Sending keystrokes to an application, SendKeys.Send() vs SendMessage()
c#, winforms
Solution
- `SendKeys.Send` typically uses `SendInput`. The alternative method based on journal hooks is not viable with UAC so let us assume that `SendKeys.Send` resolves to `SendInput`.
- `SendMessage` delivers messages direct to the window proc in a synchronous manner.
So, which is easier to detect. Well, for sure the answer is `SendMessage`. These are input messages that arrive at the window procedure without ever having been pulled off the queue with a call to `GetMessage`. That is trivially easy to detect. You simply log some information about the latest message pulled from the queue, and in the window procedure, check the message against the latest queued message.
Now, discriminating between `SendInput` and real human input is probably harder than that. I'm quite sure it's possible though. One way is to install a low-level keyboard hook and look for the LLKHF_INJECTED flag. Harder, but not that much harder.
Problem
I have created a simple bot to automate some things in a game. I'm currently sendings commands to the game by bringing the game window to the foreground and sending keys using SendKeys, like this: ``` SendKeys.Send("{ENTER}") ``` What I would like to know is, from a detectability point of view, if it's easier for anti cheat engines and such to detect something like this (using SendMessage): ``` public static void SendKeystroke(ushort k) { const uint WM_KEYDOWN = 0x100; const uint WM_SYSCOMMAND = 0x018; const uint SC_CLOSE = 0x053; IntPtr WindowToFind = FindWindow(null, "Untitled1 - Notepad++"); IntPtr result3 = SendMessage(WindowToFind, WM_KEYDOWN, ((IntPtr)k), (IntPtr)0); } SendKeystroke(Keys.Enter); ``` In the end, the game would receive a keydown event for the enter key nontheless, right?