July 2010 - Posts

While playing around with a python keylogger I had a problem finding out a way to detect keyboard input locale. After spending whole afternoon trying to make it work, I finally succeeded (IMHO :) ). If you have better/shorter/more pythonic way to do it, I will be more than happy to hear about it.

Anyway, start the script, open other apps (browser, notepad, whatever...) and switch between input locales. Have fun ;)

 

 detect input locale

<Python>

from ctypes import *
from _winreg import *
import sys,  time
user32 = windll.user32

layout_map={}

def FindLocaleName():
    hklm = ConnectRegistry(None,  HKEY_LOCAL_MACHINE)
    path = "SYSTEM\CurrentControlSet\Control\Keyboard Layouts"
    key = OpenKey(hklm, path)
    layouts = []
    for i in range(1024):
        try:
            layouts.append(EnumKey(key, i))
        except:
            pass
    CloseKey(key)
    for subkey in layouts:
        path = "SYSTEM\CurrentControlSet\Control\Keyboard Layouts\\"+subkey
        key = OpenKey(hklm, path)
        txt = QueryValueEx(key, "Layout Text")
        layout_map[subkey]=txt[0]
        CloseKey(key)                       

def MapLayout(kbd):
    base = str(kbd[5:])
    pad = '0000'
    layout = pad+base
    if layout in layout_map:
        layout_name = layout_map[layout]
        return layout_name
    else:
        print "Can not find layout %d", layout
def Keyboard():
    w = ""
    l = ""
    while 1:
        time.sleep(1)
        tid = user32.GetWindowThreadProcessId(w, 0)
        if (w == user32.GetForegroundWindow()) and  (l==hex(user32.GetKeyboardLayout(tid))):
            pass
        else:
            w =  user32.GetForegroundWindow()
            tid = user32.GetWindowThreadProcessId(w, 0)
            kbd = hex(user32.GetKeyboardLayout(tid))
            l=kbd
            buf_size = user32.GetWindowTextLengthA(w)
            buf=c_buffer(' ' * buf_size)
            window_text = user32.GetWindowTextA(w,buf,256)
            window_name = "".join(buf)
            print ' window name:\t', window_name
            print 'window handle:\t', w
            print 'locale:\t\t', kbd
            layout_name=MapLayout(kbd)
            print 'locale name:\t', layout_name
            sys.stdout.flush()
def SelfPraise():
    print " "
    print "            _"
    print " _ __   ___| |_ ___  ___  ___ "
    print "| '_ \ / _ \ __/ __|/ _ \/ __|"
    print "| | | |  __/ |_\__ \  __/ (__ "
    print "|_| |_|\___|\__|___/\___|\___|"
    print "     http://www.netsec.rs"
    print "   dejan.levaja@netsec.rs "
if __name__ == '__main__':
    SelfPraise()
    FindLocaleName()
    Keyboard()

</Python>

Pozdrav svima,

Novi krug obuke za CompTia Security+ u oktobru. Stay tuned!