是否可以编写“访问剪贴板”监控程序？

Question

Is there any possibility on Windows to create a programm ( C# or even C++, or any other language) which can be able to trace which process are using the clipboard ?

I have a malware who modify my clipboard when i paste ethereum adresses. No tools are able to detect this malware...since i'm programmer i would like to code a tool to help me to find the malicious process.

Any idea if it's possible ?

Thanks a lot

Answer 1

There is no Win32 API for monitoring access to the clipboard, only for detecting when changes are made to the clipboard's content.

To do what you are asking for, you will have to write a DLL that directly hooks the Win32 OpenClipboard() function, such as with a detour , and then you can inject that DLL into all running processes, such as with SetWindowsHookEx() , AppInit_DLLs , etc. When your hook is called, it can communicate information about the calling process back to your main app as needed, such as the process ID .

Answer 2

You can find an existing and reputable tool that can do that for you: Sysmon v12.0 by SysInternals.

Although it doesn't mention it on the doc page, this states

Sysmon 12 adds clipboard capturing

I sifted through some help and references and confirmed that the following config works:

  <Sysmon schemaversion="4.40">
  <CaptureClipboard />
  <EventFiltering>
    <RuleGroup name="" groupRelation="or">
      <ClipboardChange onmatch="exclude">
      </ClipboardChange>
    </RuleGroup>
  </EventFiltering>
</Sysmon>

You can view those captured events in the Windows Event Viewer, in

Applications and Services Logs/Microsoft/Windows/Sysmon/Operational .

In response to my copying text from the command prompt, I can see this logged event:

Clipboard changed:
RuleName: -
UtcTime: 2020-10-12 22:08:45.505
ProcessGuid: {0509ed25-cd58-5f84-41a3-050000003500}
ProcessId: 20708
Image: C:\Windows\System32\cmd.exe
Session: 3
etc...

Answer 3

Another option, for DIY programmers :)

From your code, copy something to the Clipboard with delay rendering:

::SetClipboardData(CF_TEXT, NULL);

When someone (that malware?) would attempt to get that text, you will receive a WM_RENDERFORMAT message. If you place a breakpoint there and stop your execution, the calling program will be blocked on its GetClipboardData call or something like that.

I didn't figure out where to go from here. Enumerate all processes? Attach to each one with Debugger? Look at their call stack?