4

I am currently creating a c program that counts all of the keys I press in a day and sorts the key types by amount, so I can tell which ones I press most often. It was more of a side project than anything else but I have become annoyed with the fact that my program doesn't seem to be able to intercept any input to password fields. I suppose this is a good thing, but I have been spending hours looking at documentation and trying to figure how to do this. I am not trying to create any sort of malicious software. Is there a way around this? My program is running as root. I am using the ApplicationServices framework and CGEventRef and the CGEventTapCreate funcion. Should I be using a different framework or struct? Also, is there a difference between kCGHIDEventTap, kCGSessionEventTap, and kCGAnnotatedSessionEventTap? I have tried using each of them and it does not seem to make a difference in my program.

I am running this on OS X 10.9

UPDATE Apparently I cannot capture keystrokes going to terminal either, which is where I spend most of my time on my laptop. This is a problem.

735Tesla
  • 3,162
  • 4
  • 34
  • 57
  • You may need to use `IOKit` – jamespick Jan 25 '14 at 21:18
  • 2
    Have you seen this article: http://www.cocoabuilder.com/archive/cocoa/220055-keystroke-logger-for-mac-os.html ? – jamespick Jan 25 '14 at 21:21
  • @InsertNameHere I am not actually trying to create a key logger, just increment a variable each time a certain key is pressed. The article is still relevant but they do not seem to provide a solution – 735Tesla Jan 25 '14 at 21:25
  • That thread makes it clear that CGEventTapCreate is the right way to go to log keys generally, but password fields use secure input and so you won't be able to get that input using an event tap. You'll have to use a kernel extension, I'd guess, but having never built a kernel extension I'm not sure what API you'd use. – AriX Jan 25 '14 at 22:47
  • @735Tesla , so what your saying is... you want to make a malicious keylogger... hmm... – elliotanderson Jan 26 '14 at 06:13
  • @elliotanderson that is actually quite the opposite of what I am saying. Read the question. – 735Tesla Jan 26 '14 at 13:52

1 Answers1

2

What you want is fairly complicated and requires a kernel extension. The interprocess communication is also not trivial. Take a look at logKext, specifically logKext.cpp. That project actually logs the keystrokes to an encrypted file. You should be able to pull everything you need from it.

Bill
  • 1,588
  • 12
  • 21