Graphics Device Interface

However, contemporary info stealers and advanced persistent threats, APTs, have evolved.

Instead of relying solely on low-level keyboard hooks, modern malware frequently implements continuous asynchronous screen scraping loops via graphics APIs like DirectX or GDI.

If a user enters sensitive data via a virtual keyboard or opens a password manager, a host-based surveillance vector can capture the visual buffer at the exact millisecond the plain text is exposed.

Standard user space protections that attempt to intercept the key intercept nothing when malware captures the screen directly from the window graphics pipeline.

English Bob says, I hope I'm not asking about trade secrets here, but am I right in thinking that the Windows version is essentially a native Win32 app

where all the widgets are custom drawn? Yeah, because it's all GDI...

It was GDI+.

Now it is mostly direct 2D and direct composition.

Yeah.

So he says, if so, is that GDI+, that's doing all the work? I'm horribly out of date with that guess.

Yeah, no, I probably was too.

So I started with GDI+, and then realized that...