#1 2018-02-15 15:23

Registered: 2008-12-13
Posts: 20

Description of "Hook" methods for "User Inactive" event

Could you please explain a bit how the "Low Level Hook" and "Injection Hook" methods work, and what the implications of using them are? The documentation currently does not mention these.


#2 2018-02-16 23:07

From: den4b.com
Registered: 2006-04-06
Posts: 3,039

Re: Description of "Hook" methods for "User Inactive" event

The methods for monitoring user inactivity are now described on the wiki:

  1. Last Input Event - Uses GetLastInputInfo API. Captures activity only of the initiating user session. The most stable and the least intrusive approach.

  2. Low Level Hook - Uses SetWindowsHookEx(WH_KEYBOARD_LL) and SetWindowsHookEx(WH_MOUSE_LL) API. Captures activity from all user sessions. Applied without injection into foreign processes to achieve a less intrusive effect, contrary to the official documentation, so it may stop working in future versions of Windows.

  3. Injection Hook - Uses SetWindowsHookEx(WH_KEYBOARD) and SetWindowsHookEx(WH_MOUSE) API. Captures activity from all user sessions. A tiny dedicated library file is injected into all foreign processes to capture user activity across all applications. This is a well established approach which may yield better results in some cases, but it is the most intrusive approach.


Board footer

Powered by FluxBB