Learning Malware Analysis

1.3.1 Keylogger Using GetAsyncKeyState()

This technique involves querying the state of each key on the keyboard. To do that, keyloggers make use of the GetAsyncKeyState() API function to determine whether the key is pressed or not. From the return value of GetAsyncKeyState(), it can be determined whether the key is up or down at the time the function is called and whether the key was pressed after a previous call to GetAsyncKeyState(). The following is the function prototype of the GetAsyncKeyState() API:

SHORT GetAsyncKeyState(int vKey);

GetAsynKeyState() accepts a single integer argument vKey which specifies one of 256 possible virtual-key codes. To determine the state of a single key on the keyboard, the GetAsyncKeyState() API can be called ...