Importance of Calling DefHookProc()

• Microsoft Windows Software Development Kit (SDK) versions 3.0 and 3.1
• Microsoft Win32 Application Programming Interface (API) included with:

      - Microsoft Windows NT versions 3.5 and 3.51
      - Microsoft Windows 95 version 4.0
  

SUMMARY

When an application installs a hook using SetWindowsHook(), Windows adds the hook's callback filter function to the hook chain. It is the responsibility of each callback function to call the next function in the chain. DefHookProc() is used to call the next function in the hook chain for Windows 3.0. DefHookProc() is retained in Windows 3.1 for backwards compatibility. For Windows 3.1, you should use CallNextHookEx() to call the next function in the hook chain.

For Win32, mouse and keyboard hooks can suppress messages by return value and do not have to call CallNextHookEx(), unless they want to pass the message on. Other hooks, like WH_CALLWNDPROC, don't need to call CallNextHookEx(), because it will be called by the system. However, all hooks should call CallNextHookEx() immediately if nCode<0.

MORE INFORMATION

Windows 3.0

If a callback function does not call DefHookProc(), none of the filter functions that were installed before the current filter will be called. Windows will try to process the message and this could hang the system.

Only a keyboard hook (WH_KEYBOARD) can suppress a keyboard event by not calling DefHookProc() and returning a 1. When the system gets a value of 1 from a keyboard hook callback function, it discards the message.

Windows 3.1

In Windows 3.1, the WH_MOUSE hook will work like the WH_KEYBOARD hook in that the mouse event can be suppressed by returning 1 instead of calling DefHookProc().

Furthermore, when the hook callback function receives a negative value for the nCode parameter, it should pass the message and the parameters to DefHookProc() without further processing. When nCode is negative, Windows is in the process of removing a hook callback function from the hook chain.