From aldeid
Jump to navigation Jump to search


Determines whether a key is up or down at the time the function is called, and whether the key was pressed after a previous call to GetAsyncKeyState.

Malware sometimes uses this function to implement a keylogger.


SHORT WINAPI GetAsyncKeyState(
  _In_  int vKey


vKey [in]
Type: int
The virtual-key code. For more information, see Virtual Key Codes.
You can use left- and right-distinguishing constants to specify certain keys. See the Remarks section for further information.

Return value


If the function succeeds, the return value specifies whether the key was pressed since the last call to GetAsyncKeyState, and whether the key is currently up or down. If the most significant bit is set, the key is down, and if the least significant bit is set, the key was pressed after the previous call to GetAsyncKeyState. However, you should not rely on this last behavior.

The return value is zero for the following cases:

  • The current desktop is not the active desktop
  • The foreground thread belongs to another process and the desktop does not allow the hook or the journal record.