Writing a Linux Keylogger in C

最新推荐文章于 2021-05-15 05:25:25 发布
最新推荐文章于 2021-05-15 05:25:25 发布
阅读量1.9k 收藏
点赞数
分类专栏： Linux C 文章标签： keylogger
Linux 同时被 2 个专栏收录
124 篇文章 1 订阅
订阅专栏
C
33 篇文章 0 订阅
订阅专栏

原文： http://samvh.nl/security/writing-a-linux-keylogger-in-c/


Writing a Linux Keylogger in C

Today we are going to write a Linux keylogger in C. We can do this by reading from the keyboard device under /dev. This means you have to have root rights.

Warning: this keylogger is meant only for educational purposes. I’m not responsible for any damage made by this program.

Reading from the device

First of all, we need to know which /dev-ice we need to use, this is different for each keyboard. I know already that it is under /dev/input. In that folder we have multiple devices starting with “event”. We could open each device with something likecat  and look if something happens after hitting a key. But, this can be done much easier. In the file /proc/bus/input/devices are all eventX listed. So we can read this file with cat  and search for the keyboard. An item in the /proc/bus/input/devices file looks like this:

The thirth word after “Handlers=” is the eventX-device of the device. My keyboard is event3, so I will be using that in this blogpost. If we read from /dev/input/event3 (with root rights ;)), we will see a lot of scancodes.  In the C program, we will be translating those scancodes to ASCII.

 

The program

We need the following imports:

After that, we define the constant UK, so we don’t have to write “[Unknown]” everytime a scancode doesn’t have a key on the keyboard-layout:

Then we make a keyboard layout, like the following:

Also, we make a keyboard layout for whenever the capslock key is pressed and whenever the shift key is pressed:

Then we define a main function, with some variables and a while loop.

O_RDONLY means we can only read from the file. input_event is a struct defined in input.h:

 

In the while loop, we will read from fd and store it in ev. When the ev.type is equal to 1, two if statements will check if the key was pressed or released and print the key.

ev.code is the scancode in decimals.

The program will now work, but shift and capslock won’t make keys uppercase or something like. So, we check in the first if statement if the pressed key is capslock. If it is, we’ll check ifcaps_pressed is already 1, if so we set it to 0. Otherwise we set it to 1.  We also check if shift has been pressed, if that is the case, we setshift_pressed to 1. Whenever shift has been released, we set it to 0. The scancode for [RShift], [LShift] and [CapsLock] are 54, 42 and 58,respectively. Also each time when a key is released, we print a newline onto the screen. You can find the final code in my GitHub repository: https://github.com/samvhb/Linux-Keylogger.

Next

You can make a scancode-list, when CTRL is hold, so you can log keys like CTRL+C, CTRL+S. Also you can store the keys in a logfile.

If you have questions, suggestions or anything like that, make sure to comment :).

 

– Sam

 

 

Posted on August 29, 2015AuthoradminCategoriesSecurityTagsc, keylogger, linux,malware, programming, security, unix,virus




===================Window keylogger=======================

原文： http://www.haseeb-ahmed.com/2015/02/global-windows-hook-in-visual-c/

Using global windows hook in Visual C++

by Haseeb Ahmed | Feb 20, 2015 | Windows Development | 0 comments

Using global windows hook in Visual C++

Since you are here, you probably know what is a Windows hook and what can it be used for. I say this because, this isn’t exactly a beginner topic. Nonetheless, lets get ourselves familiar with hooks before we get started. Here is how the MSDN documentation describes a Windows hook:

A hook is a mechanism by which an application can intercept events, such as messages, mouse actions, and keystrokes. A function that intercepts a particular type of event is known as a hook procedure.

For the sake of simplicity, you can think of hooks as Windows’ global events and hook procedures as your event handlers for them. Many might disagree with my analogy and i do agree that its not the best but still, it gets the job done.

Before we can implement a Windows hook, you need to make sure that you have at least some basic understanding of the C++ programming language. If you don’t, i would recommend you go and checkout this free course at the Microsoft Virtual Academy before you continue any further.

How-to implement Windows hook

Now that we have the brief introduction and prerequisites out of our way, we should start with the implementation of hooks using C++. I would be using Microsoft’s Visual Studio 2013 but this code should run in pretty much any C++ IDE. Also, I would only be implementing the WH_KEYBOARD_LL hook through which we can get the low-level keyboard input events. This is mainly due to two reasons:

  • WH_KEYBOARD_LL hook is easy to implement and understand.
  • Other types of hooks have almost a similar implementation.

Start off using an empty console project and add the following lines of code to your Source.cpp file.

We have included iostream and Windows.h files into our program. You probably know what iostream is for, Windows.h file has the code required to install and uninstall a Windows hook. Pragma pre-processor directive tells the compiler that the user32.lib file will be required as well.

While statement on the line #7 puts the program in a message loop and makes sure that the program stays alive. We need this because the hooks are uninstalled once you program exits so without this while statement, our program will immediately close after running.

Now, add the following lines of code just above the declaration of our program’s main method.

First, we declare and initialize a variable of the type HHOOK. This actually is a pointer that gets set once the hook has been installed. MyLowLevelKeyboardProc() is the event handler (or the hook procedure) that runs once the respected Windows’ global event (or hook) is triggered. CallNextHookEx() returns the next hook procedure in the queue, for execution. If you don’t do this, other application’s hook procedures queued after yours won’t work. This might cause other applications to behave irregularly. You can read in more detail about LowLevelKeyboardProc() and it’s arguments in the MSDN documentation.

We have done most of the work by now. The basic structure of our  C++ program is ready. We have defined the LowLevelKeyboardProc() hook procedure. Now all that is left is to install the hook so that we can start receiving our low-level keyboard events.

To do that, add the following code just above the while loop, into the main function of your program.

What this does is, it installs our MyLowLevelKeyBoardProc() into the WH_KEYBOARD_LL hook and return a pointer to hHook. If SetWindowsHookEx() fails due to some reason, hHook is null and the error is displayed in the console window.

Your complete program should now look something like this.

That’s it. Run your program (Ctrl + F5), click on the task-bar and press some keys from the keyboard. You’ll should see something like the screenshot below.

Using global windows hook in Visual C++

In my experience, those are all the basics you need to know about how to implement hooks in C++. Still, if you have any further questions please feel free to ask. I’ll try my level best to answer them.

You can download the final source code from my Codeplex project. Meanwhile, also do checkout some more recommend resources given below.


##############阅读笔记################

Linux上实现keylogger原理是读取设备文件 /dev/xxxx

Window上通过Hooks

通过监听系统范围的键盘时间，或鼠标点击时间，可以实现一些有意思的事情。

比如用户双击了一个*.doc文件，我们可以先对这个文件进行一些处理，再给用户打开。


春泥面包
关注
  • 0
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
专栏目录
Linux-keylogger:在Linux中配置键盘记录程序
05-11
键盘记录器 在Linux中配置键盘记录程序 在Linux机器上下载和配置keykogger的脚本 开始确认系统的电子邮件服务器： 要使用ssmtp配置电子邮件服务器，请运行smtpserver.sh脚本 授予执行权限： chmod + x smtpserver.sh 运行脚本： ./smtpserver.sh 按照脚本中的指示进行操作。 要使用postfix配置电子邮件服务器，请运行postfixserver.sh脚本 授予执行权限： chmod + x postfixserver.sh 运行脚本： ./postfixserver.sh 按照脚本中的指示进行操作。 开始执行keylogs.sh脚本。 授予执行权限： chmod + x keylogs.sh 运行脚本： ./keylogs.sh
KatroLogger:Linux系统的KeyLogger
03-11
KatroLogger KeyLogger for Linux Systems 特征 在GUI系统或CLI上运行 通过电子邮件发送数据 启动时自动运行 屏幕截图 依存关系 wget https://ufpr.dl.sourceforge.net/project/libquickmail/libquickmail-0.1.29.tar.xz tar -xvf libquickmail-0.1.29.tar.xz ./autogen.sh && ./configure && make && make install 编译中 ./configure make make install 用法 katrologger --output /path/file 通过电子邮件发送数据 争论 描述 --smtp-status 发送电子邮件服务的状态 --smtps-url SMTPS服务器 --s
基于内核的Linux键盘记录器 2.6.24 x86
01-30
基于内核的Linux键盘记录器 内核2.6.24 x86 ，完整源代码，供参考学习
linux 键盘记录,Linux键盘记录sh2log keylogger notes
weixin_39858124的博客
05-15 195
make linuxmake freebsdmake openbsdmake cygwinmake sunosmake irixmake hpuxmake aixmake osf如下:[root@Centos sh2log-1.0]# make linuxgcc -g -W -Wall -o sh2log rc4.c sha1.c sh2log.c -lutil -DLINUXgcc -g -W ...
Linux上基于 Golang 实现 KeyLogger 按键记录
Myth的博客
09-08 1401
项目主页 实现原理： 记录每次按键 键值和时间戳， 记录每天累计键输入次数 报表计算规则： 获取时间段内 Top 值的键值，得到需要展示的键值 获取时间段内每天 键值 输入次数 热力图 一周内每个小时的输入次数 ...
A simple keylogger for Windows, Linux and Mac.zip
最新发布
06-22
Linux是一套免费使用和自由传播的类Unix操作系统，由林纳斯·托瓦兹于1991年首次发布。 Linux不仅是一个强大的操作系统，也是一个庞大的技术生态系统，涵盖了从服务器到个人电脑的各种应用场景。同时，它的开源特性...
LKL Linux KeyLogger-开源
05-01
Linux KeyLogger，简称LKL，是一个专为x86架构的Linux系统设计的开源用户空间键盘记录器。这个工具的设计目的是捕获并记录通过硬件键盘端口0x60输入的所有按键信息。在信息技术领域，键盘记录器通常用于监控和记录...
keylogger 源码-包含Linux、Mac、window 三个平台
09-29
在这个目录下，你可能会找到分别针对Linux、Mac和Windows的源代码文件夹，每个文件夹可能包含特定于该平台的C、C++或Python等编程语言的源代码文件。这些源代码会详细解释如何捕获系统级的键盘事件，如何存储这些...
How to Make Your Own Keylogger in C++ Programming Language azw3
09-23
How to Make Your Own Keylogger in C++ Programming Language 英文azw3 本资源转载自网络，如有侵权，请联系上传者或csdn删除 本资源转载自网络，如有侵权，请联系上传者或csdn删除
Linux kernel key logger:用于记录击键的 Linux 内核模块-开源
07-22
一个 Linux 内核模块，用于嗅探击键并将其保存在内存缓冲区中，以便从 /dev/klg 进一步读取
Keylogger:适用于Windows，Linux和Mac的简单键盘记录器-开源
05-26
键盘记录器是适用于Windows，Mac和Linux的简单按键记录器。 击键记录器或击键记录器基本上是一个记录击键并将其保存在本地计算机上的日志文件中的程序。 该键盘记录器虽然简单无味，但效果出色，可用于许多方面。 您可以使用它来跟踪关键动作，并确保不在时没有人使用计算机，或者将其用于自我分析。 在企业和办公室中，它可以用来监视员工的活动； 在学校中，它可以跟踪击键并记录被禁止的单词。
[sh2log]Linux键盘记录 keylogger notes
ace_yijianghui的专栏
04-11 1854
不仅可以记录到击键信息，而且包括终端下的输出信息 123456789101112[root@Centos log]# wget http://www.i0day.com/exp/Linux/sh2log-1.0.tgz--2013-01-07 05:16:56-- http://www.i0day.com/exp/Linux/sh2log-1.0.tgzResolving packets
Keylogger in C++
weixin_34168700的博客
04-13 122
The org is the link：[url]http://www.darkmindz.com/codebase/keylogger-in-c-num283.html[/url] // Coded By Cyberwire//              Compiled in Dev C++//                                 Takes up 99 CPU ...
linux键盘是哪个文件,【技术分享】一款Linux下的键盘记录软件分析
weixin_28678517的博客
04-28 353
预估稿费：160RMB(不服你也来投稿啊！)投稿方式：发送邮件至linwei#360.cn，或登陆网页版在线投稿前言当前，Linux恶意软件正在逐渐流行起来了。近几年，已经有好几起重大安全事件中所涉及的Linux后门都是从Windows系统移植过来的。在研究Odinaff报告中的Windows KLRD键盘记录软件的过程中，我们发现了几个新的键盘记录软件。在本文中，我们讨论的焦点是MiKey，这是...
基于内核的linux键盘纪录器
lucien的博客
04-28 3076
1 - 介绍 2 - linux的keyboard驱动是如何工作的 3 - 基于内核的键盘纪录的原理    3.1 - 中断句柄    3.2 - 函数劫持        3.2.1 - 劫持handle_scancode        3.2.2 - 劫持put_queue        3.2.3 - 劫持receive_buf        3.2.4 - 劫持tty_rea
linux下键盘记录程序,书写基于内核的linux键盘纪录器（三）
weixin_34603379的博客
05-01 599
3 - 基于内核的键盘纪录器的实现步骤我们论述两种实现方法,一个是书写我们自己的键盘中断句柄,另一个是劫持输入进程函数.----[ 3.1 - 中断句柄要纪录击键信息,我们就要利用我们自己的键盘中断。在Intel体系下，控制键盘的IRQ值是1。当接受到一个键盘中断时，我们的键盘中断器会读取scancode和键盘的状态。读写键盘事件都是通过0x60端口(键盘数据注册器)和0x64(键盘状态注册器)来...
某Keylogger分析
ProgrammingRing的专栏
06-26 1704
基本信息   报告名称：某Keylogger分析  报告更新日期：2013/06/25                                              样本发现日期：未知                                              样本类型：键盘记录
KeyLogger
windworst的专栏
10-08 865
// Keyboard.cpp : Defines the entry point for the DLL application. // //#include "stdafx.h" #include #include HINSTANCE g_hInstance = NULL; HHOOK Kg_hHook = NULL; char Buff[10]= {0}; #define DEBUG_LOG
keylogger.py
07-28
很抱歉，我无法回答关于keylogger.py的问题。 #### 引用[.reference_title] - *1* [windows python keylogger](https://blog.csdn.net/cnbird2008/article/details/4419250)[target="_blank" data-report-click={...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值