有没有办法检测按键记录软件？
我可能会编写一个程序来检测进行键盘记录的恶意（或非恶意）软件（记录击键以获取信息）。
- 会使用什么策略？
- 是否有特定的代码需要查找？
- 我应该搜索某些位置吗？
- 我更喜欢 Java 或 Perl，因为我精通这些语言
- 这些语言有用吗？
- 是否有更好的语言可以用于此案例？
- 会用到什么？
- 代码？
- 算法？
- 功能？ 代码
I might write a program to detect malicious (or non-malicious) software that is key logging (logging key strokes to gain information).
- What tactics would be used?
- Is there certain code to look for?
- Are there certain locations I should search?
- I prefer Java or Perl as I am fluent in those languages
- Would these languages work?
- Is there a better language to use for this case?
- What would be used?
- Code?
- Algorithms?
- Function?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我认为这取决于您想要做什么。如果您正在寻找已知的键盘记录程序，您可以使用任何可以搜索文件系统以查看文件签名的软件。但是，听起来您想检测未知程序。我认为这绝对不可能。键盘记录应用程序可以被动地侦听击键，因此您无法寻找主动签名。了解应该在您的计算机上运行的软件，然后检测开始运行的任何新软件可能会更容易。它不一定是击键记录软件，但它可能是未经授权的软件（或至少尚未获得授权的软件）。
按键操作将作为您可以在应用程序中订阅的事件广播到系统。这就是游戏和其他程序使用键盘输入的方式。整个系统知道何时按下某个键以及按下的是哪个键。你无法知道谁在听。
换句话说，如果这是可能的，它将杀死软件击键记录器，因为每个防病毒和反间谍软件应用程序都可以选择检测和删除所有这些类型的软件。他们有一个与此类似的选项，但它基于已知击键记录器的已知签名。
I think it depends on what you are attempting to do. If you are looking for known keylogging programs, you could use any software that can search the file system to view file signatures. However, it sounds like you want to detect unknown programs. I do not believe this is strictly possible. Keylogging applications can passively listen to the keystrokes so there is not an active signature you could look for. It would probably be easier to understand the software that is supposed to run on your computer and then detect any new software that starts to run. It wouldn't necessarily be keystroke logging software, but it would be unauthorized software (or at least yet to be authorized software).
Keystrokes are broadcast to the system as events that you can subscribe to in your application. This is how games and other programs use the keyboard input. The entire system knows when a key is hit and which key it was. You can't know who is listening.
To put it another way, if this were possible, it would kill software keystroke loggers since every anti-virus and anti-spyware application would have an option to detect and remove all of these types of software. They have an option similar to this, but it is based upon known signatures of known keystroke loggers.
作为一个试图确定其输入是否正在被键盘记录的程序，对于写得不好的键盘记录器，您可以寻找一些时间模式，例如记录器回收缓冲区时的周期性延迟，但通常键盘记录器非常好 -写入并将自身注入驱动程序链中，因此与正常链无法区分。
在这种情况下，检测键盘记录程序的唯一希望是检查驱动程序链以查找非标准驱动程序（但某些键盘记录程序可以感染标准驱动程序），这在 Windows 环境中并不是特别容易（如此低级别的检查） 。
人们需要插入反病毒/反恶意软件挂钩，以便不仅能够真正访问驱动程序链定义，而且能够真正访问正在执行的实际代码，以检测是否正在发生某些按键记录，这很难，充满官僚作风，除了 C/C++ 之外几乎无法撤销
As a program trying just to figure if it's input is being key-logged, for badly written key-loggers, you can look for some time-patterns, like periodic delays when the logger recycle buffers, but normally key-loggers are very well-written and will inject themselves in the driver chain and so will be indiscernible from the normal chain.
In that case the only hope to detect key-loggers is to inspect the driver chain looking for non-standard drivers (but some key-loggers can infect standard drivers) which isn't particularly easy in Windows-land (such low level inspection).
One would need to plug into the anti-virus/anti-malware hooks to be able to really access not only the driver chain definitions, but the real code being executed, to detect if some key-logging is takeing place, and that is hard, full of bureaucracy, and almost undoable in anything but C/C++