Anti-Keylogging Method Based on Windows

Abstract

The invention discloses a Windows-based anti-keylogging method, which includes: for the kernel state, before the Windows normal key interruption, an interruption is added, after receiving the user key information, the interruption is performed, and whether the key information has been checked The button information conversion is judged, and the button information is the original button information, the button information conversion is performed, and the converted information is resent to the IO port, and the converted button information is the converted button information, and the windows normal button interrupt is executed; for In the user state, reverse conversion is performed according to the key mapping relationship, and then the key information is directly submitted to the user process.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a method for preventing keyloggers based on Windows. Background technique [0002] Hook (hook) technology is mostly used in the existing Windows system keylogging technology, and the keylogging technology is divided into two categories from the position where the hook function is called to run, which are respectively user state Hook and kernel state Hook. Because in the Windows user mode, keyboard keys are transmitted in the form of Windows messages, so the user mode Hook mainly implements keylogging through the Windows message hook function. The kernel-mode Hook is more flexible than the user-mode Hook. It takes multiple layers of calls from the keyboard interrupt generated by the key until the kernel mode completes the IRP (IO request packet) and returns to the user mode. Keyloggers can be implemented in multiple places on this path. , mainly including the following ...

AI Technical Summary

Problems solved by technology

[0007] For user-mode keyloggers, you can also use the Windows message hook function to defend, mainly calling the WH_DEBUG type hook function, because the Windows operating system always executes the WH_DEBUG type hook function first, and this hook function can directly determine whether to continue Execute the hook function of the keyboard (keylogging in user mode exists in the form of a keyboard hook function), so the way to prevent keylogging in user mode is to directly submit the key information to the user process in the hook function of WH_DEBUG type, and block the keyboard hook The operation of the function, but if the keylogger in the kernel mode, this method cannot prevent the key information from being stolen