Skip to content

Commit 21e611a

Browse files
committed
Use standard macros, update doc.
1 parent 3c105f9 commit 21e611a

File tree

2 files changed

+13
-9
lines changed

2 files changed

+13
-9
lines changed

README.md

+10-6
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
# keysniffer
2-
A Linux kernel module to grab keys pressed in the keyboard, or a keylogger. Works with the US keyboard (and conforming laptops).
2+
A Linux kernel module to grab keys pressed in the keyboard, or a keylogger.
3+
4+
keysniffer was originally written with the US keyboard (and conforming laptops) in mind. By default it shows human-readable strings for the keys pressed. However, as keyboards evolved, more keys got added. So the module now supports a module parameter `codes` which shows the `keycode shift_mask` pair in hex (`codes=1`) or decimal (`codes=2`). You can lookup the keycodes in `/usr/include/linux/input-event-codes.h`.
35

46
The keypress logs are recorded in debugfs as long as the module is loaded. Only root or sudoers can read the log. The module name has been camouflaged to blend-in with other kernel modules.
57

68
You can, however, execute a script at shutdown or reboot (the procedure would be distro-specific) to save the keys to a file.
79

8-
keysniffer is intended to track your own devices and NOT to trespass on others. The author has never usesd it to compromise someone else's system and is not responsible for any unethical application.
10+
**DISCLAIMER:** keysniffer is intended to track your own devices and NOT to trespass on others. The author has never used it to compromise any third-party device and is not responsible for any unethical application.
911

1012
[![PayPal](https://tuxtricks.files.wordpress.com/2016/12/donate.png)](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=RMLTQ76JSXJ4Q "Donate via PayPal!")
1113

@@ -53,12 +55,10 @@ To view the pressed keys, run:
5355
_ENTER_
5456
_ENTER_
5557

56-
To view generic keycodes (hex) in the format *keycode shift_mask*, run:
58+
To log generic hex keycodes in the format `keycode shift_mask`, run:
5759

5860
$ sudo insmod kisni.ko codes=1
59-
or, for decimal:
60-
$ sudo insmod kisni.ko codes=2
61-
61+
// Type something
6262
$ sudo cat /sys/kernel/debug/kisni/keys
6363
23 0
6464
12 0
@@ -90,6 +90,10 @@ To view generic keycodes (hex) in the format *keycode shift_mask*, run:
9090
6a 0
9191
1c 0
9292

93+
To log the keycodes in decimal, run:
94+
95+
$ sudo insmod kisni.ko codes=2
96+
9397
To unload the module (and clear the logs), run:
9498

9599
$ sudo rmmod kisni

keysniffer.c

+3-3
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ void keycode_to_string(int keycode, int shift_mask, char *buf, int type)
122122
{
123123
switch (type) {
124124
case US:
125-
if (keycode >= 0x1 && keycode <= 0x77) {
125+
if (keycode > KEY_RESERVED && keycode <= KEY_PAUSE) {
126126
const char *us_key = (shift_mask == 1)
127127
? us_keymap[keycode][1]
128128
: us_keymap[keycode][0];
@@ -131,11 +131,11 @@ void keycode_to_string(int keycode, int shift_mask, char *buf, int type)
131131
}
132132
break;
133133
case HEX:
134-
if (keycode < KEY_MAX)
134+
if (keycode > KEY_RESERVED && keycode < KEY_MAX)
135135
snprintf(buf, CHUNK_LEN, "%x %x", keycode, shift_mask);
136136
break;
137137
case DEC:
138-
if (keycode < KEY_MAX)
138+
if (keycode > KEY_RESERVED && keycode < KEY_MAX)
139139
snprintf(buf, CHUNK_LEN, "%d %d", keycode, shift_mask);
140140
break;
141141
}

0 commit comments

Comments
 (0)