• 设为首页
  • 点击收藏
  • 手机版
    手机扫一扫访问
    迪恩网络手机版
  • 关注官方公众号
    微信扫一扫关注
    迪恩网络公众号

jarun/spy: Linux kernel mode debugfs keylogger

原作者: [db:作者] 来自: 网络 收藏 邀请

开源软件名称(OpenSource Name):

jarun/spy

开源软件地址(OpenSource Url):

https://github.com/jarun/spy

开源编程语言(OpenSource Language):

C 92.6%

开源软件介绍(OpenSource Introduction):

spy

A Linux kernel module to grab keys pressed in the keyboard, or a keylogger.

It's also an academic project for devs willing to learn Linux kernel module programming, with extensive comments, checkpatch.pl scanned code, standards-compliant Makefile and DKMS support.

spy was initially written for the US keyboard (and conforming laptops). By default it shows human-readable strings for the keys pressed. Optionally, the keycode shift_mask pair can be printed in hex or decimal. You can lookup the keycodes in /usr/include/linux/input-event-codes.h.

The keypress logs are recorded in debugfs as long as the module is loaded. Only root or sudoers can read the log. The module name has been camouflaged to blend-in with other kernel modules.

You can, however, execute a script at shutdown or reboot (the procedure would be distro-specific) to save the keys to a file.

DISCLAIMER: spy is intended to track your own devices and NOT to trespass on others. The author is not responsible for any unethical application.

Table of contents

Compilation

Build

Clone the repository and run:

# make

Note that you need to have the linux kernel headers installed for your running kernel version.

To insert the module into the kernel, run:

# insmod kisni.ko
OR
# make load

To unload the module (and clear the logs), run:

# rmmod kisni

DKMS support

If you have DKMS installed, you can install spy in such a way that it survives kernel upgrades. It is recommended to remove older versions of spy by running dkms remove -m kisni -v OLDVERSION --all as root. To install the new version, run:

# make -f Makefile.dkms

To uninstall it, run:

# make -f Makefile.dkms uninstall

Usage

To view the pressed keys, run:

# cat /sys/kernel/debug/kisni/keys
modinfo kisni.ko
cat /sys/kernel/debug/kisni/keys
#

To log generic hex keycodes in the format keycode shift_mask, run:

# insmod kisni.ko codes=1
// Type something
# cat /sys/kernel/debug/kisni/keys
23 0
12 0
26 0
26 0
18 0
39 0
2a 0
2a 1
2a 1
11 1
18 0
13 0
26 0
20 0
2a 0
2a 1
2a 1
2 1
1c 0
1f 0
16 0
20 0
18 0
39 0
2e 0
1e 0
14 0
6a 0
1c 0

To log the keycodes in decimal, run:

# insmod kisni.ko codes=2

To check the module details:

# modinfo kisni.ko
filename:       kisni.ko
description:    Sniff and log keys pressed in the system to debugfs
version:        1.8
author:         Arun Prakash Jana <[email protected]>
license:        GPL v2
srcversion:     F62F351D06A999293307C20
depends:
retpoline:      Y
name:           kisni
vermagic:       5.4.0-48-generic SMP mod_unload
parm:           codes:log format (0:US keys (default), 1:hex keycodes, 2:dec keycodes) (int)

License

License

Developer

Copyright © 2015 Arun Prakash Jana

Links




鲜花

握手

雷人

路过

鸡蛋
该文章已有0人参与评论

请发表评论

全部评论

专题导读
上一篇:
hisilicon/linux-hisi发布时间:2022-08-16
下一篇:
clearlinux/dockerfiles: Clear Linux-based Docker containers发布时间:2022-08-16
热门推荐
阅读排行榜

扫描微信二维码

查看手机版网站

随时了解更新最新资讯

139-2527-9053

在线客服(服务时间 9:00~18:00)

在线QQ客服
地址:深圳市南山区西丽大学城创智工业园
电邮:jeky_zhao#qq.com
移动电话:139-2527-9053

Powered by 互联科技 X3.4© 2001-2213 极客世界.|Sitemap