We help IT Professionals succeed at work.
Get Started

Help with a keylogger detector

SeanDurkin
SeanDurkin asked
on
1,547 Views
Last Modified: 2013-12-04
Hello! I'm trying to make a userland keylogger detector in C++ for Win32 (I'd like it to work for 2000 and XP, but solely XP would be tolerable), which detects all main userland keylogging methods (SetWindowsHookEx() and GetAsyncKeyState()).

My problem is that I'm trying to detect which process(es) have set a windows hook, and I've found that it is harder than I originally thought. At first, I tried to set a global WH_DEBUG hook to catch any WH_KEYBOARD hooks that were set, but it wouldn't allow me to view the process or thread id that set the original hook.

After a great deal of research, I came to the conclusion that I'd have to use an undocumented structure called the TEB (Thread Environment Block) to access the hook chain for every windows hook, and then I could get the process information from there. The information I found is located here:

http://zairon.wordpress.com/2006/12/06/any-application-defined-hook-procedure-on-my-machine/

The problem is that it's an undocumented structure, and I'm also messing around with the win32k subsystem, which I really shouldn't be doing. I was wondering three things: 1) Is this is the only way to go about it, and if it is, 2) how would I find out more information about the hook chains within Windows so that I could safely get access to the information I need? I'm doing this project simply to expand my knowledge about Windows programming and to get more experience, so 3) would it even be worth it to finish this project?

On a side note: I know this is possible, because I found a keylogger detector (that is for sale) that does this, but the original site was taken down for some reason. It can be found here:

http://software.techrepublic.com.com/download.aspx?docid=225314
Comment
Watch Question
This problem has been solved!
Unlock 1 Answer and 11 Comments.
See Answer
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE