From aldeid
Jump to navigation Jump to search


Attaches or detaches the input processing for one thread to another so that the second thread receives input events such as keyboard and mouse events.

Keyloggers and other spyware use this function.


BOOL WINAPI AttachThreadInput(
  _In_ DWORD idAttach,
  _In_ DWORD idAttachTo,
  _In_ BOOL  fAttach


idAttach [in]
The identifier of the thread to be attached to another thread. The thread to be attached cannot be a system thread.
idAttachTo [in]
The identifier of the thread to which idAttach will be attached. This thread cannot be a system thread.
A thread cannot attach to itself. Therefore, idAttachTo cannot equal idAttach.
fAttach [in]
If this parameter is TRUE, the two threads are attached. If the parameter is FALSE, the threads are detached.

Return value

If the function succeeds, the return value is nonzero.

If the function fails, the return value is zero. To get extended error information, call GetLastError.

Windows Server 2003 and Windows XP: There is no extended error information; do not call GetLastError. This behavior changed as of Windows Vista.