Skip to content

Commit

Permalink
Use standard macros, update doc.
Browse files Browse the repository at this point in the history
  • Loading branch information
jarun committed Mar 28, 2017
1 parent 3c105f9 commit 21e611a
Show file tree
Hide file tree
Showing 2 changed files with 13 additions and 9 deletions.
16 changes: 10 additions & 6 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,11 +1,13 @@
# keysniffer
A Linux kernel module to grab keys pressed in the keyboard, or a keylogger. Works with the US keyboard (and conforming laptops).
A Linux kernel module to grab keys pressed in the keyboard, or a keylogger.

keysniffer was originally written with the US keyboard (and conforming laptops) in mind. By default it shows human-readable strings for the keys pressed. However, as keyboards evolved, more keys got added. So the module now supports a module parameter `codes` which shows the `keycode shift_mask` pair in hex (`codes=1`) or decimal (`codes=2`). You can lookup the keycodes in `/usr/include/linux/input-event-codes.h`.

The keypress logs are recorded in debugfs as long as the module is loaded. Only root or sudoers can read the log. The module name has been camouflaged to blend-in with other kernel modules.

You can, however, execute a script at shutdown or reboot (the procedure would be distro-specific) to save the keys to a file.

keysniffer is intended to track your own devices and NOT to trespass on others. The author has never usesd it to compromise someone else's system and is not responsible for any unethical application.
**DISCLAIMER:** keysniffer is intended to track your own devices and NOT to trespass on others. The author has never used it to compromise any third-party device and is not responsible for any unethical application.

[![PayPal](https://tuxtricks.files.wordpress.com/2016/12/donate.png)](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=RMLTQ76JSXJ4Q "Donate via PayPal!")

Expand Down Expand Up @@ -53,12 +55,10 @@ To view the pressed keys, run:
_ENTER_
_ENTER_

To view generic keycodes (hex) in the format *keycode shift_mask*, run:
To log generic hex keycodes in the format `keycode shift_mask`, run:

$ sudo insmod kisni.ko codes=1
or, for decimal:
$ sudo insmod kisni.ko codes=2

// Type something
$ sudo cat /sys/kernel/debug/kisni/keys
23 0
12 0
Expand Down Expand Up @@ -90,6 +90,10 @@ To view generic keycodes (hex) in the format *keycode shift_mask*, run:
6a 0
1c 0

To log the keycodes in decimal, run:

$ sudo insmod kisni.ko codes=2

To unload the module (and clear the logs), run:

$ sudo rmmod kisni
Expand Down
6 changes: 3 additions & 3 deletions keysniffer.c
Original file line number Diff line number Diff line change
Expand Up @@ -122,7 +122,7 @@ void keycode_to_string(int keycode, int shift_mask, char *buf, int type)
{
switch (type) {
case US:
if (keycode >= 0x1 && keycode <= 0x77) {
if (keycode > KEY_RESERVED && keycode <= KEY_PAUSE) {
const char *us_key = (shift_mask == 1)
? us_keymap[keycode][1]
: us_keymap[keycode][0];
Expand All @@ -131,11 +131,11 @@ void keycode_to_string(int keycode, int shift_mask, char *buf, int type)
}
break;
case HEX:
if (keycode < KEY_MAX)
if (keycode > KEY_RESERVED && keycode < KEY_MAX)
snprintf(buf, CHUNK_LEN, "%x %x", keycode, shift_mask);
break;
case DEC:
if (keycode < KEY_MAX)
if (keycode > KEY_RESERVED && keycode < KEY_MAX)
snprintf(buf, CHUNK_LEN, "%d %d", keycode, shift_mask);
break;
}
Expand Down

6 comments on commit 21e611a

@jarun
Copy link
Owner Author

@jarun jarun commented on 21e611a Oct 10, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@shaggytwodope if you do have some time (and it interests you), would you like to give dkms a try and make the installation of keysniffer easier for mere mortals? ;)

Help:

Note: I don't intend to have it in any repo, it must be a thou shall seek and thou shall find case ;) but the dkms is kinda convenient when one finds it.

@professorjamesmoriarty

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jarun This will take some time to research a bit. But I'm certainly interested.

@jarun
Copy link
Owner Author

@jarun jarun commented on 21e611a Oct 10, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, it's not urgent.

@jarun
Copy link
Owner Author

@jarun jarun commented on 21e611a Nov 12, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I had some time this afternoon. Added the dkms support at 552684e. 👍

@professorjamesmoriarty
Copy link

@professorjamesmoriarty professorjamesmoriarty commented on 21e611a Nov 16, 2017 via email

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jarun
Copy link
Owner Author

@jarun jarun commented on 21e611a Nov 16, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey, no problem at all. I just wanted to update you is all.

Recover soon! We are missing you already. :)

Please sign in to comment.