|
1 | 1 | # keysniffer
|
2 |
| -A Linux kernel module to grab keys pressed in the keyboard, or a keylogger. Works with the US keyboard (and conforming laptops). |
| 2 | +A Linux kernel module to grab keys pressed in the keyboard, or a keylogger. |
| 3 | + |
| 4 | +keysniffer was originally written with the US keyboard (and conforming laptops) in mind. By default it shows human-readable strings for the keys pressed. However, as keyboards evolved, more keys got added. So the module now supports a module parameter `codes` which shows the `keycode shift_mask` pair in hex (`codes=1`) or decimal (`codes=2`). You can lookup the keycodes in `/usr/include/linux/input-event-codes.h`. |
3 | 5 |
|
4 | 6 | The keypress logs are recorded in debugfs as long as the module is loaded. Only root or sudoers can read the log. The module name has been camouflaged to blend-in with other kernel modules.
|
5 | 7 |
|
6 | 8 | You can, however, execute a script at shutdown or reboot (the procedure would be distro-specific) to save the keys to a file.
|
7 | 9 |
|
8 |
| -keysniffer is intended to track your own devices and NOT to trespass on others. The author has never usesd it to compromise someone else's system and is not responsible for any unethical application. |
| 10 | +**DISCLAIMER:** keysniffer is intended to track your own devices and NOT to trespass on others. The author has never used it to compromise any third-party device and is not responsible for any unethical application. |
9 | 11 |
|
10 | 12 | [](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=RMLTQ76JSXJ4Q "Donate via PayPal!")
|
11 | 13 |
|
@@ -53,12 +55,10 @@ To view the pressed keys, run:
|
53 | 55 | _ENTER_
|
54 | 56 | _ENTER_
|
55 | 57 |
|
56 |
| -To view generic keycodes (hex) in the format *keycode shift_mask*, run: |
| 58 | +To log generic hex keycodes in the format `keycode shift_mask`, run: |
57 | 59 |
|
58 | 60 | $ sudo insmod kisni.ko codes=1
|
59 |
| - or, for decimal: |
60 |
| - $ sudo insmod kisni.ko codes=2 |
61 |
| - |
| 61 | + // Type something |
62 | 62 | $ sudo cat /sys/kernel/debug/kisni/keys
|
63 | 63 | 23 0
|
64 | 64 | 12 0
|
@@ -90,6 +90,10 @@ To view generic keycodes (hex) in the format *keycode shift_mask*, run:
|
90 | 90 | 6a 0
|
91 | 91 | 1c 0
|
92 | 92 |
|
| 93 | +To log the keycodes in decimal, run: |
| 94 | + |
| 95 | + $ sudo insmod kisni.ko codes=2 |
| 96 | + |
93 | 97 | To unload the module (and clear the logs), run:
|
94 | 98 |
|
95 | 99 | $ sudo rmmod kisni
|
|
0 commit comments