Monitoring both sides of chats

The window might consist of totally custom controls, the net channel might be encrypted on application layer. When hijacking input you want to capture input events and their target. For a simpler solution I would go with hooking into the message loop of the main/gui thread of the application, maybe into all threads of the application. This is a per-process approach. You can then capture any keyboard/mouse messages inside the process, gui focus changes and so on. Even if the program has only a main window with exclusively custom controls you can still get all input messages and reconstruct the text messages. For a more serious solution I would do this hooking on system level, this ways you could capture outgoing input globally and for each input event you should find out the target process/thread/gui control. This way you can log the whole interaction between the user and the machine.

"the net channel might be encrypted on application layer." :face-palm:
Of course! How did I manage to overlook that simple counter-measure.

As is the norm from you pasztorpisti, a comprehensive post, full of valuable insights. :thumbs-up:

Thank you! The WinPcap solution is also a nice one if there is no encryption. Lot of chat programs are silly enough not to use good encryption. :-) My solution doesn't cover the capturing of the other party, WinPcap can handle that too (however that also requires net protocol reverse engineering that is often not too difficult).

Anyway, WinPcap is not only a nice solution, its probably the easiest and first way to consider if there is no strong encryption! :thumbsup: