[This is preliminary documentation and subject to change.]
You can set a DDI hook procedure by calling the SetDDIHook function. This function accepts five parameters. The first, hdcHook, is unused and must be set to NULL. The second parameter, hModCode, is a handle to the module that contains the hook procedure. This module must be a 16-bit DLL. Use the GetModuleHandle Win32 function to retrieve the module handle. The third parameter, lPrivateData, accepts a 32-bit value that will be passed to the hook procedure when an event occurs. The fourth parameter, hookClass, describes the type of application that the hook procedure belongs to. The last parameter, lpfnDdiHook, is the address of the hook procedure that Active Accessibility calls in response to DDI events.
The SetDDIHook function returns an HDDI value. This value is provided to identify the event hook and acts as the handle accepted when unhooking the event hook. For more information, see Unhooking a DDI Hook.