Hooking Keyboard messages from Internet Explorer

Environment: VC6, Windows 2000

The following code demonstrates an example on hooks. A friend of mine asked me to write a program that logs keyboard messages from a given application. Here is how it works:

After executing the program it installs the hook functions to monitor keyboard messages from IE then writes the chars to a file. The program has no window, so it can be stopped only through Task Manager (or by CTR-ALT-DEL in Win95/98). It is simple to modify the code to monitor all/another running application's keyboard messages. A hook function must be a CALLBACK function and must be placed in a dll. So you have to create a dll and an exe that calls it.

The dll

If you want to create a Win32 dll (there is MFC dll but its size is big) run Visual C++ and from the FILE MENU click NEW - make sure the projects tab is selected - fill out the edit-boxes then click on "Win32 Dynamic-Link Library", click OK, then choose "An Empty Dll project". Now you have to add two files (.h, .c). To do this choose FILE/NEW - make sure the files tab is selected - click on "C/C++ Header file" fill out the edit-boxes and click OK. Now repeat the process but choose "C++ Source File" and you are ready for writing the code. From the workspace window choose FileView and by clicking on the "+" signs move in the tree until the .h file is not visible (it's in "Header Files"). Double click on it, so it will be active. Now you can write your code and do this for the .c file, and include the header file in the .c file than Build the dll. The __declspec(dllexport) means that the associated functions are exported (they can be called from an exe though are in the dll). Now take a look at the .c file in the dllsource code. There are three important functions:

  • SetKbHook
  • CBTProc
  • KeyboardProc

In SetKbHook you install the hooks (KeyboardProc and CBTProc are the hook functions) through the SetWindowsHookEx function (VC++ help). The KeyboardProc hook function monitors keyboard messages and writes them to a file. The wParam parameter contains the virtual-key codes. The CBTProc function monitors active windows, and from it's handle it gets the "class name" of the window through the GetClassName function (VC++ help).

The exe

Now you will create a Win32 Application. Select FILE MENU/CLOSE WORKSPACE and close all windows. FILE MENU/NEW then click on "Win32 Application" (make sure Projects tab is selected), fill out the edit-boxes then click OK. Choose An empty project then click OK. Copy the dll's .h file to this project's folder, then PROJECT MENU/Add to Project/Files add the copied .h file to the exe project (it will appear in the workspace window under "Header Files"). FILE MENU/NEW add a "C++ Source File" to the project. Include the dll's .h file, so the exe will now know about the dll's exported functions. Use LoadLibrary to load the dll, and call SetKbHook function through GetProcAddress (VC++ help). This is explicit linking.

If you want to link the dll implicit you don't have to use LoadLibrary you can directly call the SetKbHook function. You can achive this if you copy and add the .lib file of the dll to the exe project (The compiler builds the .lib file during Build). It's important that you set BUILD MENU/SET ACTIVE CONFIGURATION to Release both in the exe and dll project. The program will not monitor a window if it became active before it's been executed.

You can easily add a window to the program if you define the window-handler CALLBACK function and fill the WNDCLASS and CREATEWINDOW structures and call RegisterClassEx, ShowWindow and UpdateWindow functions in the exe project's .c code.

Downloads

Download exe and dll source - 20 Kb


Comments

  • hook run globally even on desktop

    Posted by Legacy on 02/19/2004 12:00am

    Originally posted by: Rashmi

    your code only run for application window,but not sopport globly like on desktop,window explorer etc.Pl. help me for it.

    Reply
  • It does not work on XP's IE

    Posted by Legacy on 07/11/2003 12:00am

    Originally posted by: Nguyen Van Binh

    I have run this program. It is Ok when I type English but It does not work when I type Japenese in editbox, anyone can solve this problem please tell me. Thanks.

    Reply
  • Capture usernamean

    Posted by Legacy on 10/12/2002 12:00am

    Originally posted by: Bhupinder Singh

    Hi i have installed a keyboard hook and it works fine on Windows programs but it doesnot capture

    keystrokes on MS Command Prompt for Windows 98 . I am able to capture keystrokes on Windows 2000

    command prompt though. Could you please tell me what needs to be done to capture keystrokes in

    Dos prompt.

    My second problem is that i am able to install a password hook that captures the paswword fields

    in a text box. Now is there any way in which i can actually get the usernames along with the

    passwords .


    Installer function:

    g_passwordHook.hHook = SetWindowsHookEx(WH_SYSMSGFILTER, (HOOKPROC) PasswordCallbackFunc,

    g_hInstance, 0);



    Callback Handler Function

    if (nCode == MSGF_DIALOGBOX)
    {
    MSG * pMsg = (MSG *)lParam;

    if (pMsg->message == WM_CHAR && GetWindowLong(pMsg->hwnd, GWL_STYLE) &

    ES_PASSWORD)
    {
    DWORD dState;

    if (GetShiftState(pMsg->lParam, &dState))
    PostMessage(g_passwordHook.hWndParent, g_passwordHook.dMsgID,

    (WPARAM)pMsg->wParam, (LPARAM)dState);
    }
    }

    Reply
  • debug error

    Posted by Legacy on 10/05/2002 12:00am

    Originally posted by: aart

    D:\keylogger\dll\ktr.cpp(198) : error C2664: 'GetClassNameA' : cannot convert parameter 1 from 'void *' to 'struct HWND__ *'
    Conversion from 'void*' to pointer to non-'void' requires an explicit cast
    Error executing cl.exe.

    what's the problem? I copied everything so nothing can be wrong...?

    Reply
  • Hooking keyboard messages from internet explorer

    Posted by Legacy on 07/10/2002 12:00am

    Originally posted by: irfan

    i have been trying to install a keyboard hook in mi application but was limited only to a local one...
    
    hope this code helps a lot.

    Thanks anyway!!!!!!!!!

    Reply
  • GetKeyNameText

    Posted by Legacy on 08/09/2001 12:00am

    Originally posted by: Catalin Varsendan

    what about GetKeyNameText function? I think it is an easier way to find out what key was pressed..

    Reply
  • Try it!

    Posted by Legacy on 08/08/2001 12:00am

    Originally posted by: Robert Nagy

    Of course it's working. I tested it, and everything was OK.

    Reply
  • One

    Posted by Legacy on 08/07/2001 12:00am

    Originally posted by: sanjeev

    Hi,
    
    I would be interested in knowing how can I make a
    application which works like record and play.
    [ The examples of that are - silk , winrunner are tools that are used for automation.
    Kindly know how it can be done using VC++
    Regards
    Sanjeev

    Reply
  • if used as macromaker or redo undo, is there a way to execute keys read from file

    Posted by Legacy on 08/04/2001 12:00am

    Originally posted by: gatman

    is there a way to read those key strokes from file, and execute them in the application again, ???

    BEGINNER

    Reply
  • Hmmm....

    Posted by Legacy on 08/03/2001 12:00am

    Originally posted by: GogglesPisano

    A keystroke logger for IE -- now WHAT might that be for? ;)

    Reply
Leave a Comment
  • Your email address will not be published. All fields are required.

Top White Papers and Webcasts

  • This ESG study by Mark Peters evaluated a common industry-standard disk VTl deduplication system (with 15:1 reduction ratio) versus a tape library with LTO-5, drives with full nightly backups, over a five-year period.  The scenarios included replicated systems and offsite tape vaults.  In all circumstances, the TCO for VTL with deduplication ranged from about 2 to 4 times more expensive than the LTO-5 tape library TCO. The paper shares recent ESG research and lots more. 

  • Live Event Date: September 10, 2014 @ 11:00 a.m. ET / 8:00 a.m. PT Modern mobile applications connect systems-of-engagement (mobile apps) with systems-of-record (traditional IT) to deliver new and innovative business value. But the lifecycle for development of mobile apps is also new and different. Emerging trends in mobile development call for faster delivery of incremental features, coupled with feedback from the users of the app "in the wild". This loop of continuous delivery and continuous feedback is …

Most Popular Programming Stories

More for Developers

Latest Developer Headlines

RSS Feeds