How calomity/usbfilelogger works
usbfilelogger is a Windows program that persists itself, injects a DLL into Task Manager, logs activity, and watches removable drives to copy selected files. Its main loop detects newly connected removable volumes and copies .txt, .pdf, and .exe files into extension-specific folders. The DLL source shows a directory-query hook that filters a configured filename; the README also identifies a system-information hook, and the header declares it. The system-information hook implementation and DLL hook-installation wiring are not visible in the sampled source, so those details are not inferred here.
Main entry points: main.cpp Main loop · rat.h Runtime helpers · dllmain.cpp Injected DLL hooks · dllmain.h System info hook
Components 14
Host runtime
- Main loop
main.cpp - Runtime helpers
rat.h - Activity logs
- Run registry key
- Task Manager
- DLL injection
rat.h
Drive monitoring
- Copied files
- Drive polling
main.cpp - Extension copier
rat.h
Injected hooks
- Injected DLL hooks
dllmain/dllmain.cpp - Directory query filter
dllmain/dllmain.cpp - System info hook
dllmain/dllmain.h
Other components
- Windows
- Removable drive
Connections 17
- Windows → Main loop: starts
- Main loop → Runtime helpers: logs activity
- Runtime helpers → Activity logs: appends logs
- Main loop → Run registry key: sets autorun
- Main loop → Task Manager: launches
- Main loop → Runtime helpers: injects via
- Runtime helpers → Task Manager: loads DLL into
- Main loop → Drive polling: polls drives
- Drive polling → Windows: queries volumes
- Removable drive → Drive polling: volume detected
- Drive polling → Extension copier: copies matching files
- Extension copier → Removable drive: scans files
- Extension copier → Copied files: writes copies
- Task Manager → Injected DLL hooks: loads
- Injected DLL hooks → Directory query filter: implements
- Windows → Directory query filter: dispatches directory queries
- Injected DLL hooks → System info hook: declares hook