Linux keylogger

fakie_flip · 05-22-2007, 07:48 AM

I tried your C program. It's producing garbage output in the key.log file. Here is what I got in it.

Code:

10020500.137657-30
10020503.577657+48
10020503.745656-48
10020506.145656+46
10020506.305657-46
10020506.641657+32
10020506.777656-32
10020507.401657+18
10020507.545657-18
10020507.769657+33
10020507.937660-33
10020508.177655+34
10020508.321656-34
10020508.865656+35
10020508.953658-35
10020509.209657+23
10020509.313655-23
10020509.569657+36
10020509.673656-36
10020510.345658+37
10020510.457659-37
10020510.729657+38
10020510.841655-38
10020511. 41657+50
10020511.169655-50
10020511.377656+49
10020511.473657-49
10020511.753658+24
10020511.833652-24
10020512. 65655+25
10020512.177656-25
10020512.361657+16
10020512.513656-16
10020512.801655+19
10020512.937658-19
10020513.505657+31
10020513.625654-31
10020513.777656+20
10020513.897655-20
10020514.129654+22
10020514.249655-22
10020514.449658+47
10020514.609655-47
10020515.889656+17
10020516.  9656-17
10020516.273655+45
10020516.409656-45
10020516.849656+21
10020516.969654-21
10020517.137656+44
10020517.305654-44

phi · 05-24-2007, 07:20 AM

First of all I want to state, that my code is not a final application.
It only was a simple try to get the pressed keys together with the time, they were pressed.

I wanted to write an keylogger, which finds the keycodes, the characters and times of each press (the releass is not relevant for my application).
The keylogger should generate a file which will make it possible to enhance the keyboard layout for myself. I have my own key assignment already, because
as a german programmer I use all the "umlauts" (äöüßÖÄÜ) but also some french symbols (éáí...) and of course all the programmers symbols like "{([" and so on.
Attention: The closing parentheses, brackets and so on I do not use a lot, because the editors (like eclipse) normally enter them automatically.

I have not finished my project yet, because I have not yet found a simple way to get the characters out of the key codes.
The "xmodmap -pk" gives some information, but I have to find all the pressed modifier keys myself? Any Idea is welcome.

But now to the heavy Word "garbage" for my SUPER code example ;-)

Replace the fprintf to the follwing and the code is not as "garbage" any more: the leading zeros are now filled with "0"s and not with blanks " ".
But still garbage, if you don't know what it means (see Explanation below).

Code:

fprintf(output, "%i.%06d", makeSeconds(data), makeMicros(data));

The result may look like the following:

Code:

10190741.798544+31
10190741.819493+32
10190741.840557-30
10190741.871797+33
10190741.892722-31
10190741.923755-32
10190741.965280-33
10190742.013934+30
10190742.037998+31
10190742.069367+32
10190742.110791+33
10190742.121436-30
10190742.132060-31
10190742.153096-32
10190742.194779-33
10190742.249864+30

Explanation

Here the number before the period(.) indicate the seconds, the number after the point show the microseconds of the key press or release.
A + means that the key was pressed and a - means that the key was released.
The last 2 numbers are the keys identifier (not the ascii or UTF number !!), but the keyboard-key-id: The character "a" for example is normally (us, german) located at key 30. But - and that's still my question - the character "A" is also located at key 30! I should find a simple way to find out, if shift, control and alt are pressed at a given time. I realy don't want to programmatically trace each press of a shift, control or alt key. Any ideas?

Attention: Sometimes (i have not found when) the

Code:

/dev/input/event0

should be replaced by

Code:

/dev/input/event1

. Why? I ' don't know.

fakie_flip · 05-28-2007, 09:29 PM

Currently there is not a working keylogger for USB keyboards for Linux. LKL (Linux KeyLogger) works on ps/2 keyboards, but not for usb keyboards.

phi · 07-05-2008, 09:42 AM

Hello

I have still the same problem. Because I want to find out, which keys are pressed how many times, I want to use a keylogger. The Dvorak Keyboard is generated for the english language, but I mostly write German or Java. So, I want to generate my own .Xmodmap (phi-dvorak).

Because eclipse writes some code for me, it is not sufficient to analyse my texts and code to find out, which keys I press most. Example: The "{" is pressed much more times than the "}"-Key, because eclispe writes the "}" itself.

But the above mentioned keyloger gets me the key-events rather than the key-codes. Thats why I was looking for another solution. Now, my code hangs at the XPeekEvent()-routine. Is it possible, that there is no way to get the X-Keycodes of all applications?

Heres my Idea, but I need help with that, because the program hangs at the XPeekEvent routine.

Code:

/* Kompilieren mit
  >gcc XKeylogger.c -L/usr/X11R6/lib -lX11
*/

#include <X11/Xlib.h> 
#include <X11/Xutil.h>

#include <stdlib.h>
#include <stdio.h>



Display * d;
XKeyEvent evt;
char buffer[256];
KeySym keysym;
XComposeStatus statusInOut;

int main(int argc, char * args[]) {

  printf("debug xyz\n");

  d = XOpenDisplay(":0.0");

  if(0 == d) {
    printf("EXIT no display\n");
    return EXIT_FAILURE;
  }

  while(-1) {
    printf("debug before peek\n"); // Hier hakts ...
    XPeekEvent(d, (XEvent*) &evt);

    printf("debug before lookup\n");
    XLookupString(&evt,  buffer, 255, &keysym, &statusInOut);

    printf("Buffer :[%s]\n", buffer);
  }

 
}

geogauci · 10-14-2008, 12:19 PM

Hi! I just mapped the keycodes generated by the code written by PHI some time ago to the actual letters and symbols.

Now I need to flush the buffer just after reading the data so it will not be "picked up" by other software if possible.
What I mean is that I want to have my keylogger running while mplayer is running, but I don't want mplayer to interact to the keyboard keys except maybe for ESC.

Any help would be greatly appreciated!

fakie_flip · 10-14-2008, 12:59 PM

Is there any chance in getting keylogging working with usb keyboards?

esaghor · 11-11-2008, 10:19 PM

hello evryone!
i need to a linux keylogger,so plz hellp me!
thnx
Esa
Esa_ghur@yahoo.com

chrism01 · 11-11-2008, 11:39 PM

I believe the tools 'script' and/or 'screen' may be an easier way to record what you've done.

phi · 04-15-2009, 08:11 AM

I have finally created my own keyboard (without the use of a keylogger, but using statistics on german texts and java code). I don't know, if this is the best choice, but for me, it works fine:

www.freimann.eu/eliphi/phi/keyboard/

kernc · 01-03-2010, 12:28 AM

Hello all!

I sincerely apologize for bumping this old thread, but I honestly believe my post is relevant and appropriate.

In search of a usable and reliable linux keylogger I stumbled upon this thread, and also with its help I created what is now another lkl and überkey comparable keylogger.

logkeys linux keylogger

features:

dynamically interprets console keymap (not very reliable, read documentation :P)
writes to log file

I'm sorry to say that it doesn't seem to work with USB keyboards despite them using input event interface.

(I'm lacking USB peripherals to test with.)
I guess I'll keep working on it as time allows.

For now, logkeys suits me really well, better than lkl or uberkey ever did.

Thanks for listening!

roscogruen · 01-04-2010, 06:37 AM

is there an easy to use GUI package i could use? i just can't seem to learn code/language/programming.

i've a usb keyboard. hopefully things have changed since this thread was last active.

i tried sudo od -tx1 /dev/input/dev0 but got errors. yeah, i need GUI

roscogruen · 01-04-2010, 06:50 AM

kernc,
is this "logkey" from a trusted repo? what is the repo? i don't find logkey in the ones i use.

thx - r

roscogruen · 01-04-2010, 06:55 AM

Quote:

Originally Posted by chrism01

I believe the tools 'script' and/or 'screen' may be an easier way to record what you've done.

could you explain further?

do you mean in the menu's, "file," "edit," "view," ...?

would the "'script' and/or 'screen'" approach work with a usb keyboard? i'd love to know!

H_TeXMeX_H · 01-04-2010, 12:58 PM

Well, I recently wrote a rather nice keylogger (with some borrowed code), if you want I could post it somewhere (maybe even here) ... if the mods are ok with that...

or maybe I'll put it on my site.

roscogruen · 01-05-2010, 01:57 AM

Quote:

Originally Posted by H_TeXMeX_H

Well, I recently wrote a rather nice keylogger (with some borrowed code), if you want I could post it somewhere (maybe even here) ... if the mods are ok with that...

or maybe I'll put it on my site.

If it works for a USB, awesome. you can send it to my email if i gave you that in private message. or you could post it here, paste it on a imagebin.ca.org or give me a link.

i'm not good with code. will i know how to tailor it to this system?

along with recording from local peripherals, would this keylogger also cover outside (intrusive) traffic? just curious.