管理员权限下IMessageFilter无法正常工作的技术求助

嘿，我完全懂你遇到的麻烦——用IMessageFilter跟踪输入在普通权限下好好的，一切换到管理员权限就罢工了对吧？这背后其实是Windows的UAC权限隔离机制在起作用：IMessageFilter是基于窗口消息的，它只能捕获同一权限上下文内的输入事件，当程序以管理员权限运行时，普通权限窗口的消息传不过来，反过来也一样。

那该怎么解决呢？答案是改用低级全局钩子（Low-Level Hooks），具体来说就是WH_KEYBOARD_LL和WH_MOUSE_LL这两个钩子。它们是少数不需要DLL注入的全局钩子，回调函数会在你的程序线程里执行，而且能跨权限捕获所有输入，完美适配管理员权限场景。

下面是完整的实现代码，替换你原来的IMessageFilter相关逻辑就行：

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Windows.Forms;

namespace GlobalInputTracker
{
    public class GlobalInputHook : IDisposable
    {
        // Windows API 导入
        [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
        private static extern IntPtr SetWindowsHookEx(int idHook, LowLevelProc lpfn, IntPtr hMod, uint dwThreadId);

        [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        private static extern bool UnhookWindowsHookEx(IntPtr hhk);

        [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
        private static extern IntPtr CallNextHookEx(IntPtr hhk, int nCode, IntPtr wParam, IntPtr lParam);

        [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
        private static extern IntPtr GetModuleHandle(string lpModuleName);

        // 钩子类型常量
        private const int WH_KEYBOARD_LL = 13;
        private const int WH_MOUSE_LL = 14;

        // 输入消息常量
        private const int WM_KEYDOWN = 0x0100;
        private const int WM_KEYUP = 0x0101;
        private const int WM_LBUTTONDOWN = 0x0201;
        private const int WM_LBUTTONUP = 0x0202;
        private const int WM_RBUTTONDOWN = 0x0204;
        private const int WM_RBUTTONUP = 0x0205;

        // 钩子回调委托
        private delegate IntPtr LowLevelProc(int nCode, IntPtr wParam, IntPtr lParam);

        private LowLevelProc _keyboardCallback;
        private LowLevelProc _mouseCallback;
        private IntPtr _keyboardHookHandle = IntPtr.Zero;
        private IntPtr _mouseHookHandle = IntPtr.Zero;

        // 自定义事件，方便外部订阅输入事件
        public event EventHandler<KeyEventArgs> KeyAction;
        public event EventHandler<MouseEventArgs> MouseAction;

        public GlobalInputHook()
        {
            _keyboardCallback = KeyboardHookProc;
            _mouseCallback = MouseHookProc;
            RegisterHooks();
        }

        private void RegisterHooks()
        {
            using (var mainModule = Process.GetCurrentProcess().MainModule)
            {
                var moduleHandle = GetModuleHandle(mainModule.ModuleName);
                _keyboardHookHandle = SetWindowsHookEx(WH_KEYBOARD_LL, _keyboardCallback, moduleHandle, 0);
                _mouseHookHandle = SetWindowsHookEx(WH_MOUSE_LL, _mouseCallback, moduleHandle, 0);
            }

            // 检查钩子是否注册成功
            if (_keyboardHookHandle == IntPtr.Zero || _mouseHookHandle == IntPtr.Zero)
            {
                throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
            }
        }

        private IntPtr KeyboardHookProc(int nCode, IntPtr wParam, IntPtr lParam)
        {
            // nCode >=0 表示消息可以处理
            if (nCode >= 0 && (wParam == (IntPtr)WM_KEYDOWN || wParam == (IntPtr)WM_KEYUP))
            {
                var keyCode = Marshal.ReadInt32(lParam);
                KeyAction?.Invoke(this, new KeyEventArgs((Keys)keyCode));
            }
            // 必须调用下一个钩子，否则会影响系统其他钩子
            return CallNextHookEx(_keyboardHookHandle, nCode, wParam, lParam);
        }

        private IntPtr MouseHookProc(int nCode, IntPtr wParam, IntPtr lParam)
        {
            if (nCode >= 0)
            {
                var hookData = Marshal.PtrToStructure<MSLLHOOKSTRUCT>(lParam);
                MouseButtons button = MouseButtons.None;

                switch ((int)wParam)
                {
                    case WM_LBUTTONDOWN:
                    case WM_LBUTTONUP:
                        button = MouseButtons.Left;
                        break;
                    case WM_RBUTTONDOWN:
                    case WM_RBUTTONUP:
                        button = MouseButtons.Right;
                        break;
                }

                if (button != MouseButtons.None)
                {
                    var clickCount = (wParam == (IntPtr)WM_LBUTTONDOWN || wParam == (IntPtr)WM_RBUTTONDOWN) ? 1 : 0;
                    MouseAction?.Invoke(this, new MouseEventArgs(button, clickCount, hookData.pt.x, hookData.pt.y, 0));
                }
            }
            return CallNextHookEx(_mouseHookHandle, nCode, wParam, lParam);
        }

        // 鼠标钩子数据结构
        [StructLayout(LayoutKind.Sequential)]
        private struct POINT
        {
            public int x;
            public int y;
        }

        [StructLayout(LayoutKind.Sequential)]
        private struct MSLLHOOKSTRUCT
        {
            public POINT pt;
            public int mouseData;
            public int flags;
            public int time;
            public IntPtr dwExtraInfo;
        }

        // 注销钩子，释放资源
        public void Dispose()
        {
            UnhookWindowsHookEx(_keyboardHookHandle);
            UnhookWindowsHookEx(_mouseHookHandle);
        }
    }

    // 主程序示例
    class Program
    {
        static void Main(string[] args)
        {
            try
            {
                using (var inputHook = new GlobalInputHook())
                {
                    // 订阅键盘事件
                    inputHook.KeyAction += (sender, e) => 
                        Console.WriteLine($"键盘动作: {(e.KeyDown ? "按下" : "抬起")} {e.KeyCode}");
                    
                    // 订阅鼠标事件
                    inputHook.MouseAction += (sender, e) => 
                        Console.WriteLine($"鼠标动作: {(e.Button == MouseButtons.Left ? "左键" : "右键")}{(e.Clicks > 0 ? "按下" : "抬起")} 位置: ({e.X}, {e.Y})");

                    Console.WriteLine("输入跟踪已启动，按任意键退出...");
                    // 必须保持消息循环运行，低级钩子依赖这个
                    Application.Run();
                }
            }
            catch (Exception ex)
            {
                Console.WriteLine("程序出错: " + ex.Message);
            }
        }
    }
}

关键注意事项： #

• 消息循环必须运行：如果是控制台程序，一定要调用Application.Run()来启动消息泵，否则钩子会收不到事件；如果是WinForms/WPF程序，消息循环已经由框架处理，不需要额外操作。
• 正确注销钩子：使用IDisposable接口确保程序退出时注销钩子，避免残留的钩子影响系统。
• 跨权限捕获：以管理员权限运行这个程序时，它可以捕获所有进程的输入，包括其他管理员进程的操作，完美解决你原来的问题。
• 不要阻塞回调函数：钩子回调函数要尽量简洁，不要做耗时操作，否则会导致系统输入响应变慢。

内容的提问来源于stack exchange，提问作者Ravi Kanth