Is there any kind of way to monitor the low level keyboard hooks in a Windows enviroment. Say if I am making a program trying to find keyloggers.
+1
A:
It really depends on a number of things; the way keyboard events get handled on whatever operating system you're using and the way each keylogger works. What have you found out? What have you tried? What doesn't work?
Graham Lee
2009-04-10 08:01:33
A windows environment is what I would be doing this in.
dax
2009-04-10 08:05:32
A:
Discussion about reading hooks
A problem you might run into is that there are malware that do not exist as "processes" that you can enumerate easily.
CookieOfFortune
2009-04-10 08:11:19
A:
There is no official API to query the installed keyboard hooks. Since MicroSoft doesn't share the source for Windows, you must install a keyboard hook and single step the assembler code to figure out where Windows is saving this information. Then, you can write a device driver that watches this memory area for changes.
Aaron Digulla
2009-04-10 08:19:16
A:
> There is no official API to query the installed keyboard hooks.
Yes, there are. (you're too young to know this...)
You must read the PEB.
See on Win32 api Group
where all the Windows source code (each api, undocumented or not ) had been disassembled
Perhaps this link might be more useful: http://groups.google.com/group/comp.os.ms-windows.programmer.win32/topics
Damian Powell
2009-12-29 10:36:03
A:
Another problem is that at least one keylogger works by injecting itself into the keyboard's processor memory and running from there. Almost impossible to detect and if you can, you'll have to know a lot about how keyboards work.
Summary: If you have success with this task in any way, you will probably not cover all possible keyloggers. Bad news, I'm afraid.
Stephen Kellett
2010-04-08 19:52:24