A hook procedure is code that intercepts “messages”. Here a message is an invocation of a kernel function, I think. There are 13 types of hooks provided by MS. For each combination of hook type and application there is an ordered chain of hooks. The hook runs, I think, in the address space of the program whose kernel invocations are intercepted. The hook code can be normal application code, or can appear in a .dll which is shared RAM that is mapped into some or all applications. The mechanism that registers hooks puts them in a chain in some order and nominally presents each message to each member hook of that chain.

The function SetWindowsHookEx registers a new hook at the beginning of some chain chain.

Some types of hooks (determined by MS) can only read the message.

I need a head-bones--knee-bone (lattice) view of the following terms: thread; desk-top; application; module; window-procedure;