3 ms·
Just use SetWindowsHookEx() with WH_KEYBOARD_LL. Here's some ancient proof of concept code I wrote for detecting user activity (keyboard and mouse): https://gi
by getsat 16y ago
Just use SetWindowsHookEx() with WH_KEYBOARD_LL. Here's some ancient proof of concept code I wrote for detecting user activity (keyboard and mouse):
https://gist.github.com/a95f198292c9e453e054 https://gist.github.com/a95f198292c9e453e054
This was originally to be used with malware that needs to run when the user is away from their workstation. You can access p->vkCode in KeyboardProc() to see which keys are pressed.
One interesting thing to note is that if you remove the invisible window/message pumping loop, the program behaves erratically when processing the low-level inputs. I never looked into this.
- iuguy 16y agoThis is really really easy to detect for malware analysts. One of the first things you look for in memory on a compromised system is hooking. Most rootkits use hooks at different levels to hide or monitor things. Strangely, on a clean system most hooks tend to be from the Antivirus (usually hooking filesystem calls for on demand scans).
- getsat 16y agoDefinitely. Any amateur effort will generally involve SetWindowsHookEx() + DLL injection to capture keystrokes. The intention was to move this up to ring 0 eventually, but I decided to work on more lucrative things instead.
- dotBen 16y ago"Here's some ancient proof of concept code I wrote for detecting user activity .. This was originally to be used with malware that needs to run..." Are you implying that you wrote malware?
- getsat 16y agoI was considering it a long time ago. It was fun to poke around Win32 internals and you could (potentially) make a lot of money.