Solved

Hooking into keyboard to log user activity

Posted on 2004-09-28
3
656 Views
Last Modified: 2013-12-03
I would like to write a proram that logs every keystroke. I've read enough to know that I have to use keyboard hooks, but do not know how to do this. I need a good easy-to-understand explaination and possibly some sample code on this.

I'd like to write this in C#, but am very well versed in vb & vb.net.
0
Comment
Question by:apm825
3 Comments
 
LVL 14

Accepted Solution

by:
RichieHindle earned 500 total points
ID: 12282280
Below is a C program that does what you need - just replace the 'printf' with log output code.

I don't know C# I'm afraid.  8-(  At http://www.codeproject.com/csharp/NetWin32Hooks.asp is an article on implementing hooks in C#, with source code for a hook library.  Between that article and this code, you should find what you need.

Write this code into a file called keylogger.c, then at a command prompt do:

cl keylogger.c -link -subsystem:console user32.lib
keylogger

Now whenever you press an alphabetical key in any application, keylogger will log that even to the command prompt(it only prints alphabetical keys to make it simple - it traps all keys, but just doesn't print the non-alphabetical ones).

This uses a low-level keyboard hook, which is not available on Win9x.  You'll need to use an ordinary WH_KEYBOARD hook, rather than a WH_KEYBOARD_LL, if you want your code to work on Win9x.  I believe the code in the article I mentioned above will support that.  (I didn't use WH_KEYBOARD in my example below because WH_KEYBOARD hooks need to live in a DLL, which complicates the example.  WH_KEYBOARD_LL hooks can live in the main executable.)

#define _WIN32_WINNT 0x0400
#include "windows.h"

HHOOK g_Hook;

LRESULT CALLBACK HookFn(int nCode, WPARAM wParam, LPARAM lParam)
{
    if (nCode == HC_ACTION)
    {
        KBDLLHOOKSTRUCT* pKHS = (KBDLLHOOKSTRUCT*) lParam;
        if (pKHS->vkCode >= 'A' && pKHS->vkCode <= 'Z' && !(pKHS->flags & LLKHF_UP))
        {
            printf("You pressed %c\n", pKHS->vkCode);
        }
    }

    return CallNextHookEx(g_Hook, nCode, wParam, lParam);
}

int main(void)
{
    HMODULE Module = GetModuleHandle(NULL);
    g_Hook = SetWindowsHookEx(WH_KEYBOARD_LL, (HOOKPROC) HookFn, Module, 0);
    MessageBox(NULL, "Press OK to stop logging", "Key Logger", MB_ICONINFORMATION | MB_OK);
    UnhookWindowsHookEx(g_Hook);
    return 0;
}
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

This article describes a technique for converting RTF (Rich Text Format) data to HTML and provides C++ source that does it all in just a few lines of code. Although RTF is coming to be considered a "legacy" format, it is still in common use... po…
What my article will show is if you ever had to do processing to a listbox without being able to just select all the items in it. My software Visual Studio 2008 crystal report v11 My issue was I wanted to add crystal report to a form and show…
This is Part 3 in a 3-part series on Experts Exchange to discuss error handling in VBA code written for Excel. Part 1 of this series discussed basic error handling code using VBA. http://www.experts-exchange.com/videos/1478/Excel-Error-Handlin…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

746 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now