C# Signature:

[DllImport("user32.dll")]
static extern IntPtr SetWinEventHook(WinEvents eventMin, WinEvents eventMax, IntPtr
   hmodWinEventProc, WinEventDelegate lpfnWinEventProc, uint idProcess,
   uint idThread, WinEventFlags dwFlags);

VB Signature:

    <System.Runtime.InteropServices.DllImport("user32.dll", EntryPoint:="SetWinEventHook")> _
    Private Shared Function SetWinEventHook( _
        ByVal eventMin As UInteger, _
        ByVal eventMax As UInteger, _
        ByVal hmodWinEventProc As IntPtr, _
        ByVal lpfnWinEventProc As WinEventDelegate, _
        ByVal idProcess As UInteger, _
        ByVal idThread As UInteger, _
        ByVal dwFlags As UInteger _
    ) As IntPtr
    End Function

User-Defined Types:

WinEventDelegate

C# Constants:

Flags

    public enum WinEventFlags : uint
    {
    WINEVENT_OUTOFCONTEXT = 0x0000, // Events are ASYNC
    WINEVENT_SKIPOWNTHREAD = 0x0001, // Don't call back for events on installer's thread
    WINEVENT_SKIPOWNPROCESS = 0x0002, // Don't call back for events on installer's process
    WINEVENT_INCONTEXT = 0x0004, // Events are SYNC, this causes your dll to be injected into every process
    }

     public enum WinEvents : uint
    {
    /** The range of WinEvent constant values specified by the Accessibility Interoperability Alliance (AIA) for use across the industry.
* For more information, see Allocation of WinEvent IDs. */
    EVENT_AIA_START = 0xA000,
    EVENT_AIA_END = 0xAFFF,

    /** The lowest and highest possible event values.
*/
    EVENT_MIN = 0x00000001,
    EVENT_MAX = 0x7FFFFFFF,

    /** An object's KeyboardShortcut property has changed. Server applications send this event for their accessible objects.
*/
    EVENT_OBJECT_ACCELERATORCHANGE = 0x8012,

    /** Sent when a window is cloaked. A cloaked window still exists, but is invisible to the user.
*/
    EVENT_OBJECT_CLOAKED = 0x8017,

    /** A window object's scrolling has ended. Unlike EVENT_SYSTEM_SCROLLEND, this event is associated with the scrolling window.
* Whether the scrolling is horizontal or vertical scrolling, this event should be sent whenever the scroll action is completed. * The hwnd parameter of the WinEventProc callback function describes the scrolling window; the idObject parameter is OBJID_CLIENT, * and the idChild parameter is CHILDID_SELF. */
    EVENT_OBJECT_CONTENTSCROLLED = 0x8015,

    /** An object has been created. The system sends this event for the following user interface elements: caret, header control,
* list-view control, tab control, toolbar control, tree view control, and window object. Server applications send this event * for their accessible objects. * Before sending the event for the parent object, servers must send it for all of an object's child objects. * Servers must ensure that all child objects are fully created and ready to accept IAccessible calls from clients before * the parent object sends this event. * Because a parent object is created after its child objects, clients must make sure that an object's parent has been created * before calling IAccessible::get_accParent, particularly if in-context hook functions are used. */
    EVENT_OBJECT_CREATE = 0x8000,

    /** An object's DefaultAction property has changed. The system sends this event for dialog boxes. Server applications send
* this event for their accessible objects. */
    EVENT_OBJECT_DEFACTIONCHANGE = 0x8011,

    /** An object's Description property has changed. Server applications send this event for their accessible objects.
*/
    EVENT_OBJECT_DESCRIPTIONCHANGE = 0x800D,

    /** An object has been destroyed. The system sends this event for the following user interface elements: caret, header control,
* list-view control, tab control, toolbar control, tree view control, and window object. Server applications send this event for * their accessible objects. * Clients assume that all of an object's children are destroyed when the parent object sends this event. * After receiving this event, clients do not call an object's IAccessible properties or methods. However, the interface pointer * must remain valid as long as there is a reference count on it (due to COM rules), but the UI element may no longer be present. * Further calls on the interface pointer may return failure errors; to prevent this, servers create proxy objects and monitor * their life spans. */
    EVENT_OBJECT_DESTROY = 0x8001,

    /** The user started to drag an element. The hwnd, idObject, and idChild parameters of the WinEventProc callback function
* identify the object being dragged. */
    EVENT_OBJECT_DRAGSTART = 0x8021,

    /** The user has ended a drag operation before dropping the dragged element on a drop target. The hwnd, idObject, and idChild
* parameters of the WinEventProc callback function identify the object being dragged. */
    EVENT_OBJECT_DRAGCANCEL = 0x8022,

    /** The user dropped an element on a drop target. The hwnd, idObject, and idChild parameters of the WinEventProc callback
* function identify the object being dragged. */
    EVENT_OBJECT_DRAGCOMPLETE = 0x8023,

    /** The user dragged an element into a drop target's boundary. The hwnd, idObject, and idChild parameters of the WinEventProc
* callback function identify the drop target. */
    EVENT_OBJECT_DRAGENTER = 0x8024,

    /** The user dragged an element out of a drop target's boundary. The hwnd, idObject, and idChild parameters of the WinEventProc
* callback function identify the drop target. */
    EVENT_OBJECT_DRAGLEAVE = 0x8025,

    /** The user dropped an element on a drop target. The hwnd, idObject, and idChild parameters of the WinEventProc callback
* function identify the drop target. */
    EVENT_OBJECT_DRAGDROPPED = 0x8026,

    /** The highest object event value.
*/
    EVENT_OBJECT_END = 0x80FF,

    /** An object has received the keyboard focus. The system sends this event for the following user interface elements:
* list-view control, menu bar, pop-up menu, switch window, tab control, tree view control, and window object. * Server applications send this event for their accessible objects. * The hwnd parameter of the WinEventProc callback function identifies the window that receives the keyboard focus. */
    EVENT_OBJECT_FOCUS = 0x8005,

    /** An object's Help property has changed. Server applications send this event for their accessible objects.
*/
    EVENT_OBJECT_HELPCHANGE = 0x8010,

    /** An object is hidden. The system sends this event for the following user interface elements: caret and cursor.
* Server applications send this event for their accessible objects. * When this event is generated for a parent object, all child objects are already hidden. * Server applications do not send this event for the child objects. * Hidden objects include the STATE_SYSTEM_INVISIBLE flag; shown objects do not include this flag. The EVENT_OBJECT_HIDE event * also indicates that the STATE_SYSTEM_INVISIBLE flag is set. Therefore, servers do not send the EVENT_STATE_CHANGE event in * this case. */
    EVENT_OBJECT_HIDE = 0x8003,

    /** A window that hosts other accessible objects has changed the hosted objects. A client might need to query the host
* window to discover the new hosted objects, especially if the client has been monitoring events from the window. * A hosted object is an object from an accessibility framework (MSAA or UI Automation) that is different from that of the host. * Changes in hosted objects that are from the same framework as the host should be handed with the structural change events, * such as EVENT_OBJECT_CREATE for MSAA. For more info see comments within winuser.h. */
    EVENT_OBJECT_HOSTEDOBJECTSINVALIDATED = 0x8020,

    /** An IME window has become hidden.
*/
    EVENT_OBJECT_IME_HIDE = 0x8028,

    /** An IME window has become visible.
*/
    EVENT_OBJECT_IME_SHOW = 0x8027,

    /** The size or position of an IME window has changed.
*/
    EVENT_OBJECT_IME_CHANGE = 0x8029,

    /** An object has been invoked; for example, the user has clicked a button. This event is supported by common controls and is
* used by UI Automation. * For this event, the hwnd, ID, and idChild parameters of the WinEventProc callback function identify the item that is invoked. */
    EVENT_OBJECT_INVOKED = 0x8013,

    /** An object that is part of a live region has changed. A live region is an area of an application that changes frequently
* and/or asynchronously. */
    EVENT_OBJECT_LIVEREGIONCHANGED = 0x8019,

    /** An object has changed location, shape, or size. The system sends this event for the following user interface elements:
* caret and window objects. Server applications send this event for their accessible objects. * This event is generated in response to a change in the top-level object within the object hierarchy; it is not generated for any * children that the object might have. For example, if the user resizes a window, the system sends this notification for the window, * but not for the menu bar, title bar, scroll bar, or other objects that have also changed. * The system does not send this event for every non-floating child window when the parent moves. However, if an application explicitly * resizes child windows as a result of resizing the parent window, the system sends multiple events for the resized children. * If an object's State property is set to STATE_SYSTEM_FLOATING, the server sends EVENT_OBJECT_LOCATIONCHANGE whenever the object changes * location. If an object does not have this state, servers only trigger this event when the object moves in relation to its parent. * For this event notification, the idChild parameter of the WinEventProc callback function identifies the child object that has changed. */
    EVENT_OBJECT_LOCATIONCHANGE = 0x800B,

    /** An object's Name property has changed. The system sends this event for the following user interface elements: check box,
* cursor, list-view control, push button, radio button, status bar control, tree view control, and window object. Server * * applications send this event for their accessible objects. */
    EVENT_OBJECT_NAMECHANGE = 0x800C,

    /** An object has a new parent object. Server applications send this event for their accessible objects.
*/
    EVENT_OBJECT_PARENTCHANGE = 0x800F,

    /** A container object has added, removed, or reordered its children. The system sends this event for the following user
* interface elements: header control, list-view control, toolbar control, and window object. Server applications send this * event as appropriate for their accessible objects. * For example, this event is generated by a list-view object when the number of child elements or the order of the elements changes. * This event is also sent by a parent window when the Z-order for the child windows changes. */
    EVENT_OBJECT_REORDER = 0x8004,

    /** The selection within a container object has changed. The system sends this event for the following user interface elements:
* list-view control, tab control, tree view control, and window object. Server applications send this event for their accessible * objects. * This event signals a single selection: either a child is selected in a container that previously did not contain any selected children, * or the selection has changed from one child to another. * The hwnd and idObject parameters of the WinEventProc callback function describe the container; the idChild parameter identifies the object * that is selected. If the selected child is a window that also contains objects, the idChild parameter is OBJID_WINDOW. */
    EVENT_OBJECT_SELECTION = 0x8006,

    /** A child within a container object has been added to an existing selection. The system sends this event for the following user
* interface elements: list box, list-view control, and tree view control. Server applications send this event for their accessible * objects. * The hwnd and idObject parameters of the WinEventProc callback function describe the container. The idChild parameter is the child that * is added to the selection. */
    EVENT_OBJECT_SELECTIONADD = 0x8007,

    /** An item within a container object has been removed from the selection. The system sends this event for the following user
* interface elements: list box, list-view control, and tree view control. Server applications send this event for their accessible * objects. * This event signals that a child is removed from an existing selection. * The hwnd and idObject parameters of the WinEventProc callback function describe the container; the idChild parameter identifies * the child that has been removed from the selection. */
    EVENT_OBJECT_SELECTIONREMOVE = 0x8008,

    /** Numerous selection changes have occurred within a container object. The system sends this event for list boxes; server
* applications send it for their accessible objects. * This event is sent when the selected items within a control have changed substantially. The event informs the client * that many selection changes have occurred, and it is sent instead of several * EVENT_OBJECT_SELECTIONADD or EVENT_OBJECT_SELECTIONREMOVE events. The client * queries for the selected items by calling the container object's IAccessible::get_accSelection method and * enumerating the selected items. For this event notification, the hwnd and idObject parameters of the WinEventProc callback * function describe the container in which the changes occurred. */
    EVENT_OBJECT_SELECTIONWITHIN = 0x8009,

    /** A hidden object is shown. The system sends this event for the following user interface elements: caret, cursor, and window
* object. Server applications send this event for their accessible objects. * Clients assume that when this event is sent by a parent object, all child objects are already displayed. * Therefore, server applications do not send this event for the child objects. * Hidden objects include the STATE_SYSTEM_INVISIBLE flag; shown objects do not include this flag. * The EVENT_OBJECT_SHOW event also indicates that the STATE_SYSTEM_INVISIBLE flag is cleared. Therefore, servers * do not send the EVENT_STATE_CHANGE event in this case. */
    EVENT_OBJECT_SHOW = 0x8002,

    /** An object's state has changed. The system sends this event for the following user interface elements: check box, combo box,
* header control, push button, radio button, scroll bar, toolbar control, tree view control, up-down control, and window object. * Server applications send this event for their accessible objects. * For example, a state change occurs when a button object is clicked or released, or when an object is enabled or disabled. * For this event notification, the idChild parameter of the WinEventProc callback function identifies the child object whose state has changed. */
    EVENT_OBJECT_STATECHANGE = 0x800A,

    /** The conversion target within an IME composition has changed. The conversion target is the subset of the IME composition
* which is actively selected as the target for user-initiated conversions. */
    EVENT_OBJECT_TEXTEDIT_CONVERSIONTARGETCHANGED = 0x8030,

    /** An object's text selection has changed. This event is supported by common controls and is used by UI Automation.
* The hwnd, ID, and idChild parameters of the WinEventProc callback function describe the item that is contained in the updated text selection. */
    EVENT_OBJECT_TEXTSELECTIONCHANGED = 0x8014,

    /** Sent when a window is uncloaked. A cloaked window still exists, but is invisible to the user.
*/
    EVENT_OBJECT_UNCLOAKED = 0x8018,

    /** An object's Value property has changed. The system sends this event for the user interface elements that include the scroll
* bar and the following controls: edit, header, hot key, progress bar, slider, and up-down. Server applications send this event * for their accessible objects. */
    EVENT_OBJECT_VALUECHANGE = 0x800E,

    /** The range of event constant values reserved for OEMs. For more information, see Allocation of WinEvent IDs.
*/
    EVENT_OEM_DEFINED_START = 0x0101,
    EVENT_OEM_DEFINED_END = 0x01FF,

    /** An alert has been generated. Server applications should not send this event.
*/
    EVENT_SYSTEM_ALERT = 0x0002,

    /** A preview rectangle is being displayed.
*/
    EVENT_SYSTEM_ARRANGMENTPREVIEW = 0x8016,

    /** A window has lost mouse capture. This event is sent by the system, never by servers.
*/
    EVENT_SYSTEM_CAPTUREEND = 0x0009,

    /** A window has received mouse capture. This event is sent by the system, never by servers.
*/
    EVENT_SYSTEM_CAPTURESTART = 0x0008,

    /** A window has exited context-sensitive Help mode. This event is not sent consistently by the system.
*/     EVENT_SYSTEM_CONTEXTHELPEND = 0x000D,

    /** A window has entered context-sensitive Help mode. This event is not sent consistently by the system.
*/
    EVENT_SYSTEM_CONTEXTHELPSTART = 0x000C,

    /** The active desktop has been switched.
*/
    EVENT_SYSTEM_DESKTOPSWITCH = 0x0020,

    /** A dialog box has been closed. The system sends this event for standard dialog boxes; servers send it for custom dialog boxes.
* This event is not sent consistently by the system. */
    EVENT_SYSTEM_DIALOGEND = 0x0011,

    /** A dialog box has been displayed. The system sends this event for standard dialog boxes, which are created using resource
* templates or Win32 dialog box functions. Servers send this event for custom dialog boxes, which are windows that function as * dialog boxes but are not created in the standard way. * This event is not sent consistently by the system. */
    EVENT_SYSTEM_DIALOGSTART = 0x0010,

    /** An application is about to exit drag-and-drop mode. Applications that support drag-and-drop operations must send this event;
* the system does not send this event. */
    EVENT_SYSTEM_DRAGDROPEND = 0x000F,

    /** An application is about to enter drag-and-drop mode. Applications that support drag-and-drop operations must send this
* event because the system does not send it. */
    EVENT_SYSTEM_DRAGDROPSTART = 0x000E,

    /** The highest system event value.
*/
    EVENT_SYSTEM_END = 0x00FF,

    /** The foreground window has changed. The system sends this event even if the foreground window has changed to another window
* in the same thread. Server applications never send this event. * For this event, the WinEventProc callback function's hwnd parameter is the handle to the window that is in the * foreground, the idObject parameter is OBJID_WINDOW, and the idChild parameter is CHILDID_SELF. */
    EVENT_SYSTEM_FOREGROUND = 0x0003,

    /** A pop-up menu has been closed. The system sends this event for standard menus; servers send it for custom menus.
* When a pop-up menu is closed, the client receives this message, and then the EVENT_SYSTEM_MENUEND event. * This event is not sent consistently by the system. */
    EVENT_SYSTEM_MENUPOPUPEND = 0x0007,

    /** A pop-up menu has been displayed. The system sends this event for standard menus, which are identified by HMENU, and are
* created using menu-template resources or Win32 menu functions. Servers send this event for custom menus, which are user * interface elements that function as menus but are not created in the standard way. This event is not sent consistently by the system. */
    EVENT_SYSTEM_MENUPOPUPSTART = 0x0006,

    /** A menu from the menu bar has been closed. The system sends this event for standard menus; servers send it for custom menus.
* For this event, the WinEventProc callback function's hwnd, idObject, and idChild parameters refer to the control * that contains the menu bar or the control that activates the context menu. The hwnd parameter is the handle to the window * that is related to the event. The idObject parameter is OBJID_MENU or OBJID_SYSMENU for a menu, or OBJID_WINDOW for a * pop-up menu. The idChild parameter is CHILDID_SELF. */
    EVENT_SYSTEM_MENUEND = 0x0005,

    /** A menu item on the menu bar has been selected. The system sends this event for standard menus, which are identified
* by HMENU, created using menu-template resources or Win32 menu API elements. Servers send this event for custom menus, * which are user interface elements that function as menus but are not created in the standard way. * For this event, the WinEventProc callback function's hwnd, idObject, and idChild parameters refer to the control * that contains the menu bar or the control that activates the context menu. The hwnd parameter is the handle to the window * related to the event. The idObject parameter is OBJID_MENU or OBJID_SYSMENU for a menu, or OBJID_WINDOW for a pop-up menu. * The idChild parameter is CHILDID_SELF.The system triggers more than one EVENT_SYSTEM_MENUSTART event that does not always * correspond with the EVENT_SYSTEM_MENUEND event. */
    EVENT_SYSTEM_MENUSTART = 0x0004,

    /** A window object is about to be restored. This event is sent by the system, never by servers.
*/
    EVENT_SYSTEM_MINIMIZEEND = 0x0017,

    /** A window object is about to be minimized. This event is sent by the system, never by servers.
*/
    EVENT_SYSTEM_MINIMIZESTART = 0x0016,

    /** The movement or resizing of a window has finished. This event is sent by the system, never by servers.
*/
    EVENT_SYSTEM_MOVESIZEEND = 0x000B,

    /** A window is being moved or resized. This event is sent by the system, never by servers.
*/
    EVENT_SYSTEM_MOVESIZESTART = 0x000A,

    /** Scrolling has ended on a scroll bar. This event is sent by the system for standard scroll bar controls and for
* scroll bars that are attached to a window. Servers send this event for custom scroll bars, which are user interface * elements that function as scroll bars but are not created in the standard way. * The idObject parameter that is sent to the WinEventProc callback function is OBJID_HSCROLL for horizontal scroll bars, and * OBJID_VSCROLL for vertical scroll bars. */
    EVENT_SYSTEM_SCROLLINGEND = 0x0013,

    /** Scrolling has started on a scroll bar. The system sends this event for standard scroll bar controls and for scroll
* bars attached to a window. Servers send this event for custom scroll bars, which are user interface elements that * function as scroll bars but are not created in the standard way. * The idObject parameter that is sent to the WinEventProc callback function is OBJID_HSCROLL for horizontal scrolls bars, * and OBJID_VSCROLL for vertical scroll bars. */     EVENT_SYSTEM_SCROLLINGSTART = 0x0012,

    /** A sound has been played. The system sends this event when a system sound, such as one for a menu,
* is played even if no sound is audible (for example, due to the lack of a sound file or a sound card). * Servers send this event whenever a custom UI element generates a sound. * For this event, the WinEventProc callback function receives the OBJID_SOUND value as the idObject parameter. */
    EVENT_SYSTEM_SOUND = 0x0001,

    /** The user has released ALT+TAB. This event is sent by the system, never by servers.
* The hwnd parameter of the WinEventProc callback function identifies the window to which the user has switched. * If only one application is running when the user presses ALT+TAB, the system sends this event without a corresponding * EVENT_SYSTEM_SWITCHSTART event. */
    EVENT_SYSTEM_SWITCHEND = 0x0015,

    /** The user has pressed ALT+TAB, which activates the switch window. This event is sent by the system, never by servers.
* The hwnd parameter of the WinEventProc callback function identifies the window to which the user is switching. * If only one application is running when the user presses ALT+TAB, the system sends an EVENT_SYSTEM_SWITCHEND event without a * corresponding EVENT_SYSTEM_SWITCHSTART event. */
    EVENT_SYSTEM_SWITCHSTART = 0x0014,

    /** The range of event constant values reserved for UI Automation event identifiers. For more information,
* see Allocation of WinEvent IDs. */
    EVENT_UIA_EVENTID_START = 0x4E00,
    EVENT_UIA_EVENTID_END = 0x4EFF,

    /**
* The range of event constant values reserved for UI Automation property-changed event identifiers. * For more information, see Allocation of WinEvent IDs. */
    EVENT_UIA_PROPID_START = 0x7500,
    EVENT_UIA_PROPID_END = 0x75FF
    }

Notes:

The MSDN documentation states:

When you use a Win32 API that has a callback in managed code, such as SetWinEventHook, you should use GCHandle class structure to avoid exceptions.

This is apparently not accurate as the P/Invoke layer automatically generates a marshaling stub at a fixed address:

http://blogs.msdn.com/cbrumme/archive/2003/05/06/51385.aspx

Tips & Tricks:

Please add some!

Sample Code:

Please add some!

Alternative Managed API:

The ManagedWindowsApi project (http://mwinapi.sourceforge.net) provides a SystemAccessibleObject class to access accessible objects and handle accessible events.

Please edit this page!

Do you have...

• helpful tips or sample code to share for using this API in managed code?
• corrections to the existing content?
• variations of the signature you want to share?
• additional languages you want to include?

Select "Edit This Page" on the right hand toolbar and edit it! Or add new pages containing supporting types needed for this API (structures, delegates, and more).