键盘记录器

利用HOOK技术来做一个键盘记录器，看看一天下来，我们点击了多少次键盘，哪些键的使用频率最高。
实现功能：

使用C#实现一个键盘记录器

开发环境：

开发工具：Visual Studio 2013

.NET Framework版本：4.5

```java

public class HookUtil
   {
       #region windows api

/// <summary>
       /// 安装钩子
       /// </summary>
       [DllImport("user32.dll", CharSet = CharSet.Auto, CallingConvention = CallingConvention.StdCall)]
        public static extern int SetWindowsHookEx(int idHook, HookProc lpfn, IntPtr hInstance, int threadId);
       public delegate int HookProc(int nCode, Int32 wParam, IntPtr lParam);

/// <summary>
       /// 继续下一个钩子
       /// </summary>
       [DllImport("user32.dll", CharSet = CharSet.Auto, CallingConvention = CallingConvention.StdCall)]
       public static extern int CallNextHookEx(int idHook, int nCode, Int32 wParam, IntPtr lParam);

/// <summary>
       /// 卸载钩子
        /// </summary>
        [DllImport("user32.dll", CharSet = CharSet.Auto, CallingConvention = CallingConvention.StdCall)]
        public static extern bool UnhookWindowsHookEx(int idHook);

/// <summary>
        ///获取当前线程编号（线程钩子需要用到）
        [DllImport("kernel32.dll")]
        static extern int GetCurrentThreadId();

/// <summary>
        /// 获取当前实例的函数
       /// </summary>
        [DllImport("kernel32.dll")]
        public static extern IntPtr GetModuleHandle(string name);

/// <summary>
        /// 获取按键的状态
        /// </summary>
        /// <param name="pbKeyState"></param>
        /// <returns></returns>
        [DllImport("user32")]
        public static extern int GetKeyboardState(byte[] pbKeyState);

/// <summary>
        /// 将指定的虚拟键码和键盘状态翻译为相应的字符或字符串
       /// </summary>
        [DllImport("user32")]
        public static extern int ToAscii(int uVirtKey, int uScanCode,   byte[] lpbKeyState,byte[] lpwTransKey,int fuState); 
       #endregion

/// <summary>
        /// 键盘结构
        /// </summary>
        [StructLayout(LayoutKind.Sequential)]
        public class KeyboardHookStruct
        {
            public int vkCode;  //定一个虚拟键码。该代码必须有一个价值的范围1至254
            public int scanCode; // 指定的硬件扫描码的关键
            public int flags;  // 键标志
            public int time; // 指定的时间戳记的这个讯息
            public int dwExtraInfo; // 指定额外信息相关的信息
        }

//定义为键盘钩子
        public int WH_KEYBOARD_LL = 13;

//相关键盘事件
        public event KeyEventHandler KeyDownEvent;
        public event KeyPressEventHandler KeyPressEvent;
        public event KeyEventHandler KeyUpEvent;

//相关动作
        private const int WM_KEYDOWN = 0x100;//KEYDOWN
        private const int WM_KEYUP = 0x101;//KEYUP
        private const int WM_SYSKEYDOWN = 0x104;//SYSKEYDOWN
        private const int WM_SYSKEYUP = 0x105;//SYSKEYUP

//hookid
       private int hookID = 0;

//向下传递数据
       public Keys NoNextKeyCode;

/// <summary>
       /// 安装钩子
       /// </summary>
        public void StartHook()
        {
            if (hookID == 0)
            {
                HookProc hookProc = new HookProc(KeyboardHookProc);
                hookID = SetWindowsHookEx(WH_KEYBOARD_LL, hookProc, GetModuleHandle(System.Diagnostics.Process.GetCurrentProcess().MainModule.ModuleName), 0);

if (hookID == 0)
                {
                    StopHook();
                    throw new Exception("安装键盘钩子失败");
                }
            }
        }

public void StopHook()
        {
            bool isStop = true;
            if (hookID != 0)
            {
                isStop = UnhookWindowsHookEx(hookID);
                hookID = 0;
            }
            if (!isStop) throw new Exception("卸载键盘钩子失败！");
        }

/// <summary>
       /// 监听事件
       /// </summary>
        private int KeyboardHookProc(int nCode, Int32 wParam, IntPtr lParam)
        {
            if ((nCode >= 0) && (KeyDownEvent != null || KeyUpEvent != null || KeyPressEvent != null))
            {

KeyboardHookStruct MyKeyboardHookStruct = (KeyboardHookStruct)Marshal.PtrToStructure(lParam, typeof(KeyboardHookStruct));
            
                //按下处理
                if (KeyDownEvent != null && (wParam == WM_KEYDOWN || wParam == WM_SYSKEYDOWN))
                {
                    Keys keyData = (Keys)MyKeyboardHookStruct.vkCode;
                    KeyEventArgs e = new KeyEventArgs(keyData);
                     KeyDownEvent(this, e);
                    //阻止向下传递
                    if (NoNextKeyCode == keyData)
                    {
                        return hookID;
                    }
                }

//按下并抬起处理
                if (KeyPressEvent != null && wParam == WM_KEYDOWN)
                {
                    byte[] keyState = new byte[256];
                    GetKeyboardState(keyState);

byte[] inBuffer = new byte[2];
                    if (ToAscii(MyKeyboardHookStruct.vkCode, MyKeyboardHookStruct.scanCode, keyState, inBuffer, MyKeyboardHookStruct.flags) == 1)
                    {
                        KeyPressEventArgs e = new KeyPressEventArgs((char)inBuffer[0]);
                        KeyPressEvent(this, e);
                    }
                }

// 抬起处理
                if (KeyUpEvent != null && (wParam == WM_KEYUP || wParam == WM_SYSKEYUP))
                {
                    Keys keyData = (Keys)MyKeyboardHookStruct.vkCode;
                    KeyEventArgs e = new KeyEventArgs(keyData);
                    KeyUpEvent(this, e);
                }

}
            return CallNextHookEx(hookID, nCode, wParam, lParam);
        }

~HookUtil()
        {
            StopHook();
        }
   }
```

```java
HookUtil keyHook = new HookUtil();
        private void btnBegin_Click(object sender, EventArgs e)
        {
            keyHook.KeyDownEvent += new KeyEventHandler(hook_KeyDown);//钩住按下事件
            keyHook.StartHook();
            btnBegin.Enabled = false;
            btnEnd.Enabled = true;
        }

private void btnEnd_Click(object sender, EventArgs e)
        {
            keyHook.StopHook();
            btnBegin.Enabled = true;
            btnEnd.Enabled = false;
        }

private void btnInfo_Click(object sender, EventArgs e)
        {
            string path = System.AppDomain.CurrentDomain.BaseDirectory + "log\\" + DateTime.Now.ToString("yyyy-MM-dd") + ".txt";
            if (!File.Exists(path))
            {
                MessageBox.Show("还未监听到数据，请操作后再查看");
                return;
            }
            var list = File.ReadAllLines(path).ToList().GroupBy(s => s).Select(s => new { s.Key, s.ToList().Count }).OrderByDescending(s => s.Count);
            FrmInfo frm = new FrmInfo();
            frm.Show();
            foreach (var item in list)
            {
                frm.addItems(new string[] { "", item.Key, item.Count + "" });
            }

}
  private void hook_KeyDown(object sender, KeyEventArgs e)
        {
            if (!listKey.Contains(e.KeyData))
            {
                if (Control.ModifierKeys != Keys.None)
                {
                    WriteLog(Control.ModifierKeys + "+" + e.KeyData);
                }
                else
                {
                    WriteLog(e.KeyData + "");
                }
            }
            else
            {
                WriteLog(e.KeyData + "");
            }

}
```

![](/media/202409/2024-09-23_145540_3664270.0754894889139005.gif)