test code remove after this paragraphwhile trueget_last_input(time sleep( we define lastinputinfo structure that will hold the timestamp (in millisecondsof when the last input event was detected on the system do note that you have to initialize the cbsize variable to the size of the structure before making the call we then call the getlastinputinfo functionwhich populates our struct_lastinputinfo dwtime field with the timestamp the next step is to determine how long the system has been running by using the gettickcount function call the last little snippet of code is simple test code where you can run the script and then move the mouseor hit key on the keyboard and see this new piece of code in action we'll define thresholds for these user input values next but first it' worth noting that the total running system time and the last detected user input event can also be relevant to your particular method of implantation for exampleif you know that you're only implanting using phishing tacticthen it' likely that user had to click or perform some operation to get infected this means that within the last minute or twoyou would see user input if for some reason you see that the machine has been running for minutes and the last detected input was minutes agothen you are likely inside sandbox that has not processed any user input these judgment calls are all part of having good trojan that works consistently this same technique can be useful for polling the system to see if user is idle or notas you may only want to start taking screenshots when they are actively using the machineand likewiseyou may only want to transmit data or perform other tasks when the user appears to be offline you could alsofor examplemodel user over time to determine what days and hours they are typically online let' delete the last three lines of test codeand add some additional code to look at keystrokes and mouse-clicks we'll use pure ctypes solution this time as opposed to the pyhook method you can easily use pyhook for this purpose as wellbut having couple of different tricks in your toolbox always helps as each antivirus and sandboxing technology has its own ways of spotting these tricks let' get codingdef get_key_press()global mouse_clicks global keystrokes for in range( , xff)if user getasynckeystate( =- is the code for left mouse-click if = mouse_clicks + return time time(elif and keystrokes + return none this simple function tells us the number of mouse-clicksthe time of the mouse-clicksas well as how many keystrokes the target has issued this works by iterating over the range of valid input keys for each keywe check whether the key has been pressed using the getasynckeystate function call if the key is detected as being pressedwe check if it is which is the virtual key code for