keyboard buffer location?
keyboard buffer location?
I understand that it may be possible to get into a keyboard buffer to retrieve data that has been typed on my computer. How would i do this and where would i have to go to get the data?
- floodhound2
- ∑lectronic counselor
- Posts: 2117
- Joined: 03 Sep 2006, 16:00
- 17
- Location: 127.0.0.1
- Contact:
I am not 100% on this but I think that your keyboard buffer would dissolve, or become rewritten over in a matter of milliseconds. The computer uses IRQ's and that means that the keyboard is in "line if you will" once the keyboard is flagged as having something in its buffer it will be asked to release the information, after that the buffer is rewritten over.
Otherwise you will need to write some code to record the keystrokes and put it into a different buffer or known as memory.
One more thing. You can increase the buffer size in the register.
Hope this helps
Otherwise you will need to write some code to record the keystrokes and put it into a different buffer or known as memory.
One more thing. You can increase the buffer size in the register.
Code: Select all
System Key: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kbdclass\Parameters]
Value Name: KeyboardDataQueueSize
Data Type: REG_DWORD (DWORD Value)
₣£ΘΘĐĦΘŮŇĐ
- bad_brain
- Site Owner
- Posts: 11636
- Joined: 06 Apr 2005, 16:00
- 19
- Location: In your eye floaters.
- Contact:
hm, you could dump the content of the physical memory (RAM) and try to analyze it, but this is definitely pretty advanced stuff...
but if you want to get into it have a look here:
http://win32dd.msuiche.net/
http://www.forensicswiki.org/wiki/Tools:Memory_Imaging
but if you want to get into it have a look here:
http://win32dd.msuiche.net/
http://www.forensicswiki.org/wiki/Tools:Memory_Imaging