arryboom / screencapattack

ScreenCap

• By using a Mirror Driver technique for making a kernel level screen capture.

Compile Environment

• Visual Studio 2015 with update 3
  
• Windowr Driver Kit 7 or above
  
• MFC library

Runtime Environment

• Windows 2000 to Windows 7 for x64 (also compatible with x86)

Description

• ScreenCap is a MFC DLL and packed with a miniport driver(mirror driver) and related file into a resource,
  ScreenCap provided a exported function that can be able to make a kernel-level Screen Capture on Windows 2000
  to Windows 7 for x86/x64 platform, and which is using a mini-port driver technique, by attached to videoprt.sys.  And the driver will map the memory which is pointer to self-created surface it will be updated by intercepting GDI rendering.

Compile

1. Build a Mini-port driver and user-mode driver by WDK, then we will get a Mirror.dll / Mirror.sys
2. Put them into bin-x64
3. Compile a ScreenCap.dll , it will pack the files into resources.
4. Compile a Tester.exe , test a screen capture functions.

Demo Program:

• Tester.exe by pressing default command '2', then the driver will be loaded by default INF file
  and finally a demo program will make a screenshot which will be saved in C:\CopyScreen2.bmp file.

REMARKS

• This project is just for experiment, and I suggest it run in Virtualization Environment. Since the INF file default the Driver will be loaded during boot time.