问题
As a proof of concept, I wrote a quick keylogger in .NET. It was only 150 lines and it worked flawlessly.
It's frighteningly effective. With some relatively simple use of the WinAPI function GetAsyncKeyState, I was able to capture any and all keystrokes and save them to a data file.
My question is, is it possible for one program to detect when another program calls GetAsyncKeyState?
Furthermore, is it possible to detect when another program calls any winAPI function at all?
Thanks!
回答1:
Yes, Microsoft offers Detours library which lets you hook any API calls. The library is quite expensive though. With enough skill you can implement the same that MIcrosoft does yourself as well (and many protection solutions like antivirus and application firewalls do this).
来源：https://stackoverflow.com/questions/26064820/monitoring-or-disabling-winapi-functions