Keystroke Monitoring

Apriorit Inc, Vladimir S. Sabanov

Rate me:

4.93/5 (53 votes)

19 Oct 2009CPOL6 min read

103K

4.7K

163

In this article, we will consider the methods of hooking keyboard data in the kernel mode.

keyboardhook_src.zip
- src
  - clean.bat
  - ddk_build.bat
  - DriverMain
    - CKeyLoggerObserver.cpp
    - CKeyLoggerObserver.h
    - ClassDiagram1.cd
    - DriverMain.vcproj
    - Init.cpp
    - Init.h
    - InstallHooks.cpp
    - InstallHooks.h
    - Makefile
    - Sources
  - KBHookLib
    - APCRoutinePatch.cpp
    - APCRoutinePatch.h
    - CAPCContext.cpp
    - CAPCContext.h
    - CKbdclassHook.cpp
    - CKbdclassHook.h
    - CKBFilterManager.cpp
    - CKBFilterManager.h
    - CKBFilterObject.cpp
    - CKBFilterObject.h
    - IExternalObserver.h
    - IFilterObject.h
    - IFiltersManager.h
    - IIRPDispatcher.h
    - IIRPProcessor.h
    - IOCompletionRoutine.cpp
    - IOCompletionRoutine.h
    - KbdclassDefs.h
    - KBHookLib.vcproj
    - Makefile
    - Sources
  - LibCPP2
    - libcpp.h
    - limits.h
    - typeinfo
    - typeinfo.h
    - wchar.h
    - yvals.h
  - MSSTLPort
    - algorithm
    - bitset
    - climits
    - deque
    - exception
    - functional
    - iosfwd
    - iterator
    - list
    - map
    - memory
    - MSSTLPort.vcproj
    - new
    - queue
    - set
    - stack
    - stdexcept
    - string
    - utility
    - vector
    - xmemory
    - xstddef
    - xstring
    - xtree
    - xutility
  - SolutionItems
    - LibCPP2
      - LibCPP2.lib
  - TestDriver.sln
  - UtilsNative
    - Guards.cpp
    - Guards.h
    - Makefile
    - Sources
    - UtilsNative.vcproj
    - Wrappers.cpp
    - Wrappers.h
  - UtilsPort
    - GuardsPort.h
    - UtilsPort.vcproj

#ifndef __INIT_H__
#define __INIT_H__

extern "C"{
    #include <ntifs.h>
};

const wchar_t KBHookDeviceName[] = L"\\Device\\KBHookDriver";
const wchar_t KBHookSymlink[] = L"\\??\\KBHookDriver";

extern "C"
    NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObject, PUNICODE_STRING pRegistryPath);
void DriverUnload(PDRIVER_OBJECT pDriverObject);

NTSTATUS DefaultDispatchRoutine(PDEVICE_OBJECT pDeviceObject, PIRP pIRP);

#endif

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Written By

Apriorit Inc

Chief Technology Officer Apriorit Inc.

United States

ApriorIT is a software research and development company specializing in cybersecurity and data management technology engineering. We work for a broad range of clients from Fortune 500 technology leaders to small innovative startups building unique solutions.

As Apriorit offers integrated research&development services for the software projects in such areas as endpoint security, network security, data security, embedded Systems, and virtualization, we have strong kernel and driver development skills, huge system programming expertise, and are reals fans of research projects.

Our specialty is reverse engineering, we apply it for security testing and security-related projects.

A separate department of Apriorit works on large-scale business SaaS solutions, handling tasks from business analysis, data architecture design, and web development to performance optimization and DevOps.

Official site: https://www.apriorit.com
Clutch profile: https://clutch.co/profile/apriorit

This is a Organisation

33 members

Written By

Vladimir S. Sabanov

Software Developer (Senior) AptiorIT

Ukraine

This member has not yet provided a Biography. Assume it's interesting and varied, and probably something to do with programming.

Keystroke Monitoring

License

Comments and Discussions