www.cnblogs.com/Images/OutliningIndicators/ContractedBlock.gif)
Code
using System;
using System.IO;
using System.Reflection;
using System.Runtime.InteropServices;
using System.Windows.Forms;
![](https://www.cnblogs.com/Images/OutliningIndicators/None.gif)
namespace WAT.PMS
![](https://www.cnblogs.com/Images/OutliningIndicators/ExpandedBlockStart.gif)
![](https://www.cnblogs.com/Images/OutliningIndicators/ContractedBlock.gif)
{
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
![](https://www.cnblogs.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
/**//// <summary>
/// Description: Hook Helper类,可以屏蔽一些热键并屏蔽任务管理器
/// Author: ZhangRongHua
/// Create DateTime: 2009-6-19 20:21
/// UpdateHistory:
/// </summary>
public class HookHelper
![](https://www.cnblogs.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
![](https://www.cnblogs.com/Images/OutliningIndicators/ContractedSubBlock.gif)
Delegates#region Delegates
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
public delegate int HookProc(int nCode, Int32 wParam, IntPtr lParam);
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
#endregion
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
![](https://www.cnblogs.com/Images/OutliningIndicators/ContractedSubBlock.gif)
变量声明#region 变量声明
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
private HookProc KeyboardHookProcedure;
private FileStream MyFs; // 用流来屏蔽ctrl alt delete
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
private const byte LLKHF_ALTDOWN = 0x20;
private const byte VK_CAPITAL = 0x14;
private const byte VK_ESCAPE = 0x1B;
private const byte VK_F4 = 0x73;
private const byte VK_LCONTROL = 0xA2;
private const byte VK_NUMLOCK = 0x90;
private const byte VK_RCONTROL = 0xA3;
private const byte VK_SHIFT = 0x10;
private const byte VK_TAB = 0x09;
public const int WH_KEYBOARD = 13;
private const int WH_KEYBOARD_LL = 13;
private const int WH_MOUSE = 7;
private const int WH_MOUSE_LL = 14;
private const int WM_KEYDOWN = 0x100;
private const int WM_KEYUP = 0x101;
private const int WM_LBUTTONDBLCLK = 0x203;
private const int WM_LBUTTONDOWN = 0x201;
private const int WM_LBUTTONUP = 0x202;
private const int WM_MBUTTONDBLCLK = 0x209;
private const int WM_MBUTTONDOWN = 0x207;
private const int WM_MBUTTONUP = 0x208;
private const int WM_MOUSEMOVE = 0x200;
private const int WM_MOUSEWHEEL = 0x020A;
private const int WM_RBUTTONDBLCLK = 0x206;
private const int WM_RBUTTONDOWN = 0x204;
private const int WM_RBUTTONUP = 0x205;
private const int WM_SYSKEYDOWN = 0x104;
private const int WM_SYSKEYUP = 0x105;
private static int hKeyboardHook = 0;
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
#endregion
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
![](https://www.cnblogs.com/Images/OutliningIndicators/ContractedSubBlock.gif)
函数转换#region 函数转换
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
[DllImport("user32.dll", CharSet = CharSet.Auto, CallingConvention = CallingConvention.StdCall)]
public static extern int SetWindowsHookEx(int idHook, HookProc lpfn, IntPtr hInstance, int threadId);
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
// 卸载钩子
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
[DllImport("user32.dll", CharSet = CharSet.Auto, CallingConvention = CallingConvention.StdCall)]
public static extern bool UnhookWindowsHookEx(int idHook);
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
// 继续下一个钩子
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
[DllImport("user32.dll", CharSet = CharSet.Auto, CallingConvention = CallingConvention.StdCall)]
public static extern int CallNextHookEx(int idHook, int nCode, Int32 wParam, IntPtr lParam);
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
// 取得当前线程编号
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
[DllImport("kernel32.dll")]
private static extern int GetCurrentThreadId();
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
[DllImport("user32.dll", CharSet = CharSet.Auto, CallingConvention = CallingConvention.StdCall)]
private static extern short GetKeyState(int vKey);
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
#endregion
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
![](https://www.cnblogs.com/Images/OutliningIndicators/ContractedSubBlock.gif)
方法#region 方法
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
![](https://www.cnblogs.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
/**//// <summary>
/// 钩子回调函数,在这里屏蔽热键。
/// <remark>
/// Author:ZhangRongHua
/// Create DateTime: 2009-6-19 20:19
/// Update History:
/// </remark>
/// </summary>
/// <param name="nCode">The n code.</param>
/// <param name="wParam">The w param.</param>
/// <param name="lParam">The l param.</param>
/// <returns></returns>
private int KeyboardHookProc(int nCode, Int32 wParam, IntPtr lParam)
![](https://www.cnblogs.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
KeyMSG m = (KeyMSG) Marshal.PtrToStructure(lParam, typeof (KeyMSG));
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
if (((Keys) m.vkCode == Keys.LWin) || ((Keys) m.vkCode == Keys.RWin) ||
((m.vkCode == VK_TAB) && ((m.flags & LLKHF_ALTDOWN) != 0)) ||
((m.vkCode == VK_ESCAPE) && ((m.flags & LLKHF_ALTDOWN) != 0)) ||
((m.vkCode == VK_F4) && ((m.flags & LLKHF_ALTDOWN) != 0)) ||
(m.vkCode == VK_ESCAPE) && ((GetKeyState(VK_LCONTROL) & 0x8000) != 0) ||
(m.vkCode == VK_ESCAPE) && ((GetKeyState(VK_RCONTROL) & 0x8000) != 0)
)
![](https://www.cnblogs.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
return 1;
}
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
return CallNextHookEx(hKeyboardHook, nCode, wParam, lParam);
}
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
![](https://www.cnblogs.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
/**//// <summary>
/// 启动Hook,并用流屏蔽任务管理器
/// <remark>
/// Author:ZhangRongHua
/// Create DateTime: 2009-6-19 20:20
/// Update History:
/// </remark>
/// </summary>
public void HookStart()
![](https://www.cnblogs.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
if (hKeyboardHook == 0)
![](https://www.cnblogs.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
// 创建HookProc实例
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
KeyboardHookProcedure = new HookProc(KeyboardHookProc);
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
hKeyboardHook = SetWindowsHookEx(WH_KEYBOARD,
KeyboardHookProcedure,
Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]),
0);
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
// 如果设置钩子失败
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
if (hKeyboardHook == 0)
![](https://www.cnblogs.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
HookStop();
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
//throw new Exception("SetWindowsHookEx failedeeeeeeee.");
}
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
//用二进制流的方法打开任务管理器。而且不关闭流.这样任务管理器就打开不了
MyFs = new FileStream(Environment.ExpandEnvironmentVariables("%windir%\\system32\\taskmgr.exe"),
FileMode.Open);
byte[] MyByte = new byte[(int) MyFs.Length];
MyFs.Write(MyByte, 0, (int) MyFs.Length);
}
}
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
![](https://www.cnblogs.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
/**//// <summary>
/// 卸载hook,并关闭流,取消屏蔽任务管理器。
/// <remark>
/// Author:ZhangRongHua
/// Create DateTime: 2009-6-19 20:21
/// Update History:
/// </remark>
/// </summary>
public void HookStop()
![](https://www.cnblogs.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
bool retKeyboard = true;
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
if (hKeyboardHook != 0)
![](https://www.cnblogs.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
retKeyboard = UnhookWindowsHookEx(hKeyboardHook);
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
hKeyboardHook = 0;
}
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
if (null != MyFs)
![](https://www.cnblogs.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
MyFs.Close();
}
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
if (!(retKeyboard))
![](https://www.cnblogs.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
throw new Exception("UnhookWindowsHookEx failedsssss.");
}
}
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
#endregion
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
![](https://www.cnblogs.com/Images/OutliningIndicators/ContractedSubBlock.gif)
Nested type: KeyMSG#region Nested type: KeyMSG
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
public struct KeyMSG
![](https://www.cnblogs.com/Images/OutliningIndicators/ExpandedSubBlockStart.gif)
{
public int dwExtraInfo;
public int flags;
public int scanCode;
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
public int time;
public int vkCode;
}
![](https://www.cnblogs.com/Images/OutliningIndicators/InBlock.gif)
#endregion
}
}
PS:也可以通过将[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] 下的DisableTaskmgr项的值设为"1”来屏蔽任务管理器。