A filter-function chain is a series of connected filter functions for a particular system hook. For example, all keyboard filter functions are installed by WH_KEYBOARD and all journaling-record filter functions are installed by WH_JOURNALRECORD. Applications pass these filter functions to the system hooks with calls to the SetWindowsHook function. Each call adds a new filter function to the beginning of the chain. Whenever an application passes a filter function to a system hook, it must reserve space for the address of the next filter function in the chain. SetWindowsHook returns this address.
Once each filter function completes its task, it must call the DefHookProc function. DefHookProc uses the address stored in the location reserved by the application to access the next filter function in the chain.
To remove a filter function from a filter chain, an application must call the UnhookWindowsHook function with the type of hook and a pointer to the function.
There are five types of standard window hooks and two types of debugging hooks. Table 1.8 lists each type and describes its purpose:
Table 1.8 System Hooks
| Type | Purpose |
| WH_CALLWNDPROC | Installs a window function filter. |
| WH_GETMESSAGE | Installs a message filter (on debugging versions only). |
| WH_JOURNALPLAYBACK | Installs a journaling playback filter. |
| WH_JOURNALRECORD | Installs a journaling record filter. |
| WH_KEYBOARD | Installs a keyboard filter. |
| WH_MSGFILTER | Installs a message filter. |
| WH_SYSMSGFILTER | Installs a system-wide message filter. |
NOTE:
The WH_CALLWNDPROC and WH_GETMESSAGE hooks will affect system perfor-mance. They are supplied for debugging purposes only.