views:

62

answers:

2

Is it possible to write a key logger in Visual Basic.NET? Is this the right language to be using?

So far, I've gotten a console app to read input and append to a file.

1)How can I make a .NET program "catch" all keyboard input?

2)How do I make a process not show up in Task Manager?

This is not for a virus, but rather a parental control program for a specific clientele. No malicious intent here.

+1  A: 
  1. You need to set a Keyboard Hook.
  2. This is extremely difficult and is not possible on 64-bit editions of Windows.
    If you're really doing this with consent, this shouldn't be necessary.
SLaks
What's different in 64-bit edition of Windows?
Sam
@Sam - +1 - I dunno, but I once heard something about negative Process ID's. I am guessing that PID's are tied to memory addresses which work differently in x64 Windows.
Moshe
@Sam: PatchGuard. http://en.wikipedia.org/wiki/Kernel_Patch_Protection
SLaks
`If you're really doing this with consent, this shouldn't be necessary.` Consent of who? Parents or their savvy kids?
Moshe
I see. Sam is correct. `C:\Windows\svchost.exe` is the best way to hide it.
SLaks
And, that will not mess with the authentic svchost?
Moshe
No; that's in `system32`.
SLaks
Stupid Stupid me. Shoulda' known. I suppose any system name is good enough, but svchost takes the cake.
Moshe
Yes; svchost is the only process that will legitimately have multiple copies running.
SLaks
Why am I not surprised?
SLaks
@SLaks - Lol. I don't give out that much info on the net, but let's just say that we're similar enough.I got more ideas. This is just the beginning. Thanks.
Moshe
Probably will. I go back to Yeshiva tomorrow and have not enough time to thoroughly test...
Moshe
What/where are you learning?
SLaks
Sent u a messg.
Moshe
@SLaks - Right. My spelling isn't good on 3hrs of sleep at 11:30pm the next night. :-) EDIT: I'm deleting that comment. It will not let me edit.
Moshe
+1  A: 
  1. Here's a sample of how to write a key logger in .net. http://www.scratchprojects.com/2008/09/csharp_keylogger_p01.php

  2. Your best bet for making it not show up in Task Manager is to make it look like something that belongs. Call it "svchost.exe". :-)

Sam
@Sam - Indeed. Silly old me... *I* am `svchost.exe`. No, *I*.
Moshe
I'm more of a VB kinda guy, but I'm going to read up on both.
Moshe