KeyGuru 1.0
You have reached the home page of KeyGuru , the Windows Keyboard Logger , it works on all win9x, win2k and winnt platforms.
Download Sites for KeyGuru
Intro
KeyGuru started of when I was wondering if there was a way to trap keys globally in Windows NT (It was always possible in Win9x). KeyGuru is inspired in many ways by "KeyTrap" the application featured in Phrack 46 (1994) (Phrack 46) by 'Dcypher' , this nifty little logger which was below 4kb in size (!!) was written in straight ASM... The key converter in KeyGuru largely borrows itself from KeyTrap...
The cost
KeyGuru is free. You may delete it, format it, destroy it, disassemble it and I wont care... If you like it you could send me 10 bucks for a beer ;-)
How does it work ?
KeyGuru consists of 3 files :
wklg.exe = main logging application
wklg32.dll = library used by loggin application
keyconvert.exe = decoder to decode key codes
wklg.exe , wklg32.dll are part of the main logging application...executing wklg.exe launches the keyboard logger.
It is an invisible application and does not have a visible window.
By default KeyGuru logs information in a file called wlkg32lg.dll in the Windows\System Directory.
keyconvert.exe is used to decode and generate a human readable output for the keys pressed.
To explain how the application works consider the following
scenario :
PC1 = your pc
PC2 = pc on which you want to log keystrokes
- Copy wklg.exe & wklg32.dll to PC2 into any folder.
- Execute wklg.exe on PC2, by double clicking on it.
- wklg.exe will start executing silently (until the PC2 is shutdown of course)
Type some keys on the keyboard on PC2 (You can press Z a 1000 times for all i care ....!)
If you check in the windows \ system directory of PC2 there will be a file created called wklg32lg.dll, this is not really a dll file but the log file created by KeyGuru.
Copy this file onto your PC (PC1).
Now run keyconvert.exe, when it launches browse and select the
wklg32lg.dll file. and now press convert. In a few seconds (or minutes..
if your log file is huge..) you will get a message from keyconvert
indicating that it has finished.
keyconvert.exe will create a file called output.txt in the same folder as
the log file which contains the decoded output.
Some of the output seems jumbled ?
I hope you remembered to convert it...otherwise...
Well if the person typed ABCD backspace DE , KeyGuru records it as :
ABCD<BKSP>DE
so the actual output of the typing would have been ABDE. Some keys (mostly on extended keyboards) which KeyGuru does not recognise is recorded as <UNK> unknown key. (those familiar with KeyTrap should see
the similarities...)
Is there anyway i can change the settings ?
Since KeyGuru does not have a visible interface it is controlled thru the command line :
wklg.exe has 2 command line options:
/l - specify a different dll name
/o - specify a diffrent output file
for example if you renamed wklg32.dll to my.dll you would launch keyguru as :
wklg /l wklg32.dll
or if you wanted a different output file name :
wklg /o myoutput.txt
or both options together :
wklg /l wklg32.dll /o myoutput.txt
..do not specify a path for the output as KeyGuru isnt that smart now, it automatically creates the output file in the PC's windows\system directory