Typically we don't want the userspace to be compromised at all. An antilogger works by effectively substituting letters as they are typed. So when I type 'A', i

Typically we don't want the userspace to be compromised at all. An antilogger works by effectively substituting letters as they are typed. So when I type 'A', it is read as A in the kernel, but backspaced, replaced by a random letter, and then the real `A` appears on screen by means of hijacking the input form. For the pedants: Some more advanced antiloggers are minus ring-0 and physically remap the keys so that `A` doesn't mean A at all. Infact if I typed this, a load of garbage would be displayed on the screen. The only reason we see valid output is because of a software abstraction layer translating the 'garbage' back to it original symbolic meaning. This is how we thwart such a kernel logger as described in this thread.