A filter-function chain is a series of connected filter functions for a particular system hook. For example, all keyboard filter functions are installed by WH_KEYBOARD and all journaling-record filter functions are installed by WH_JOURNALRECORD. An application passes a filter function to a system hook with a call to the SetWindowsHook function. Each call adds a new filter function to the beginning of the chain. Whenever an application passes the address of a filter function to a system hook, it must reserve space for the address of the next filter function in the chain. SetWindowsHook installs a hook function into a hook chain and returns a handle of the hook.
Once each filter function completes its task, it must call the DefHookProc function. DefHookProc uses the address stored in the location reserved by the application to access the next filter function in the chain.
To remove a filter function from a filter chain, an application must call the UnhookWindowsHook function with the type of hook and a pointer to the function.
The standard window hooks and debugging hooks are as follows:
| Type | Purpose |
| WH_CALLWNDPROC | Installs a window filter. |
| WH_CBT | Installs a computer-based training (CBT) filter. |
| WH_DEBUG | Installs a debugging filter. |
| WH_GETMESSAGE | Installs a message filter (on debugging versions only). |
| WH_HARDWARE | Installs a nonstandard hardware-message filter. |
| WH_JOURNALPLAYBACK | Installs a journaling playback filter. |
| WH_JOURNALRECORD | Installs a journaling record filter. |
| WH_KEYBOARD | Installs a keyboard filter. |
| WH_MOUSE | Installs a mouse-message filter. |
| WH_MSGFILTER | Installs a message filter. |
| WH_SYSMSGFILTER | Installs a systemwide message filter. |
Note:
The WH_CALLWNDPROC and WH_GETMESSAGE hooks will affect system performance. They are supplied for debugging purposes only.