一个系统钩子

library 系统钩子;
uses
  System.SysUtils,
  windows,
  System.Classes;

{$R *.res}
var           //定义全局变量
hHook:integer;
function HookProc(iCode: Integer;    //处理系统钩子的函数
wParam: WPARAM;
lParam: LPARAM): LRESULT; stdcall; export; //书写调用规则,记得加 stdcall
begin
   Result := 0;//注意返回值必须为0，允许对窗口的操作
     try
     if iCode = HCBT_DESTROYWND then begin//捕获关闭窗口的消息
       Winexec(‘notepad.exe‘,SW_SHOW);    //预处理消息前执行的代码 ,可自定义
     end;

    except
end;
end;

procedure LoadDestroyWndHook;    //设置系统挂钩
begin
hHook:=SetWindowsHookEx(WH_CBT,HookProc,Hinstance,0);   //[Error] HookMsg.dpr(65): Incompatible types: ‘Calling conventions differ‘
end;                                                      //函数呼叫约定不一致-->出错

procedure UnLoadDestroyWndHook; //注销系统挂钩
begin
    UnHookWindowsHookEx(hHook);
    hHook := 0;
end;

exports                           //输出函数
    LoadDestroyWndHook,
    UnLoadDestroyWndHook;
begin
end.

调用钩子

 function LoadDestroyWndHook: BOOL;   external ‘HookMsg.dll‘;
function UnLoadDestroyWndHook: BOOL; external ‘HookMsg.dll‘;
procedure TForm1.FormClose(Sender: TObject; var Action: TCloseAction);
begin
UnLoadDestroyWndHook;
end;

procedure TForm1.FormCreate(Sender: TObject);
begin
  LoadDestroyWndHook;

一个系统钩子

原文：http://www.cnblogs.com/onionhacker/p/3536932.html