feat: log keystrokes via rawinput

[zeze-zeze]

test file: mandiant/capa-testfiles#296
reference: http://www.rohitab.com/discuss/topic/35415-c-getrawinputdata-keylogger/

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[williballenthin]

why have you named this "...via directx"? i don't see that mentioned for the msdn pages for these functions.

[zeze-zeze]

I confused GetRawInputData with DirectX, and I fixed by changing the file name.
The reference for GetRawInputData: http://www.rohitab.com/discuss/topic/35415-c-getrawinputdata-keylogger/
for DirectX: https://www.gironsec.com/blog/2017/07/keylogger-using-directx/

I will create another PR for DirectX one after this is merged.

[williballenthin]

thank you for the contribution @zeze-zeze!

[mr-tz]

Does this differ to https://github.com/mandiant/capa-rules/blob/master/nursery/log-keystrokes-via-raw-input-data.yml#L18 and/or https://github.com/mandiant/capa-rules/blob/master/nursery/register-raw-input-devices.yml#L13?

[zeze-zeze]

Does this differ to https://github.com/mandiant/capa-rules/blob/master/nursery/log-keystrokes-via-raw-input-data.yml#L18 and/or https://github.com/mandiant/capa-rules/blob/master/nursery/register-raw-input-devices.yml#L13?

I didn't check the one in nursery. This PR has the same target to log-keystrokes-via-raw-input-data.yml

And I should have pushed to nursery. First time contribute to this project.

[mike-hunhoff]

@zeze-zeze thank you for your contribution! Please verify that the existing rules highlighted by @mr-tz match your example 52d8e95c9883cd16d7b44e3a7adc22d6.exe_. If so, graduate the existing rules by updating each rule with your example file 52d8e95c9883cd16d7b44e3a7adc22d6.exe_ and moving them to the proper directories outside of nursery. Let us know if you have any questions 😄

[zeze-zeze]

log-keystrokes-via-raw-input-data.yml is more restrict, but it doesn't match my keylogger example 52d8e95c9883cd16d7b44e3a7adc22d6.exe_.

register-raw-input-devices matches the example, but it is less restrict than mine.

Which rule should I move from nursery 🤯

[mike-hunhoff]

log-keystrokes-via-raw-input-data.yml is more restrict, but it doesn't match my keylogger example 52d8e95c9883cd16d7b44e3a7adc22d6.exe_.

register-raw-input-devices matches the example, but it is less restrict to mine.

Which rule should I move from nursery 🤯

Do we need to make log-keystrokes-via-raw-input-data.yml less restrict?

Let's for sure move register-raw-input-devices out of the nursery.