Client monitoring - Keylogging problem

Please support our C# advertiser: Intel Parallel Studio Home
Thread Solved

Join Date: Oct 2008
Posts: 52
Reputation: Bhoot is an unknown quantity at this point 
Solved Threads: 1
Bhoot's Avatar
Bhoot Bhoot is offline Offline
Junior Poster in Training

Client monitoring - Keylogging problem

 
0
  #1
May 11th, 2009
First of all, the keylogger that i am developing is not at all for offensive and destructive purposes.

I am developing a client monitoring application in C#.NET.
Keylogging is one of the features in my application.
Though i have developed the code for the keylogger, i have not been able to implement it properly in my application.

There are two projects in my solution.
The UserInterface - for server side.
The Tracker - for client side PCs.
The keylogging module Keylogger is in the Tracker project.

I have used the helper classes for socket programming - TcpClient, TcpListener and NetworkStream to help them out.

Also, i am using asynchronous mode for communication.

Though i have attached the whole code with this post, i am posting the part of code with which i am facing the problem :

  1. //This code resides on the server-side monitoring interface.When //the administrator hits a btnKeyLog button, a message //"StartKeyLog" is sent to the respective client, and the keylogging //is handled on the client.
  2. private void btnKeyLog_Click ( object sender, EventArgs e )
  3. {
  4. messageBuffer = new byte[100];
  5.  
  6. if ( btnKeyLog1.Text == "Start Keylogging" )
  7. {
  8. btnKeyLog1.Text = "Stop Keylogging";
  9. message = "StartKeyLog";
  10.  
  11. messageBuffer = Encoding.ASCII.GetBytes ( message );
  12. try
  13. {
  14. //begin writing on the stream.
  15. clientConnections[0].networkStream.BeginWrite (messageBuffer, 0, messageBuffer.Length, new AsyncCallback ( onDataWrite ), null );
  16. }
  17. catch ( Exception exc )
  18. {
  19. MessageBox.Show ( exc.Message + exc.StackTrace );
  20. }
  21. }
  22. else
  23. {
  24. btnKeyLog1.Text = "Start Keylogging";
  25. message = "StopKeyLog";
  26.  
  27. messageBuffer = Encoding.ASCII.GetBytes ( message );
  28. try
  29. {
  30. clientConnections[0].networkStream.BeginWrite ( messageBuffer, 0, messageBuffer.Length, new AsyncCallback ( onDataWrite ), null );
  31. }
  32. catch ( Exception exc )
  33. {
  34. MessageBox.Show ( exc.Message + exc.StackTrace );
  35. }
  36. }
  37. }


Now, the client-side code :
  1. //the following method is the callback method (called by //TcpListener.BeginAcceptTcpClient() )that accepts the connection //and starts reading using BeginRead() :
  2. public void onConnectionRequested ( IAsyncResult ar )
  3. {
  4. try
  5. {
  6. clientConnection.client = listener.EndAcceptTcpClient ( ar );
  7. //MessageBox.Show ( "UI connected!" );
  8.  
  9. messageBuffer = new byte[100];
  10. clientConnection.networkStream = clientConnection.client.GetStream ( );
  11. clientConnection.networkStream.BeginRead ( messageBuffer, 0, messageBuffer.Length, new AsyncCallback ( onDataReceived ), null );
  12. }
  13. catch ( Exception exc )
  14. {
  15. MessageBox.Show ( exc.Message + exc.StackTrace );
  16. }
  17. }
  18.  
  19.  
  20. // the following is the callback function that will process the data //received from the server.
  21. // temporarily, i am using a switch case structure.
  22. public void onDataReceived ( IAsyncResult ar )
  23. {
  24. int nBytesRead = 0;
  25. try
  26. {
  27. nBytesRead = clientConnection.networkStream.EndRead ( ar );
  28. }
  29. catch ( Exception exc )
  30. {
  31. MessageBox.Show ( exc.Message + exc.StackTrace );
  32. }
  33. message = Encoding.ASCII.GetString ( messageBuffer,0, nBytesRead);
  34.  
  35. switch (message)
  36. {
  37. case "StartKeyLog" :
  38. MessageBox.Show ( "Keylogger started." );
  39. //the following static method wraps the Win32 //implementation of SetWindowsHookEx - all given in Keylogger //module
  40. KeyboardHook.installHook ( );
  41. //after this method is called, the hook is //actually installed; the callback function KeyboardHookProc is also //called. Here, keylogger seems to be working fine, except that the //system slows down considerably when i type keystrokes.
  42. break;
  43.  
  44. case "StopKeyLog":
  45. MessageBox.Show ( "Keylogger stopped." );
  46. // the following method releases the hook
  47. KeyboardHook.releaseHook ( );
  48. break;
  49. }
  50.  
  51. try
  52. {
  53. messageBuffer = new byte[100];
  54. clientConnection.networkStream.BeginRead ( messageBuffer, 0, messageBuffer.Length, new AsyncCallback ( onDataReceived ), null );
  55. }
  56. catch ( Exception exc )
  57. {
  58. MessageBox.Show ( exc.Message + exc.StackTrace );
  59. }
  60. //MessageBox.Show ( "Stop" );
  61. //as soon as this function ends, however, the callback function of //the keyboard hook stops being called; keystrokes are not //processed.
  62. //the keystrokes are caught until this function the control is in this //function. i assume that it has to do something with the thread.
  63. }

I am trying to explain the situation here.
To start keylogging, the server UI would send a message "StartKeyLog" to the client.
On receiving the message, the client will process it in the callback function "onDataReceived".In this function, the message is processed and the installHook() method is called, which would install the hook.

When i ran the application, the hook got installed; also, the KeyboardHookProc() callback got called properly, and the keystrokes were processed. But this was the case only till the onDataReceived callback method was alive. As soon as the that method ended, the KeyboardHookProc() stopped getting called; keys were no longer processed, as if the hook was never installed.

Another problem was that after the hook got installed, the system got considerably slow when i hit any key.

My assumption is that both the things have something to do with the threading that happens here. But, i am not able to get the exact problem.
I have tried my best to explain the situation.Still, any questions are welcome.
Could anyone provide me with the solution??
Attached Files
File Type: txt ClientSideTrackerForm.txt (4.1 KB, 1 views)
File Type: txt ClientSideKeylogger.txt (2.6 KB, 1 views)
File Type: txt ServerSideMainInterface.txt (3.1 KB, 2 views)
Bhoot
Reply With Quote Quick reply to this message  
Join Date: Feb 2009
Posts: 3,215
Reputation: sknake has much to be proud of sknake has much to be proud of sknake has much to be proud of sknake has much to be proud of sknake has much to be proud of sknake has much to be proud of sknake has much to be proud of sknake has much to be proud of sknake has much to be proud of sknake has much to be proud of 
Solved Threads: 572
Sponsor
sknake's Avatar
sknake sknake is offline Offline
.NET Enthusiast

Re: Client monitoring - Keylogging problem

 
0
  #2
May 11th, 2009
KeyboardHookProc() stopped getting called:
I cant be sure of this without you posting a sample application, but from the sound of it you are either closing the connection OR the connection variables is going out of scope and becomes breakfast for the garbage collector.

Another problem was that after the hook got installed, the system got considerably slow when i hit any key.
Most likely it would. From the looks of it you are hooking on the win32 keypress and sending that packet over ethernet to the listener. Imagine if every time you went to type a key your system pinged google.com to make sure you were on the internet. You should buffer the keypresses in a local cache and send them every second or two, or when the buffer gets so big. Do not do *anything* other than buffering the key in the delegate that gets the keypress information from windows.


messageBuffer = new byte[100];
I'm not sure why you have a size declared on your message buffer. The MTU of 99% of ethernet cards is 1492-1500 (minus ~160 bytes for the header) for so if you're trying to limit the connection to a single packet, get the frame size from PMTU discovery/MSS.

For more on MTU see:
http://en.wikipedia.org/wiki/Maximum_transmission_unit

I found an example of client-server communications with numeric commands/enums at:
See http://www.codeproject.com/KB/IP/Cha...CPSockets.aspx

I made a few "educated guesses" in my answer about the inner working of the application but it is hard to read that much code without being able to compile it easily. Let me know if I missed my mark on the functionality.

Good luck
Scott Knake
Custom Software Development
Apex Software, Inc.
Reply With Quote Quick reply to this message  
Join Date: Oct 2008
Posts: 52
Reputation: Bhoot is an unknown quantity at this point 
Solved Threads: 1
Bhoot's Avatar
Bhoot Bhoot is offline Offline
Junior Poster in Training

Re: Client monitoring - Keylogging problem

 
0
  #3
May 14th, 2009
Originally Posted by sknake View Post
I cant be sure of this without you posting a sample application, but from the sound of it you are either closing the connection OR the connection variables is going out of scope and becomes breakfast for the garbage collector.



Most likely it would. From the looks of it you are hooking on the win32 keypress and sending that packet over ethernet to the listener. Imagine if every time you went to type a key your system pinged google.com to make sure you were on the internet. You should buffer the keypresses in a local cache and send them every second or two, or when the buffer gets so big. Do not do *anything* other than buffering the key in the delegate that gets the keypress information from windows.




I'm not sure why you have a size declared on your message buffer. The MTU of 99% of ethernet cards is 1492-1500 (minus ~160 bytes for the header) for so if you're trying to limit the connection to a single packet, get the frame size from PMTU discovery/MSS.

For more on MTU see:
http://en.wikipedia.org/wiki/Maximum_transmission_unit

I found an example of client-server communications with numeric commands/enums at:
See http://www.codeproject.com/KB/IP/Cha...CPSockets.aspx

I made a few "educated guesses" in my answer about the inner working of the application but it is hard to read that much code without being able to compile it easily. Let me know if I missed my mark on the functionality.

Good luck

sorry for a late reply. I was out for last 2 days.
anyways, you mentioned about some variable going out-of-scope. I have checked it out, but couldnt find one. Also, connection is not getting closed either.

Another thing you said is the processing part. No, i am doing almost exactly what you recommended, i.e., all the processing part has always been on the client-side. I have planned (though havent yet implemented) to send the data every minute or so, and not at every keystroke. For the time being, i have been writing the keystrokes to a file.

And you mentioned about MTU. Thanks, i didnt know about that. I would change to what you suggested.

Right now, i dont have a compilable and executable copy of my code at hand. I will post it tomorrow for your reference. Maybe, you could point out my mistake.
Bhoot
Reply With Quote Quick reply to this message  
Join Date: Oct 2008
Posts: 52
Reputation: Bhoot is an unknown quantity at this point 
Solved Threads: 1
Bhoot's Avatar
Bhoot Bhoot is offline Offline
Junior Poster in Training

Re: Client monitoring - Keylogging problem

 
0
  #4
May 15th, 2009
ok..i am attaching the compilable and executable code of the keylogger.
The interface is too much primary, so dont get bothered by it
"Connect 1" button would connect to your own PC (the loopback IP).
So you may try it out.
Please guide me in this problem
Attached Files
File Type: zip NetworkTracker.zip (108.9 KB, 2 views)
Bhoot
Reply With Quote Quick reply to this message  
Join Date: Oct 2008
Posts: 52
Reputation: Bhoot is an unknown quantity at this point 
Solved Threads: 1
Bhoot's Avatar
Bhoot Bhoot is offline Offline
Junior Poster in Training

Re: Client monitoring - Keylogging problem

 
0
  #5
May 17th, 2009
Could anyone help me out??
I am stuck at this point since last 5 days and now i am pulling my hairs off.
Bhoot
Reply With Quote Quick reply to this message  
Join Date: Oct 2008
Posts: 52
Reputation: Bhoot is an unknown quantity at this point 
Solved Threads: 1
Bhoot's Avatar
Bhoot Bhoot is offline Offline
Junior Poster in Training

Re: Client monitoring - Keylogging problem

 
0
  #6
May 17th, 2009
ya..to simplify my problem i would like to add the following :

The keylogger basically works perfectly (no slowdowns and every keystroke is logged) if i install the hook in the main thread (for eg., in the constructor of the form).
However, it doesnt work at all - hook gets installed, but callback is not called even once; also it slows down for 3-4 seconds; no keystroke is logged - if i install the hook in some subordinate thread (for eg., in NetworkStream.BeginRead() or a created thread specially for keylogger).
Also, i had a messagebox in the above two subordinate thread i mentioned above. The messagebox was just after the "installHook" method (for debugging purpose). Now, if i dont hit the messagebox, then the keystrokes were logged (no slowdown too).
As soon as i hit the messagebox, it all goes the wrong way - a slowdown for 2-3 seconds, and then nothing is logged.

I have explained in as simple manner as i could. I am desperate for some guidance.
Bhoot
Reply With Quote Quick reply to this message  
Reply

This thread has been marked solved.
Perhaps start a new thread instead?
Message:


Thread Tools Search this Thread



About Us | Contact Us | Advertise | DaniWeb | Acceptable Use Policy | RSS Feed

©2003 - 2009 DaniWeb® LLC