keylogger

README

Keylogger

Capture global keyboard events on Linux

Notes

• Only Linux based
• Need root privilages

Installation

go get github.com/MarinX/keylogger

Getting started

Finding keyboard device

There is a helper on finding the keyboard.

 keyboard := keylogger.FindKeyboardDevice()

Which goes through each file device name to find keyword "keyboard"

/sys/class/input/event[0-255]/device/name

and returns the file event path if found

/dev/input/event2

If the function returns empty string, you will need to cat each device name and get the event number. If you know already, you can easily pass it to constructor

keylogger.New("/dev/input/event2")

Getting keypress

Once the keylogger returns channel event, you can switch by event code as described in input_event.go For start, you can listen on keyboard state change

keylogger.EvKey

Once you get desire event, there is a helper to parse code into human readable key.

event.KeyString()

Writing keypress

Best way is to open an text editor and see how keyboard will react There are 2 methods:

func (k *KeyLogger) WriteOnce(key string) error

and

func (k *KeyLogger) Write(direction KeyEvent, key string) error 

WriteOnce method simulates single key press, eg: press and release letter M

Write writes to keyboard and sync the event. This will keep the key pressed or released until you call another write with other direction eg, if the key is "A" and direction is press, on UI, you will see "AAAAA..." until you stop with release

Probably you want to use WriteOnce method

NOTE

If you listen on keyboard state change, it will return double results. This is because pressing and releasing the key are 2 different state change. There is a helper function which you can call to see which type of state change happend

// returns true if key on keyboard is pressed
event.KeyPress()

// returns true if key on keyboard is released
event.KeyRelease()

Example

You can find a example script in example/main.go

Running tests

No magic, just run

go test -v

Creating key sniffer (needs update)

• sniffing global keyboard events in go

License

This library is under the MIT License

Documentation

Overview

Package keylogger is a go library for linux to capture keyboard events. About:

* No C deps

* Events ported from uapi/linux/input.h

* Needs root privilages

* Transfer keyboard code into human readable key

* Capture state changes

* Write back to keyboard

See README at https://github.com/MarinX/keylogger for more info.

Index

• func FindAllKeyboardDevices() []string
• func FindKeyboardDevice() string
• type EventType
• type InputEvent
  • func (i *InputEvent) KeyPress() bool
  • func (i *InputEvent) KeyRelease() bool
  • func (i *InputEvent) KeyString() string
• type KeyEvent
• type KeyLogger
  • func New(devPath string) (*KeyLogger, error)
  • func (k *KeyLogger) Close() error
  • func (k *KeyLogger) IsRoot() bool
  • func (k *KeyLogger) Read() chan InputEvent
  • func (k *KeyLogger) Write(direction KeyEvent, key string) error
  • func (k *KeyLogger) WriteOnce(key string) error

Functions

func FindAllKeyboardDevices

func FindAllKeyboardDevices() []string

Like FindKeyboardDevice, but finds all devices which contain keyword 'keyboard' Returns an array of file paths which contain keyboard events

func FindKeyboardDevice

func FindKeyboardDevice() string

FindKeyboardDevice by going through each device registered on OS Mostly it will contain keyword - keyboard Returns the file path which contains events

Types

type EventType

type EventType uint16

EventType are groupings of codes under a logical input construct. Each type has a set of applicable codes to be used in generating events. See the Ev section for details on valid codes for each type

const (
	// EvSyn is used as markers to separate events. Events may be separated in time or in space, such as with the multitouch protocol.
	EvSyn EventType = 0x00
	// EvKey is used to describe state changes of keyboards, buttons, or other key-like devices.
	EvKey EventType = 0x01
	// EvRel is used to describe relative axis value changes, e.g. moving the mouse 5 units to the left.
	EvRel EventType = 0x02
	// EvAbs is used to describe absolute axis value changes, e.g. describing the coordinates of a touch on a touchscreen.
	EvAbs EventType = 0x03
	// EvMsc is used to describe miscellaneous input data that do not fit into other types.
	EvMsc EventType = 0x04
	// EvSw is used to describe binary state input switches.
	EvSw EventType = 0x05
	// EvLed is used to turn LEDs on devices on and off.
	EvLed EventType = 0x11
	// EvSnd is used to output sound to devices.
	EvSnd EventType = 0x12
	// EvRep is used for autorepeating devices.
	EvRep EventType = 0x14
	// EvFf is used to send force feedback commands to an input device.
	EvFf EventType = 0x15
	// EvPwr is a special type for power button and switch input.
	EvPwr EventType = 0x16
	// EvFfStatus is used to receive force feedback device status.
	EvFfStatus EventType = 0x17
)

type InputEvent

type InputEvent struct {
	Time  syscall.Timeval
	Type  EventType
	Code  uint16
	Value int32
}

InputEvent is the keyboard event structure itself

func (*InputEvent) KeyPress

func (i *InputEvent) KeyPress() bool

KeyPress is the value when we press the key on keyboard

func (*InputEvent) KeyRelease

func (i *InputEvent) KeyRelease() bool

KeyRelease is the value when we release the key on keyboard

func (*InputEvent) KeyString

func (i *InputEvent) KeyString() string

KeyString returns representation of pressed key as string eg enter, space, a, b, c...

type KeyEvent

type KeyEvent int32

KeyEvent is the keyboard event for up/down (press/release)

const (
	KeyPress   KeyEvent = 1
	KeyRelease KeyEvent = 0
)

type KeyLogger

type KeyLogger struct {
	// contains filtered or unexported fields
}

KeyLogger wrapper around file descriptior

func New

func New(devPath string) (*KeyLogger, error)

New creates a new keylogger for a device path

func (*KeyLogger) Close

func (k *KeyLogger) Close() error

Close file descriptor

func (*KeyLogger) IsRoot

func (k *KeyLogger) IsRoot() bool

IsRoot checks if the process is run with root permission

func (*KeyLogger) Read

func (k *KeyLogger) Read() chan InputEvent

Read from file descriptor Blocking call, returns channel Make sure to close channel when finish

func (*KeyLogger) Write

func (k *KeyLogger) Write(direction KeyEvent, key string) error

Write writes to keyboard and sync the event This will keep the key pressed or released until you call another write with other direction eg, if the key is "A" and direction is press, on UI, you will see "AAAAA..." until you stop with release Probably you want to use WriteOnce method

func (*KeyLogger) WriteOnce

func (k *KeyLogger) WriteOnce(key string) error

WriteOnce method simulates single key press When you send a key, it will press it, release it and send to sync