LocalHookCreate Method

public static LocalHook Create(
	IntPtr InTargetProc,
	Delegate InNewProc,
	Object InCallback
)

Public Shared Function Create ( 
	InTargetProc As IntPtr,
	InNewProc As Delegate,
	InCallback As Object
) As LocalHook

public:
static LocalHook^ Create(
	IntPtr InTargetProc, 
	Delegate^ InNewProc, 
	Object^ InCallback
)

static member Create : 
        InTargetProc : IntPtr * 
        InNewProc : Delegate * 
        InCallback : Object -> LocalHook 

Parameters

InTargetProc

Type: SystemIntPtr
A target entry point that should be hooked.

InNewProc

Type: SystemDelegate
A handler with the same signature as the original entry point that will be invoked for every call that has passed the Fiber Deadlock Barrier and various integrity checks.

InCallback

Type: SystemObject
An uninterpreted callback that will later be available through Callback.

Return Value

Note that not all entry points are hookable! In general methods like CreateFileW won't cause any trouble. But there might be methods that are not hookable because their entry point machine code is not eligable to be hooked. You should test all hooks on common environments like "Windows XP x86/x64 SP2/SP3" and "Windows Vista x86/x64 (SP1)". This is the only way to ensure that your application will work well on most machines.

Your handler delegate has to use the UnmanagedFunctionPointerAttribute and shall map to the same native method signature, otherwise the application will crash! The best way is to use predefined delegates used in related P-Invoke implementations usually found with Google. If you know how to write such native delegates you won't need internet resources of course. I recommend using C++.NET which allows you to just copy the related windows API to your managed class and thread it as delegate without any changes. This will also speed up the whole thing because no unnecessary marshalling is required! C++.NET is also better in most cases because you may access the whole native windows API from managed code without any effort what significantly eases writing of hook handlers.

The given delegate is automatically prevented from being garbage collected until the hook itself is collected...

Reference