[_CASP3R_]

Hello, I recently started developing viruses. today i added a simple keylogger to my program. Then i got 1 detection by the 1 and only Avira. Now after ages of figuring out what it was. Its this 1 line of code -

"public static extern int GetAsyncKeyState(Int32 i);"

Then i figured out its just the GetAsyncKeyState. Is there a way a rename the call method? I have tried multiple ways but nothing. Any help is appreciated! Thank you. 🤝

Best regards CASPER

[gigajew]

Change the name of it. Then in the DllImport attribute type EntryPoint = ”GetAsyncKeyState”

Or pm me source and I'll modify it for you

[StarZ]

Change:

Code

[DllImport("User32.dll")]

To:

Code

[DllImport("User32.dll", EntryPoint = "GetAsyncKeyState")]

for gigajew's suggestion. Then rename the function to something like:

Code

public static extern int randomFunctionLikeSetCursor(Int32 i)

[_CASP3R_]

Change the name of it. Then in the DllImport attribute type EntryPoint = ”GetAsyncKeyState”

Or pm me source and I'll modify it for you

Still get the detection sadly i even tried [DllImport("User32.dll", EntryPoint = "GetAsync" + "Key"+"State")]

[HFDone]

[DllImport("User32.dll", EntryPoint = "GetAsyncKeyState")]
public static extern int GetKey(Int32 i);

[_CASP3R_]

[DllImport("User32.dll", EntryPoint = "GetAsyncKeyState")]
public static extern int GetKey(Int32 i);

Already tried man.. the AV looks for a match with the keyword GetAsyncKeyState

[Paskowsky]

This is not going to work... You have to dynamically import and call api

Take a look at LoadLibrary and GetProcAddress api calls.

Code

IntPtr ptr = GetProcAddress(LoadLibrary("user.dll"),"GetAsyncKeyState");

Then you need a delegate with the function signature of GetAsyncKeyState

Code

public delegate int GAK(int i);

Now you join the two binding the ptr to the delegate

Code

GAK gak = (GAK)Marshal.GetDelegateForFunctionPointer(ptr,typeof(GAK));

Then you call your delegate as it was your function.