1

I have a keylogger on my Win8 box. Nothing sinister: it performs some useful extra work. Actually it is so useful that I want to trigger some of its functions when I am afk. Naturally AutoIt and such does not work (I've checked): the logger is hooked to a low-level keyboard hook (I guess), and real keyboard hooks are not triggered by virtual keyboard events (I believe).

Basically I need a virtual keyboard with real-look-alike keypresses.

(Edit: I've deleted my own "idea" how to solve this, it was bad anyway, and I have more understanding now)

Trying SendInput and why it does not work.

People suggested to try SendInput. In short: it does not work, because I've managed to raise integrity level of my pythonw.exe only to High, but the "keylogger" runs on System level, and, as said in SendInput doc

Applications are permitted to inject input only into applications that are at an equal or lesser integrity level.

I've found a very nice python SendInput implementation at Python simulate keydown, in comments.
To check "integrity level" of the process you can use ProcessExplorer, View / Select Columns, check "Integrity Level".
ProcessExplorer shows my pythonw.exe which I "Run as Admin" at the IL "High", but AcrossServer, AcrossService and a spawned conhost.exe all have the IL "System". (Yes, I am trying to inject keys into the very nice Bluetooth keyboard simulator Across).

Next possible steps.

  1. Raising the integrity level of my app to System:
    • make it a windows service;
    • make it a device(less) driver;
    • anything easier? or
  2. Lowing the integrity level of AcrossService to (at least) High:
    • is it possible? Edit: it is possible, Control Panel / Services, change logon account to myself. Unfortunately, Accross stops working when lowered.
  3. Create a Python equivalent of Across Server on Windows.

Number 3 seem the most socially useful and seems easier than creating a specialized device driver :) But am I missing some simpler possibilities?

Community
  • 1
  • 1
Placid
  • 11
  • 2
  • [SendInput](https://msdn.microsoft.com/en-us/library/windows/desktop/ms646310.aspx). – IInspectable Oct 01 '16 at 21:23
  • Thank you @IInspectable for pointing to SendInput doc. There was this significant info that I've overlooked previously: `Applications are permitted to inject input only into applications that are at an equal or lesser integrity level.` I've tried to use AutoHotKey script running "as Admin". No success so far, but that may be my error (tests are not very straightforward). I am going to play with Python interface to SendInput (see http://stackoverflow.com/questions/11906925/python-simulate-keydown in comments) and will post result. – Placid Oct 03 '16 at 00:40
  • Does not seem to work: 1. I am checking that my Python code is running as Admin; 2. I am sending "down" for RCONTROL and LCONTROL; 3. I check GetAsyncKeyState for both (down) - then I send "up" for both - still the "keylogger" ignores my virtual key presses while performing ok on physical ones. – Placid Oct 03 '16 at 07:16

0 Answers0