|
how do the "spyware" programs work that record user behavior outside of their own application? are there standard c# or windows ways to track the mouse, record keystrokes, record which applications are run, or do these programs need to hook low level drivers and such?
anybody know?
Thanks in advance!
|
|
|
|
|
Looking for some help on writing some spyware, huh? I hope to the heavens no one is dumb enough to answer this one! 
You might as well ask us to do your homework, too. That goes over real well here, too!
-----BEGIN GEEK CODE BLOCK-----
Version: 3.21
GCS/G/MU d- s: a- C++++ UL@ P++(+++) L+(--) E--- W+++ N++ o+ K? w++++ O- M(+) V? PS-- PE Y++ PGP++ t++@ 5 X+++ R+@ tv+ b(-)>b++ DI++++ D+ G e++>+++ h---* r+++ y+++
-----END GEEK CODE BLOCK-----
|
|
|
|
|
newbie1 wrote:
anybody know?
Yes, but to be honest it is best to start with something much simpler than this if you are a newbie. I highly doubt you will get anyone here to post anything explaining how to implement spyware. There are many great articles here on CodeProject that can get you started in C#. Why not register for an account and start reading them, then you can also download the source code too.
- Nick Parker
My Blog
Last time I checked, all programmers have selective ignorance. I know nothing about 3D graphics. I know a lot about COM. VB gets under people's skin because one can be ignorant of computer architecture and ASM and still get a lot done. - Don Box
|
|
|
|
|
Nick, thank you. i have in fact looked at some of the great many articles and i agree CodeProject is a wonderful place, i've also purchased from people that advertise on CodeProject.
As for how spyware is implemented, I think the question of how things like this are implemented is a perfectly reasonable question, and of general interest to the community. if the answer is that it can't be done by documented api's or in a "legitimate" way, that would be an interesting discussion.
apparently i asked a taboo question, but why? if you don't agree that it's a question of general interest to this forum, please say so, but please! if you think you're keeping the world safe from spyware by not discussing it on CodeProject-- number one i am NOT implementing spyware, number two the people who are implementing it certainly seem to be doing it just fine without help from this forum.
my $.02. and no offense to you or to Heath-- i know you guys take a lot of time and put a lot of thought into these posts, and you are certainly well respected and appreciated (*even if* in this particular instance i think you're off the mark).
Thanks!
|
|
|
|
|
newbie1 wrote:
As for how spyware is implemented, I think the question of how things like this are implemented is a perfectly reasonable question, and of general interest to the community.
I would agree to some level. Here is my take on it. In order for you to fully understand how to implement "spyware" you will need to learn many of the basics to the C# language and how it operates with the Windows environment. This is simply a must. There are even articles here on CP that discuss how some of these "spyware" concepts work, however without an understanding of the basic components of the language you will constantly find yourself trying to figure out how it all fits together. You won't find anyone on here that will directly tell you how to implement it, however, by reading some of the articles you will be in a better position. These comments were only meant to be constructive, not to push you away.
This simply reminds me of the saying: "Give a man a fish, feed him for a day. Teach a man to fish, feed him his entire life". I hope you don't walk away from this negatively. 
- Nick Parker
My Blog
Last time I checked, all programmers have selective ignorance. I know nothing about 3D graphics. I know a lot about COM. VB gets under people's skin because one can be ignorant of computer architecture and ASM and still get a lot done. - Don Box
|
|
|
|
|
newbie1 wrote:
but why? if you don't agree that it's a question of general interest to this forum
I don't think that many people using CodeProject are writing SpyWare. According to a recent survey only 7.23% (survey is still open so that may change) of people on CodeProject answered Not Applicable to the question "What is your job role (or roles)?" indicating that 92.77% have an IT related job. 78.77% answered Developer to the same question. I doubt many (if any) will be writing spyware applications. So, I'd say the demographics for spyware discussions is wrong. However the demographics for professional peer-to-peer discussions is right.
Most people here are probably aware of the fundamentals of a spyware application but that's as far as they want to take it. They may also know a number of techniques for finding information about other applications or system configuration in the course of their normal job.
From a personal point of view. The questions I ask in the programming forums on Code Project are all things that I am working on. Things that I have become a bit stuck on during the course of my every-day work. I don't tend to ask questions on things that I won't be working on. I take the view, rightly or wrongly, that the majority of other people on Code Project do the same. So when I see a question that is obviously spyware or where I don't see a legitimate reason for asking the question I'll ignore it.
--Colin Mackay--
"In the confrontation between the stream and the rock, the stream always wins - not through strength but perseverance." (H. Jackson Brown)
Enumerators in .NET: See how to customise foreach loops with C#
|
|
|
|
|
Nick, Heath, Colin, thanks.
Ok, let me try this one more time.
Nick, I'm not sure how it was i induced you to believe that i know absolutely nothing about c# programming, as far as i know i simply admitted ignorance in the area of how to capture keystrokes when my application doesnt have focus, and what is required to get notifications that another app gets focus, etc. Don Box might say that being ignorant of this particular aspect of programming does not necessarily confer ignorance of the basics of c#!!
Colin, i certainly agree that the vast majority of CodeProject readers are not engaged in fulltime spyware development (and contrary to Heath's suggestion, it's not my goal either). on the other hand, billions of people around the world think they should have some clue what george bush says and does, even though they don't work for him. am i the only developer in this forum who has thought it might be interesting to capture information outside their app? does no one else wonder how spyware might do it? yes, perhaps it isn't exactly what one is planning on working on, but i think people do try to have at least some general sense of what is possible and how things are done, that's how people get insights and view problems in new ways.
ok, enough with the philosophy. although i chose the example of spyware because i thought would be a good metaphor, i'm actually interested in the understanding how independently written applications can interact. here are 3 examples that i think are interesting:
-- keystroke macros. i've always assumed you need to be a keyboard driver to implement global macros, is there any other way?
-- gestures. my glidepad hardware came with a nice little gesture recognizer, can the same thing be done hardware independent, say by globally capturing the mouse and pushing manufactured events into the app's event queue?
-- office assistant. do you need to be microsoft to write "mr paperclip", or can a third party without access to the office source code still build an app that watches what a user is doing and makes suggestions.
Thanks in advance for any insights!
|
|
|
|
|
I could be wrong, but I think a lot of the negativity you initially received was mainly due to the fact you didn't register. I think a lot of these guys get tired of unregistered people coming in here and asking them to do their homework and stuff like that. If people can't take the time to register, is it worth answering their question? Will they take the time to come back and read it, etc.? I'm not saying you're lazy or anything, I'm just saying these guys probably get burned out answering questions for people they perceive as asking something off the cuff. It's probable they did a google search and posted this same question in 20 places. I'm probably not describing this adequately, but it's not a slam or anything to you.
That said, I don't think there's too many topics that are "off limits". Spyware is probably a topic that's deserves discussion no matter your intentions. I'd personally love to be able to program a virus just to know the concepts. Would I ever unleash a virus? No. But having that knowledge would most likely prove quite educational.
In any event, you should take a look at "hooks". Learn about keyboard and mouse hooks. They basically allow you to get access to the input devices at more of an "OS level" as opposed to just capturing the device for your application. They also have "legitimate" uses like the "gesture recognizer" you mention. This is probably a good place to start. I'm not sure C# is the best language to do all of this stuff. C/C++ would probably be better suited for doing hooks.
I, for one, do not think the problem was that the band was down. I think that the problem may have been that there was a Stonehenge monument on the stage that was in danger of being crushed by a dwarf.
-David St. Hubbins
|
|
|
|
|
yay! a straight answer.. thank you, Kentamanos!! (Nick, was THAT what you meant about teaching a man to fish-- were you steering me to hooks?).
[as to the philosophy, i think Kentamanos got it perfectly.. whether i'm the scum of the earth posting to "all" 20 newsgroups, whether i will ever read the reply or not, imho this is a question of general interest-- i would bet there is >= 1 other person on this forum who could use hooks or would at least benefit by knowing they're there! here's a link those people may be interested in: http://msdn.microsoft.com/msdnmag/issues/02/10/CuttingEdge/default.aspx.]
If anyone has any more insights, please let us all know-- otherwise i'm happy to believe that the long and short of it is: HOOKS!
Thanks, and Happy Holidays all!
________________________________________
Gosh, it would be awful pleas'n, to reason out the reason, for things I can't explain.
Then perhaps I'll deserve ya, and be even worthy of ya..
if I only had a brain!
|
|
|
|
|
newbie1 wrote:
Nick, was THAT what you meant about teaching a man to fish-- were you steering me to hooks?
Yes, but it wasn't just that. You will find many articles that discuss hooks in great detail. For example Joseph M. Newcomer[^] has a great article entitled Hooks and DLLs[^] (which uses C++). While you don't appear to have signed up for an account yet (as of these posts); I tend to think questions get answered more often to registered members. I hope you find this information useful, sign up for an account (if you already haven't) and continue to post your questions on these forums.  Just don't forget to read the documentation. 
- Nick Parker
My Blog
Last time I checked, all programmers have selective ignorance. I know nothing about 3D graphics. I know a lot about COM. VB gets under people's skin because one can be ignorant of computer architecture and ASM and still get a lot done. - Don Box
|
|
|
|
|
Fine, after reading the discussions, if you really want to know, look up information about SetWindowsHook (or SetWindowsHookEx). That can record mouse movements (which is what comprises gestures), keyboard strokes, and much more. For Internet Explorer related tracking, you would write a Browser Helper Object (BHO), which you can find more information by typing "Browser Helper Object" into the MSDN Library and find some information in the IObjectWithSite documentation, which you must implement on a BHO.
-----BEGIN GEEK CODE BLOCK-----
Version: 3.21
GCS/G/MU d- s: a- C++++ UL@ P++(+++) L+(--) E--- W+++ N++ o+ K? w++++ O- M(+) V? PS-- PE Y++ PGP++ t++@ 5 X+++ R+@ tv+ b(-)>b++ DI++++ D+ G e++>+++ h---* r+++ y+++
-----END GEEK CODE BLOCK-----
|
|
|
|
|
Heath, thanks!
just out of curiosity, was it me not being registered, or your reluctance to aid and abet spyware, or something about my writing style, or none of the above that inspired your first post on this thread? 
|
|
|
|
|
I won't knowing aide and abet spyware or malware and the fact that you weren't registered just added to the suspision.
-----BEGIN GEEK CODE BLOCK-----
Version: 3.21
GCS/G/MU d- s: a- C++++ UL@ P++(+++) L+(--) E--- W+++ N++ o+ K? w++++ O- M(+) V? PS-- PE Y++ PGP++ t++@ 5 X+++ R+@ tv+ b(-)>b++ DI++++ D+ G e++>+++ h---* r+++ y+++
-----END GEEK CODE BLOCK-----
|
|
|
|
|
Heath, all, thanks. i guess i did leave an easily searchable keyword in.. live and learn. 
anyway i'll go register now!
Happy New Year!
|
|
|
|
|
I've been working on a asp.net webserver for a while now and its almost finished. The code is going to be released under the gpl. I was wondering if anyone here wanted to lend a hand helping to optimize and debug it. Its fairly complete so far get, post, head, and put are working. CGI 1.1 is almost complete. The one thing that it really lacks is good documentation (Right now its got none)
Thanks,
James Gill
|
|
|
|
|
The dotGNU people is currently looking still looking doing an ASP.NET implementation. Come chat on IRC irc://irc.freenode.org/dotgnu , I'm sure quite a few people will be interested on hearing some details!
Cheers
leppie::AllocCPArticle("Zee blog");
Seen on my Campus BBS: Linux is free...coz no-one wants to pay for it.
|
|
|
|
|
I have just spent about 3 months writing a program for PocketPC and a PC version in C# just to find out that within seconds it can be decompiled into readable source code. Does that not bother anyone else but me? I know it's my fault for not checking out the language more before starting but I need a way to protect my code. Any ideas. I am a single programmer selling software and I can't afford the expensive obfuscation tools. Any help would be appreciated. If I can't get a work around I will have to rewrite the application in c++. Thanks.
|
|
|
|
|
Hi. You can use an obfuscator tool on your assemblies. Do a web search for ".net obfuscator" and you'll find a bunch.
<oops>
I just read your message more carefully. I don't know of a freeware obfuscation tool... keep searching though - there may be one out there.
</oops>
|
|
|
|
|
Obfuscator tools wont really help you out much in this area. It might dissuade people who aren’t very driven to see how your code works, but for every obfuscator out there, there is a de-obfuscator that will unscramble the code. Besides, from my understanding, an obfuscator just scrambles the local variable names, to make it harder to follow the code. But the basic code; if, else, for, switch statements, as well as Function calls will still be very clear to read. I’ve looked at obfucatored code before using Anikrino and was still able to follow the algorithm used.
john C
|
|
|
|
|
This is the problem with knowing a language/syntax and knowing a technology. All language compilers targeting the CLR compile to IL (so the source language really doesn't matter, sans some specific compiler optimizations), which is in many ways like assembler. The IL is JIT'd to native code and executed. Of course it can be disassembled.
But any good programs should fear very little. Copyright your work and make a good product that users want to buy, not buy because they don't really have any better choices. There are many programs out there written in .NET. Heck, Java is no different.
If you're using cryptography anywhere, it's always been said and written by leading cryptoanalysts that the best cryptographic libraries are open. Your algorithms should be so good that you don't need to depend on data-hiding.
Finally, if pieces of your application are really so important and you can't deal with the fact that some schmoe wants to copy pieces of it, make a native library and P/Invoke the functions (or, if using COM, create an RCW for your native COM object). This way, the majority of your application is still managed (which mainly gets that name from its memory management capabilities) and is faster to write and maintain.
Just something to think about.
-----BEGIN GEEK CODE BLOCK-----
Version: 3.21
GCS/G/MU d- s: a- C++++ UL@ P++(+++) L+(--) E--- W+++ N++ o+ K? w++++ O- M(+) V? PS-- PE Y++ PGP++ t++@ 5 X+++ R+@ tv+ b(-)>b++ DI++++ D+ G e++>+++ h---* r+++ y+++
-----END GEEK CODE BLOCK-----
|
|
|
|
|
Just something to add.
VS.Net 2003 comes with a free obsfucator.
"if you vote me down, I shall become more powerful than you can possibly imagine" - Michael P. Butler.
Support Bone
It's a weird Life
|
|
|
|
|
I'd like to compare a user specified file mask with a given file.
I can write my own function, but many of the .NET methods use this ability and I was wondering if it was hiding someplace ?
So my question is simple, does anyone know of a .Net method that will allow me to compare a file and file spec (file mask) ?
i.e. compare all the files in System32 to *.d??
|
|
|
|
|
See the DirectoryInfo.GetFiles method:
DirectoryInfo di = new DirectoryInfo(
Environment.GetFolderPath(Environment.SpecialFolder.System));
FileInfo[] fis = di.GetFiles("*.d");
if (fis != null)
foreach (FileInfo fi in fis)
Console.WriteLine(fi.FullName);
-----BEGIN GEEK CODE BLOCK-----
Version: 3.21
GCS/G/MU d- s: a- C++++ UL@ P++(+++) L+(--) E--- W+++ N++ o+ K? w++++ O- M(+) V? PS-- PE Y++ PGP++ t++@ 5 X+++ R+@ tv+ b(-)>b++ DI++++ D+ G e++>+++ h---* r+++ y+++
-----END GEEK CODE BLOCK-----
|
|
|
|
|
This is the way I'm doing it now.
I'm actually getting the filename off a socket. So I create a dir and write a zero-length file using the file name then use the Directory.GetFiles() method. I just didn't know if there was a method that I could specify the file name and mask and get a boolean result, or something along those lines, so I don't have to write to disk. Thanks for your help as usual Heath.
-Mike
|
|
|
|
|
Well, you could generate a regex out of the mask.
Add "^" to the beginning.
Add "$" to the end.
Replace "*" with ".*".
Replace "?" with ".".
And that should do it.
Although you'll need to escape some characters like "(", "+", "." and "[" and a lot more.
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
