Skip to content

Trolling Keyloggers by Forcing them to log Specific Text then freezing them

Notifications You must be signed in to change notification settings

ZeroMemoryEx/KlTroll

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

11 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

How I Trolled keyloggers

image

Introduction

  • Keyloggers is an archaic method used by malware authors its basically record everything you type on a keyboard.

Deep analysis

  • the API we are hacking is GetAsyncKeyState , its one of the most common APIs that used by Keyloggers ,it Determines whether a key is up or down at the time the function is called ,it takes int in arguments, and returns SHORT

  • as you can see GetAsyncKeyState is just a wrapper around ntUserGetAsyncKeyState

    image

  • ntUserGetAsyncKeyState

    image

  • if you perform a GetAsyncKeyState the execution will be like this :

    Untitled

    Notes

    • The real code of ntUserGetAsyncKeyState function runs in Kernel Mode.
    • When a user-mode application calls the Nt or Zw version of a native system services routine, the routine always treats the parameters that it receives as values that come from a user-mode source that is not trusted .

Patching GetAsyncKeyState :

  • first thing we do is locate GetAsyncKeyState in memory then we overwrite the first 12 bytes and make it jump to our fake function .

    image

  • if the specified key is down/pressed GetAsyncKeyState returns 0x8001 or -32767 in decimal to abuse it ,we create an array of characters of our choice and return -32767 in every character so the keylogger log it sequentially ,then we returns 0 everytime GetAsyncKeyState get called so the keylogger get blocked from logging .

    unsigned char	msg[] = {
    'T','R','O','L','L','E','D'
    };

    image

  • our function in memory:

    image

Result

20558.mp4

we-do-a-little-trolling

Lastly

  • im planning to make a highly effective program that detect all ( high/low ) level and both direct/indirect syscalls keyloggers and shut them down .

About

Trolling Keyloggers by Forcing them to log Specific Text then freezing them

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published