Benign windows Download

BasicKeylogger.c

Code mentions stealth/stealthyAttach kernel (IoAttachDeviceToDeviceStackSafe)

SHA-256d7f6bb3e10e4e91cba81a6b7bef5c1541f424eb6633ec8b30c41cddaf49e68ba

Evidence

PDEVICE_OBJECT usage lines 13–16

13// Pointer to the array of keylogger device objects
14PDEVICE_OBJECT KeyloggerDevices[MAX_KEYLOGGERS] = { NULL };
15#define PRINT_GLOBAL_ARR KdPrint(("Status of KeyloggerDevices:\n"));	\
16for (int i = 0; i < MAX_KEYLOGGERS; ++i) {								\

Code mentions stealth/stealthy lines 91–94

// Attempt to get a reference to this keyboard class
// NOTE: This is an incredibly non-stealthy way to do this
// See https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-iogetdeviceobjectpointer
// Anything but FILE_READ_ATTRIBUTES causes an access violation for some reason

Create kernel device object lines 116–120

// At this point we know the target device exists. Now we must make a keylogger device and attach it
// Create a device
status = IoCreateDevice(
	pDriverObject, // The driver the device will be associated with
	sizeof(BASIC_KEYLOGGER_EXTENSION), // The size of device extension we want

Attach kernel device stack (IoAttachDevice) lines 141–144

// Attach to the keyboard class driver
status = IoAttachDeviceToDeviceStackSafe( // https://stackoverflow.com/questions/48208105/kmdf-lower-filter-driver Proposes this instead of IoAttachDevice
	pCurrentKeylogDevice,	// The device to attach
	pTargetDeviceObj,		// The target device to attach to

PIRP usage lines 520–523

520NTSTATUS Basic_ReadCallback(
521	_In_ PDEVICE_OBJECT pDeviceObject, // This is OUR device object?
522	_In_ PIRP pIrp
523) {