Keylogger obfuscation - would this work? (anti-keylogging discussion)

Started by
14 comments, last by Anon Mike 17 years, 6 months ago
Lots of results here: google:Winnowing+and+Chaffing
"I thought what I'd do was, I'd pretend I was one of those deaf-mutes." - the Laughing Man
Advertisement
That's odd - I'm not catching anything in either hook or async mode when sending WM_KEYDOWN messages. Here's the code for sending the notifications:

DWORD keyval = (rand() % 256);
SendMessage(mainwindow, WM_KEYDOWN, keyval, (LPARAM)(1 | (1 << 30) | (keyval << 16)));

Keylogging works nicely - all real input is captured as expected.

Sending the messages to the desktop or any other window fail as well. Is this to be expected?
Quote:Original post by irreversible
EDIT: few people type faster than 1-2 charaters/second on average (this assumes you think about what you're typing).


I think you've got that wrong. All of the people I know can type atleast 10wps even when thinking about typing (and no, none of them are programmers and not all of them use the computer once a day.) I don't even know monkey-typers that type at less than 3wps.
You should really talk in characters, not words per second. There's a world of difference between "I", "cat" and "inconsequential". I would say it takes the same time for me to type "I am a cat" as it takes me to write "inconsequential". BUT - writing certain words for the first time (such as "inconsequential") will claim an additional second or two to mentally map out the actual character squence on the keyboard (I'm pretty sure this holds true for most people). Plus, it is quite common that after each sentence, no matter how short or long (or also at more illogical/random breaks), most people tend to stop for up to several seconds to compose the next sentence beforehand and review the last sentence for completeness. Moreover - no one can type 10 wps (as you put it) for more than a couple of minutes in a row. It just doesn't happen. And hence my statement is more than valid if you consider it as a whole, also including the two key words, which are on average.

Incidentally, can anyone comment on my last post, because I really can't figure out why my keypress messages aren't being caught by the keylogger.
Using SendInput() or (for simplicity's sake) keybd_event() works. However, in such a case it is impossible to filter out the keystroke before it does any real damage (it's forwarded to the window that currently has focus).

Furthermore, GetAsyncKeyState() is not fooled that way. It may be possible to use SetKeyboardState() to fool GetAsyncKeyState(), although my first crack at that doesn't seem to be working either.

In other words, this method seems to be quite useless...

EDIT:

in the meantime, doing something like this:

::PostMessage(HWND_BROADCAST, WM_KEYDOWN, keyval, (LPARAM)(1 | (1 << 30) | (keyval << 16)));
::PostMessage(HWND_BROADCAST, WM_KEYUP, keyval, (LPARAM)(1 | (1 << 30) | (keyval << 16)));

will not be registered by my hook or GetAsyncKeyState() keyloggers, but will be captured quite successfully by WinAMP Agent (which is sort of odd).
The message injection techniques seem like really good ways to destroy certain classes of user assistance applications and perhaps IME's as well. There may also be issues with keyboards other than whatever kind the author has, e.g. your code may work fine on a US system with a standard keyboard but fall over and die with a dvorak keyboard or a Russian keyboard.

I don't know all the issues involved myself other than that kind of thing is *always* lots harder than it seems at first glance.
-Mike

This topic is closed to new replies.

Advertisement