Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Detecting Keyboard Hooks

Is there a way to detect which programs or modules are listening to a keyboard hook? By Sysinternals maybe?

like image 766
Kaveh Shahbazian Avatar asked Sep 23 '09 10:09

Kaveh Shahbazian


People also ask

What is a keyboard hook?

A hook is a mechanism by which an application can intercept events, such as messages, mouse actions, and keystrokes. A function that intercepts a particular type of event is known as a hook procedure.

What is SetWindowsHookEx?

SetWindowsHookEx can be used to inject a DLL into another process. A 32-bit DLL cannot be injected into a 64-bit process, and a 64-bit DLL cannot be injected into a 32-bit process.


2 Answers

This blog post has instructions: http://zairon.wordpress.com/2006/12/06/any-application-defined-hook-procedure-on-my-machine/

like image 71
atomice Avatar answered Sep 25 '22 14:09

atomice


It largely depends on what level of abstraction are you obtaining your key presses.
For maximum detection you could use hardware directly or go as low as possible (some hooks work at HW driver-level).

For security purposes, you could also use a virtual keyboard - hooks would have to be targeted specifically at your application to simulate key presses.

like image 28
Jaroslav Jandek Avatar answered Sep 25 '22 14:09

Jaroslav Jandek