Hacker News Reader

Comment by eliteraspberrie | Hacker News Reader

BTW, Windows is the only one mainstream OS I'm aware of, that actually attempts to implement some form of GUI-level isolation, starting from Windows Vista.

Is GetAsyncKeyState still available in Windows Vista? I'm guessing it is, and processes can still read each others' keystrokes without problem. The MSDN documentation doesn't mention it being deprecated. http://msdn.microsoft.com/en-us/library/windows/desktop/ms64...

(By the way this article is from 2011. It would be interesting to read an update.)

View on HN

Yes. Here's a Windows keystroke logger (with source code) that uses GetAsyncKeyState. I wrote this years ago to show an IT auditor that a restricted user could run a keystroke logger (he was adamant that was not possible). It works on Windows XP to Windows 8.

http://16s.us/software/16k/

GetAsyncKeyState will not reflect input that is sent to an elevated window. So, it does not break UIPI.

Oh man! I only wrote one program ever that could be used for malicious intent if so desired, and that was a GetAsyncKeyState()-based keylogger. Simple to write and so cool. The toughest part was figuring out how to register itself as a windows service and give it a good name so most people would ignore it. I ended up making a separate executable for that.

Anyway, I got curious to see how my coding style had evolved since I was a kid so I dug it up for all to see: https://gist.github.com/aktau/11057438 (I was young, be gentle).

The download of the exe file gives an error message, the cpp and txt files are fine though.

If they run on a different SessionID you won't be able to log anything. This means you want be able to log what other users type.

The article is becoming somewhat obsolete now with all the new windows/apple store apps though. (I m not talking about their store aspect)

Perhaps it needs admin permissions (UAC) though?

That would be the same as running it as root, so in that case it would make sense that you can listen to get every keypress. If not... then yep Windows Vista is as much a 'security circus' as anything else.

I'm guessing she's referring to the UAC dialog (I wonder if it also applies to apps run via UAC).

Reply on news.ycombinator.com