<?xml version="1.0"?>
<rss version="2.0">
	<channel>
		<title>really hard questions</title>
		<link>http://www.allegro.cc/forums/view/278339</link>
		<description>Allegro.cc Forum Thread</description>
		<webMaster>matthew@allegro.cc (Matthew Leverton)</webMaster>
		<lastBuildDate>Mon, 30 Jun 2003 23:33:48 +0000</lastBuildDate>
	</channel>
	<item>
		<description><![CDATA[<div class="mockup v2"><p>is it possible to capture keypresses OUTSIDE of the program? and, is there a way to keep the program from appearing in the task manager AND the lower right corner of the desktop? you know, the little icon. and, also hide the window from the task bar. thanks!
</p></div>]]>
		</description>
		<author>no-reply@allegro.cc (AzNTriK)</author>
		<pubDate>Mon, 30 Jun 2003 03:07:10 +0000</pubDate>
	</item>
	<item>
		<description><![CDATA[<div class="mockup v2"><p>
Writing a keylogger, are we? Yes, it&#39;s possible to hook keyboard from outside your own process, and hide yourself from the taskbar/little thingies at the bottom right. To hide your process entirely, though, you would need an equivalent of a rootkit, which AFAIK only work on NT flavors.
</p></div>]]>
		</description>
		<author>no-reply@allegro.cc (X-G)</author>
		<pubDate>Mon, 30 Jun 2003 03:14:03 +0000</pubDate>
	</item>
	<item>
		<description><![CDATA[<div class="mockup v2"><p>yeah <img src="http://www.allegro.cc/forums/smileys/tongue.gif" alt=":P" /> howd you know?? well i know its POSSIBLE to catch keys.. but how? and how do i keep the window from showiing on the taskbar? some code would be nice. or an explanation. thank you
</p></div>]]>
		</description>
		<author>no-reply@allegro.cc (AzNTriK)</author>
		<pubDate>Mon, 30 Jun 2003 03:41:08 +0000</pubDate>
	</item>
	<item>
		<description><![CDATA[<div class="mockup v2"><p>why would he tell you how to make a key logger...</p><p>no good usually come from those, atleast not to the person who doesnt know it is on his cpu.
</p></div>]]>
		</description>
		<author>no-reply@allegro.cc (lynerd)</author>
		<pubDate>Mon, 30 Jun 2003 03:44:35 +0000</pubDate>
	</item>
	<item>
		<description><![CDATA[<div class="mockup v2"><p>
That might be his point. <img src="http://www.allegro.cc/forums/smileys/tongue.gif" alt=":P" /><br />This sounds like a typical keylogger trojan. Well, anyway ... I don&#39;t have any code, since I don&#39;t deal with it, but look at Packetstorm Security - you should be able to find some proof-of-concept code for it there. To avoid visibility in the taskbar, just don&#39;t create a window. You can&#39;t hide yourself from the process list without a rootkit or equivalent, AFAIK.
</p></div>]]>
		</description>
		<author>no-reply@allegro.cc (X-G)</author>
		<pubDate>Mon, 30 Jun 2003 03:53:50 +0000</pubDate>
	</item>
	<item>
		<description><![CDATA[<div class="mockup v2"><p>I didn&#39;t know you could hide from the process list at all <img src="http://www.allegro.cc/forums/smileys/tongue.gif" alt=":P" /></p><p>Anyway, if you learn how to grab keys/messages using Win32, it should be very simple. Check out msdn perhaps.</p><p>Just make a program with no window, as X-G says, and keep listening for messages in windows...
</p></div>]]>
		</description>
		<author>no-reply@allegro.cc (Derezo)</author>
		<pubDate>Mon, 30 Jun 2003 04:06:30 +0000</pubDate>
	</item>
	<item>
		<description><![CDATA[<div class="mockup v2"><p>
It is possible - rootkits such as <a href="http://www.megasecurity.org/Tools/Nt_rootkit_all.html">this famous one</a> can do it.
</p></div>]]>
		</description>
		<author>no-reply@allegro.cc (X-G)</author>
		<pubDate>Mon, 30 Jun 2003 04:13:32 +0000</pubDate>
	</item>
	<item>
		<description><![CDATA[<div class="mockup v2"><p>thanks guys. im not trying to do anything illegal here.. btw, im jus trying to figure out my cousin&#39;s password for this one game that we both play <img src="http://www.allegro.cc/forums/smileys/grin.gif" alt=";D" /> he&#39;s coming by later &gt;=)</p><p>oh yeah, i searched msdn and i couldnt find anything.. please help</p><p>i found <a href="http://www.planet-source-code.com/vb/scripts/ShowCode.asp?txtCodeId=764&amp;lngWId=7">this</a> bit of code in delphi which does the hiding windows from task/bar part but not catching keys.. anyone know how to do this in c??</p><p>1. whats a rootkit?<br />2. how do i check keyboard messages in win32 from OTHER programs?
</p></div>]]>
		</description>
		<author>no-reply@allegro.cc (AzNTriK)</author>
		<pubDate>Mon, 30 Jun 2003 04:28:27 +0000</pubDate>
	</item>
	<item>
		<description><![CDATA[<div class="mockup v2"><p>You can download freeware keyloggers IIRC.  Never tried one though...
</p></div>]]>
		</description>
		<author>no-reply@allegro.cc (Steve Terry)</author>
		<pubDate>Mon, 30 Jun 2003 05:13:12 +0000</pubDate>
	</item>
	<item>
		<description><![CDATA[<div class="mockup v2"><p>
</p><div class="quote_container"><div class="title">Quote:</div><div class="quote"><p>1. whats a rootkit?</p></div></div><p>

I pasted a link. Read it.
</p></div>]]>
		</description>
		<author>no-reply@allegro.cc (X-G)</author>
		<pubDate>Mon, 30 Jun 2003 05:17:00 +0000</pubDate>
	</item>
	<item>
		<description><![CDATA[<div class="mockup v2"><p>For hiding the window, what about creating it like this: [Only tested on Win 98... ]</p><div class="source-code"><div class="toolbar"></div><div class="inner"><table width="100%"><tbody><tr><td class="number">1</td><td>hwnd <span class="k3">=</span> CreateWindowEx<span class="k2">(</span></td></tr><tr><td class="number">2</td><td>           WS_EX_TOOLWINDOW,   </td></tr><tr><td class="number">3</td><td>           szClassName,         </td></tr><tr><td class="number">4</td><td>           <span class="s">"        "</span>,       </td></tr><tr><td class="number">5</td><td>           WS_OVERLAPPEDWINDOW, </td></tr><tr><td class="number">6</td><td>           <span class="k3">-</span><span class="n">10000</span>,       </td></tr><tr><td class="number">7</td><td>           <span class="k3">-</span><span class="n">10000</span>,       </td></tr><tr><td class="number">8</td><td>           <span class="n">5</span>  ,                 </td></tr><tr><td class="number">9</td><td>           <span class="n">5</span>  ,                 </td></tr><tr><td class="number">10</td><td>           HWND_DESKTOP,        </td></tr><tr><td class="number">11</td><td>           NULL,                </td></tr><tr><td class="number">12</td><td>           hThisInstance,       </td></tr><tr><td class="number">13</td><td>           NULL                 </td></tr><tr><td class="number">14</td><td>           <span class="k2">)</span><span class="k2">;</span></td></tr><tr><td class="number">15</td><td>           </td></tr><tr><td class="number">16</td><td>        ShowWindow<span class="k2">(</span>hwnd, SW_HIDE<span class="k2">)</span><span class="k2">;</span></td></tr></tbody></table></div></div><p>

You can get the state of the keyboard with GetAsyncKeyState (only Win 98, I think)</p><p>And... with GetForegroundWindow() you can get the active window (the one that the user is using)<br />And with GetWindowText, you can get the title of any window.</p><p>Notice that all this apis are documented somewhere in the SDKs of MS... or something...<br />There was some called APIGuide that has a good guide about this APIs, google for it.</p><p>That&#39;s more that enough to make a keylogger.
</p></div>]]>
		</description>
		<author>no-reply@allegro.cc (kronoman)</author>
		<pubDate>Mon, 30 Jun 2003 08:51:54 +0000</pubDate>
	</item>
	<item>
		<description><![CDATA[<div class="mockup v2"><p>i dont think you even have to create the window. just have the main msg loop and track the keys.
</p></div>]]>
		</description>
		<author>no-reply@allegro.cc (IronBob)</author>
		<pubDate>Mon, 30 Jun 2003 09:04:56 +0000</pubDate>
	</item>
	<item>
		<description><![CDATA[<div class="mockup v2"><p>GetASyncState doesnt work for other processes?</p><div class="quote_container"><div class="title">Quote:</div><div class="quote"><p>
Windows NT/2000/XP: The return value is zero for the following cases: </p><p>The current desktop is not the active desktop<br />The foreground thread belongs to another process and the desktop does not allow the hook or the journal record.
</p></div></div><p>

also, it seem a bit inefficient.. </p><p>SHORT GetAsyncKeyState(int vKey);</p><p>doesnt that mean that i have to individually check EVERY SINGLE key in order to check the whole keyboard? and i dont think i can use a loop because the letters are hexadecimal? i have no idea.
</p></div>]]>
		</description>
		<author>no-reply@allegro.cc (AzNTriK)</author>
		<pubDate>Mon, 30 Jun 2003 09:52:17 +0000</pubDate>
	</item>
	<item>
		<description><![CDATA[<div class="mockup v2"><p>no, i said nothing about GetAsyncKeyState(). i said in the MSG LOOP. for &quot;case WM_KEYDOWN:&quot; either the HIWORD or the LOWORD contains some value that tells you what the key is. check on MSDN in the Win32API reference section.
</p></div>]]>
		</description>
		<author>no-reply@allegro.cc (IronBob)</author>
		<pubDate>Mon, 30 Jun 2003 20:47:52 +0000</pubDate>
	</item>
	<item>
		<description><![CDATA[<div class="mockup v2"><p>but does that also work for processes other than the current one?
</p></div>]]>
		</description>
		<author>no-reply@allegro.cc (AzNTriK)</author>
		<pubDate>Mon, 30 Jun 2003 22:53:16 +0000</pubDate>
	</item>
	<item>
		<description><![CDATA[<div class="mockup v2"><p>im not sure. you need to do your own research too.
</p></div>]]>
		</description>
		<author>no-reply@allegro.cc (IronBob)</author>
		<pubDate>Mon, 30 Jun 2003 23:19:14 +0000</pubDate>
	</item>
	<item>
		<description><![CDATA[<div class="mockup v2"><p>no, WM_KEYDOWN doesn&#39;t.</p><p>I believe there&#39;s a function called SetWindowHook or the like, you need to trap the WM_CHAR message the game gets and write them out to a file or something.</p><p>Also, NT based kernels (2k+XP) might have protection against that, they might not... and if its only for a game, do you really need to worry about it being in the process list?</p><p>[edit]<br />Didn&#39;t RealPlayer do something like that where it kept running without being in the process list?
</p></div>]]>
		</description>
		<author>no-reply@allegro.cc (CGamesPlay)</author>
		<pubDate>Mon, 30 Jun 2003 23:33:48 +0000</pubDate>
	</item>
</rss>
