keylogger

README

Keylogger

Capture global keyboard events on Linux

Notes

• Only Linux based
• Need root privilages

Installation

go get github.com/Moisesbr/keylogger

Getting started

Finding keyboard device

There is a helper on finding the keyboard.

 keyboard := keylogger.FindKeyboardDevice()

Which goes through each file device name to find keyword "keyboard"

/sys/class/input/event[0-255]/device/name

and returns the file event path if found

/dev/input/event2

If the function returns empty string, you will need to cat each device name and get the event number. If you know already, you can easily pass it to constructor

keylogger.New("/dev/input/event2")

Getting keypress

Once the keylogger returns channel event, you can switch by event code as described in input_event.go For start, you can listen on keyboard state change

keylogger.EvKey

Once you get desire event, there is a helper to parse code into human readable key.

event.KeyString()

NOTE

If you listen on keyboard state change, it will return double results. This is because pressing and releasing the key are 2 different state change. There is a helper function which you can call to see which type of state change happend

// returns true if key on keyboard is pressed
event.KeyPress()

// returns true if key on keyboard is released
event.KeyRelease()

Example

You can find a example script in example/main.go

Running tests

No magic, just run

go test -v

Creating key sniffer (needs update)

• sniffing global keyboard events in go

License

This library is under the MIT License

Donate

I don't drink beer, so energy drink will do :)

BTC: 19AtHE6dgKX3R9vJSCSKRyF1saexLcBRep

Documentation

Overview

Package keylogger is a go library for linux to capture keyboard events. About:

* No C deps

* Events ported from uapi/linux/input.h

* Needs root privilages

* Transfer keyboard code into human readable key

* Capture state changes

See README at https://github.com/MarinX/keylogger for more info.

Index

• func FindKeyboardDevice(found string) string
• type EventType
• type InputEvent
  • func (i *InputEvent) KeyPress() bool
  • func (i *InputEvent) KeyRelease() bool
  • func (i *InputEvent) KeyString() string
• type KeyLogger
  • func New(devPath string) (*KeyLogger, error)
  • func (k *KeyLogger) Close() error
  • func (k *KeyLogger) IsRoot() bool
  • func (k *KeyLogger) Read() chan InputEvent

Functions

func FindKeyboardDevice

func FindKeyboardDevice(found string) string

FindKeyboardDevice by going through each device registered on OS Mostly it will contain keyword - keyboard Returns the file path which contains events

Types

type EventType

type EventType uint16

EventType are groupings of codes under a logical input construct. Each type has a set of applicable codes to be used in generating events. See the Ev section for details on valid codes for each type

const (
	// EvSyn is used as markers to separate events. Events may be separated in time or in space, such as with the multitouch protocol.
	EvSyn EventType = 0x00
	// EvKey is used to describe state changes of keyboards, buttons, or other key-like devices.
	EvKey EventType = 0x01
	// EvRel is used to describe relative axis value changes, e.g. moving the mouse 5 units to the left.
	EvRel EventType = 0x02
	// EvAbs is used to describe absolute axis value changes, e.g. describing the coordinates of a touch on a touchscreen.
	EvAbs EventType = 0x03
	// EvMsc is used to describe miscellaneous input data that do not fit into other types.
	EvMsc EventType = 0x04
	// EvSw is used to describe binary state input switches.
	EvSw EventType = 0x05
	// EvLed is used to turn LEDs on devices on and off.
	EvLed EventType = 0x11
	// EvSnd is used to output sound to devices.
	EvSnd EventType = 0x12
	// EvRep is used for autorepeating devices.
	EvRep EventType = 0x14
	// EvFf is used to send force feedback commands to an input device.
	EvFf EventType = 0x15
	// EvPwr is a special type for power button and switch input.
	EvPwr EventType = 0x16
	// EvFfStatus is used to receive force feedback device status.
	EvFfStatus EventType = 0x17
)

type InputEvent

type InputEvent struct {
	Time  syscall.Timeval
	Type  EventType
	Code  uint16
	Value int32
}

InputEvent is the keyboard event structure itself

func (*InputEvent) KeyPress

func (i *InputEvent) KeyPress() bool

KeyPress is the value when we press the key on keyboard

func (*InputEvent) KeyRelease

func (i *InputEvent) KeyRelease() bool

KeyRelease is the value when we release the key on keyboard

func (*InputEvent) KeyString

func (i *InputEvent) KeyString() string

KeyString returns representation of pressed key as string eg enter, space, a, b, c...

type KeyLogger

type KeyLogger struct {
	// contains filtered or unexported fields
}

KeyLogger wrapper around file descriptior

func New

func New(devPath string) (*KeyLogger, error)

New creates a new keylogger for a device path

func (*KeyLogger) Close

func (k *KeyLogger) Close() error

Close file descriptor

func (*KeyLogger) IsRoot

func (k *KeyLogger) IsRoot() bool

IsRoot checks if the process is run with root permission

func (*KeyLogger) Read

func (k *KeyLogger) Read() chan InputEvent

Read from file descriptor Blocking call, returns channel Make sure to close channel when finish