getAsyncKeyState not recognizing key input

Question

So I decided that I wanted to write a little keylogger tonight, just to learn about getAsyncKeyState. I'm trying to get my log to write to a file but the file's contents either show up blank or throw a random memory address at me (0x28fef0 before). I've heard that getAsyncKeyState doesn't function well with Windows 7 x64, is it true?

This is pretty aggravating, I was hoping to actually be able to get this running tonight.

    while(1)
    {
        Sleep(20);
        for(DWORD_PTR key = 8; key <= 190; key++)
        {
            if (GetAsyncKeyState(key) == HC_ACTION)
                checkKey(key);
        }
    }

Function definition

void checkKey(DWORD_PTR key)
{
    ofstream out;
    out.open("log.txt");

        if (key==8)
            out << "[del]";
        if (key==13)
            out << "n";
        if (key==32)
            out << " ";
        if (key==VK_CAPITAL)
            out << "[CAPS]";
        if (key==VK_TAB)
            out << "[TAB]";
        if (key==VK_SHIFT)
            out << "[SHIFT]";
        if (key==VK_CONTROL)
            out << "[CTRL]";
        if (key==VK_PAUSE)
            out << "[PAUSE]";
        if (key==VK_ESCAPE)
            out << "[ESC]";
        if (key==VK_END)
            out << "[END]";
        if (key==VK_HOME)
            out << "[HOME]";
        if (key==VK_LEFT)
            out << "[LEFT]";
        if (key==VK_UP)
            out << "[UP]";
        if (key==VK_RIGHT)
            out << "[RIGHT]";
        if (key==VK_DOWN)
            out << "[DOWN]";
        if (key==VK_SNAPSHOT)
            out << "[PRINT]";
        if (key==VK_NUMLOCK)
            out << "[NUM LOCK]";
        if (key==190 || key==110)
            out << ".";
        if (key >=96 && key <= 105)
        {
            key -= 48;
            out << &key; // had ampersand
        }
        if (key >=48 && key <= 59)
            out << &key; // amp'd
        if (key !=VK_LBUTTON || key !=VK_RBUTTON)
        {
            if (key >=65 && key <=90)
            {
                if (GetKeyState(VK_CAPITAL))
                out << &key; // amp;d
            else
            {
                key = key +32;
                out << &key; // amp'd
            }
        }
        }
}

I'm seriously stumped by this issue and any help would be greatly appreciated. Why would a function like this work differently on a 64 bit system? Considering it's the only box I've got I can't run it on a 32 bit to check whether or not it's an isolated issue. Because I'm assuming that it's related to getAsyncKeyState and not my code (which compiles and creates a blank log file) I only included those two code snippets.

Answer 1

Well, firstly you don't want to be using GetAsyncKeyState if you are writing a key logger; GetAsyncKeyState gets the state of the key at the immediate moment you call the function. You need to be listening in on the Windows messages, for things like WM_KEYDOWN, WM_KEYUP, or depending on the purpose of the logger WM_CHAR, WM_UNICHAR etc...

Answer 2

You're using the function incorrectly. Reading the documentation before requesting help is usually a good idea...

I'll just quote MSDN here:

If the function succeeds, the return value specifies whether the key was pressed since the last call to GetAsyncKeyState, and whether the key is currently up or down. If the most significant bit is set, the key is down, and if the least significant bit is set, the key was pressed after the previous call to GetAsyncKeyState. However, you should not rely on this last behavior; for more information, see the Remarks.

That last part also means it's completely useless for a key logger.

PS: Consider using GetKeyNameText for translating virtual key codes into meaningful names.

Answer 3

For monitoring input, something like a keyboard hook is probably the way to go (look up SetWindowsHookEx with WH_KEYBOARD_LL on MSDN).

As noted elsewhere, you're not using GetAsyncKeyState correctly here.

As for why you're seeing an address appear:

out << &key; // amp'd

This is several places in your code: key is a DWORD_PTR, so &key is a pointer - this is likely where the addresses are coming from.