7 ms·
Off-topic: I wrote a very primitive passive keystroke logger a few years ago (just to demonstrate how they work). I still have the source code and folks email m
by 16s 16y ago
Off-topic: I wrote a very primitive passive keystroke logger a few years ago (just to demonstrate how they work). I still have the source code and folks email me about it often:
https://github.com/16s/16k https://github.com/16s/16k
My example is really trivial and it only works on Windows, but it works well and demonstrates the concept of passive keystroke logging. Unlike system wide hooks, passive logging just monitors the key states. Sort of like when you are playing a video game and press the 'P' key. The game pauses because it's monitoring the P key's state (up or down) and can tell when it changes. Extend that concept to the entire keyboard and you have a passive keystroke logger.
Passive loggers are more challenging to detect as well and they run just fine as a normal user (no need to be root).
- getsat 16y agoJust use SetWindowsHookEx() with WH_KEYBOARD_LL. Here's some ancient proof of concept code I wrote for detecting user activity (keyboard and mouse): https://gist.github.com/a95f198292c9e453e054 https://gist.github.com/a95f198292c9e453e054 This was originally to be used with malware that needs to run when the user is away from their workstation. You can access p->vkCode in KeyboardProc() to see which keys are pressed. One interesting thing to note is that if you remove the invisible window/message pumping loop, the program behaves erratically when processing the low-level inputs. I never looked into this.
- iuguy 16y agoThis is really really easy to detect for malware analysts. One of the first things you look for in memory on a compromised system is hooking. Most rootkits use hooks at different levels to hide or monitor things. Strangely, on a clean system most hooks tend to be from the Antivirus (usually hooking filesystem calls for on demand scans).
- getsat 16y agoDefinitely. Any amateur effort will generally involve SetWindowsHookEx() + DLL injection to capture keystrokes. The intention was to move this up to ring 0 eventually, but I decided to work on more lucrative things instead.
- dotBen 16y ago"Here's some ancient proof of concept code I wrote for detecting user activity .. This was originally to be used with malware that needs to run..." Are you implying that you wrote malware?
- getsat 16y agoI was considering it a long time ago. It was fun to poke around Win32 internals and you could (potentially) make a lot of money.
- Havoc 16y agoStumbled across the same function (GetAsyncKeyState) when I was a kid....mainly because I couldn't figure out hooks. They are not difficult to detect though. Emulate an (obscure) keystroke, wait 5sec and do you own GetAsyncKeyState. If its cleared then another app pulled the keystate via GetAsyncKeyState.
- barrkel 16y agoA low-level keyboard hook (that's a specific kind of Windows hook) does not need root either. It still only monitors the session that the hooking app is running in the context of.
- burrows 16y agoThis is a very naive implementation. Better off using a keyboard hook or GetAsyncKeyState as someone suggested. And if you want to write a 'real' implementation, you write a keyboard filter driver. Or hook NtUserGetAsyncKeyState.
- 16s 16y agoIt does use GetAsyncKeyState. Did you not read the source code? It works extremely well too (with regard to accuracy). Try the pre-compiled binary. // From the source code: ks = GetAsyncKeyState( kiter->first );
- burrows 16y agoMy apologies. I hadn't mean to suggest GAKS. However there are many known problems with implementations using GAKS. Bad implementations make heavy use of CPU and it's easily detectable. The methods I suggested later in my post are far superior. It also very wrong to claim that _this_ is how keyloggers are implemented. This technique has been deprecated some time ago.