1

I'm writing a password manager for Windows which I want to protect against keyloggers. There is a timeout of 5000 ms for keyboard hooks.

The hook procedure should process a message in less time than the data entry specified in the LowLevelHooksTimeout value in the following registry key:

HKEY_CURRENT_USER\Control Panel\Desktop

The value is in milliseconds.

(The default value of that Registry key is 5000)

Assuming a password manager running as administrator, could I suspend all programs, simulate typing a key, wait for 5 seconds and then be sure that all keyboard hooks have been disabled by Windows?

I've not found a way of unregistering all hooks via UnhookWindowsHookEx because it requires a handle that I do not have. This is why I'm resorting to unregistering them by timeout.

Improve this question
2
  • 1
    I'm not sure what you're asking. Are you writing a program? If so, what's the purpose of the program? The link you provided doesn't specify anything about 5 second timeouts. Could you add some more details?
    – RoraΖ
    Commented Jan 9, 2015 at 13:42
  • @raz. Yes, I've updated the question. The link only says that there is a timeout, but the default value seems to be 5000.
    – Thomas Weller
    Commented Jan 9, 2015 at 17:16

2 Answers 2

Reset to default
5

There are three reasons I can see why this assumption is dicey.

  1. Hooks are only removed in Windows 7 and above. This is probably the least of your concern, but worth mentioning.
  2. The hook is silently removed, and your application has no way of knowing if these actions occurred and/or were successful.

So even if your assumption is correct there is no way for you to know that the hooks were removed. Which means you should assume that not all of them have been removed.

  1. This only applies to keyboard hooks that have been registered using SetWindowsHookEx

This is the more pressing issue. A lot of malware are not going to use the built-in hooking API. They'll write their own hooks which won't be registered with the OS. Or at an even lower level for key-loggers, they'll be hooking or installing their own system level driver. Which again, will not be registering with the operating system.

Suspending all programs is possible, but again you might not be able to suspend the services that the key-logger is installed as or into. While I think that it's noble of you to try and guard against key-loggers I don't believe it is your responsibility.

Improve this answer
-1

It won't work. Hooks aren't programs, they're DLLs that execute in the context of your program. Unless they're very poorly written, you can't easily affect how long they take to execute.

Improve this answer
4
  • 3
    Hooks aren't really DLLs. They're generally installed by DLLs, but are just procedures that intercept function calls.
    – RoraΖ
    Commented Jan 11, 2015 at 15:02
  • This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post.
    – Deer Hunter
    Commented Jan 11, 2015 at 19:45
  • @DeerHunter, I think "it won't work" is a valid answer to "will this work?". If you disagree, please explain why.
    – Mark
    Commented Jan 11, 2015 at 20:26
  • Should have some supporting references, methinks.
    – Deer Hunter
    Commented Jan 11, 2015 at 20:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .