offensive-keylogger-arch

SKILL: Novel research

Metadata

• Skill Name: keylogger-architecture
• Folder: offensive-keylogger-arch
• Source: https://github.com/SnailSploit/offensive-checklist/blob/main/Low-level%20Keylogger%20architecture_.md

Description

Low-level keylogger architecture design: kernel driver hooks (WH_KEYBOARD_LL, SetWindowsHookEx), ETW-based input capture, user-mode vs kernel-mode approaches, stealth techniques, and data exfiltration. Use for understanding input capture mechanisms, EDR evasion research, or malware architecture analysis.

Trigger Phrases

Use this skill when the conversation involves any of: keylogger, keyboard hook, WH_KEYBOARD_LL, SetWindowsHookEx, ETW, kernel driver, input capture, low-level keylogger, malware architecture, stealth, exfiltration

Full Methodology

Case study of different keylogger implementations, how to implement them and their individual IOCs.

---

SetWindowHookEx

Majority of malware uses user32.dll!SetWindowHookEx to create a global hook event. this modifies an internal structure in win32k.sys. Internally, SetWindowsHookEx is just a user-mode wrapper around NtUserSetWindowsHookEx (which itself wraps around zzzzNtUserSetWindowsHookEx) in win32k.sys. What happens after you call it depends on the hook type you request but the sequence is always the same four steps:

1. Validate and allocate a hook record
   win32k.sys creates an internal HOOK structure, fills in the filter type, module handle, thread/desktop IDs, and inserts the structure at the head of the global hook chain for that type
2. Decide whether the hook procedure must live in the target process
   • Low-level hooks (WH_KEYBOARD_LL, WH_MOUSE_LL)
     – NO injection.
     – The system leaves the hook DLL in the original caller’s address space and simply delivers the event to that process via an internal WM_* message posted to its hidden “ghost” window .
   • All other global hooks (WH_KEYBOARD, WH_CBT, WH_GETMESSAGE, …)
     – YES injection required.
     – For every process that satisfies the filter (same desktop, matching bitness),
     • In/before Vista: win32k queues an asynchronous load request to csrss.exe, which in turn calls LoadLibraryEx inside the target process, mapping the hook DLL and fixing up its entry point.
     • After Vista: The target process is added to a pending-load list inside win32k; the first user-mode exit from kernel to that process takes the APC and calls LdrLoadDll directly. – The first time the target thread is about to return to user mode, the kernel APCs the loader, so the DLL’s DllMain runs in the context of the victim process.