This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(265.6, 66%, 35%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAK%3C/text%3E%3C/svg%3E)
I was looking for a program that could list all those processes which are using low-level keyboard hooks. I was trying to find a way to detect any keyloggers in the user-space. Many queries online are saying that it is not possible to write a program to list the processes which are hooked. A blog suggested it is possible but I couldn't understand the whole. HELP!!
There is gSharedInfo from User32.dll in x64; I did a test, I could apparently loop on hooks (TYPE_HOOK = 5) from HANDLEENTRY, but could not read hook structure (with phead - CLIENTINFO.ulClientDelta) (I think it worked on XP/Vista...)
Some samples on GitHub use a driver to read this kernel memory, maybe it can work on Windows 10/11...
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(211.20000000000002, 92%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERL%3C/text%3E%3C/svg%3E)
Hope you've been well. Have you solved your issue now? Does Xiaopo's answer make sense?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(179.20000000000002, 34%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EXY%3C/text%3E%3C/svg%3E)
Hello @Ashish Kumar Swarnkar,
You may need WinDbg to get that information.
You can also refer to the question https://stackoverflow.com/questions/8564987/list-of-installed-windows-hooks which includes some examples.