offensive-keylogger-arch

Low-level keylogger architecture design: kernel driver hooks (WH_KEYBOARD_LL, SetWindowsHookEx), ETW-based input capture, user-mode vs kernel-mode approaches, stealth techniques, and data exfiltration. Use for understanding input capture mechanisms, EDR evasion research, or malware architecture analysis. Use when performing authorized red-team, pentest, or research work involving keylogger arch.

Compatibility

claude-code codex opencode