Differentiating between password and other kind of keyboard inputs in a keylogger

Question

I am writing a keylogger for windows. I am planning to get the pressed key with GetAsyncKeyState(KEY) and a hidden console. After a key press has been identified I will get the current focused windows with GetForegroundWindow and indentify which program was on top when the key was pressed. I also want to be able to Differentiate between key presses for passwords and other kind of inputs. Is there a way to do it? How?

I am not writing a malicious software. This is for an assignment in Advanced Programming course.

Display a window witch a check box. The user the has to check when he inputs a password. — , Jul 05 '17 at 15:19
I am writing a keylogger so the user will not even know his keyboard input has been logged — Amir Qasemi, Jul 05 '17 at 15:28
@AmirQasemi manni66's comment was clearly intended to be a joke. — François Andrieux, Jul 05 '17 at 15:43
You know it's a password because the focus is on a password input control. How you determine that is up to you, but judging by how often password managers get it wrong I'd say it's not easy. — Carey Gregory, Jul 05 '17 at 17:17

score 0 · Accepted Answer · answered Jul 05 '17 at 17:19

If the foreground app is using standard Win32 UI controls, then try this:

use GetForegroundWindow() to get the HWND of the foreground window.
then use GetWindowThreadProcessId() and GetGUIThreadInfo() to get the foreground window's currently focused child control.
then use GetClassName() to check if it is a standard EDIT control (this check might fail in some UI frameworks! You might have to use the UI Automation API to detect the control type)
then use GetWindowLong/Ptr() to check if it has the ES_PASSWORD style applied.

However, if the foreground app is not using standard Win32 UI controls, and/or is custom-drawing them, or the like, then all bets are off.

Differentiating between password and other kind of keyboard inputs in a keylogger

1 Answers1