16

I was trying to capture keyboard events. e.g. I want to drill down a keylogger from the scratch. After 2 hours of fighting I found the following

neel@pc1$ ls -l /dev/input/by-id
lrwxrwxrwx 1 root root 9 2010-05-05 21:33 usb-Plus_More_Enterprise_LTD._USB-compliant_keyboard-event-kbd -> ../event1
lrwxrwxrwx 1 root root 9 2010-05-05 21:33 usb-Plus_More_Enterprise_LTD._USB-compliant_keyboard-event-mouse -> ../event2
lrwxrwxrwx 1 root root 9 2010-05-05 21:33 usb-Plus_More_Enterprise_LTD._USB-compliant_keyboard-mouse -> ../mouse1

But when I tried to 

neel@pc1$ sudo cat /dev/input/usb-Plus_More_Enterprise_LTD._USB-compliant_keyboard-event-kbd

It yields nothing THERE WAS NO OUTPUT

after a bit more searching Now I am thinking probabbly something in Xorg blocks it.

So Any more Information ?? and atthe end of the say how can I read the input from that file ?? or is there any other way of capturing keyboard events ??

Neel Basu
  • 12,638
  • 12
  • 82
  • 146

6 Answers6

15

A simple grep operation on the /proc/bus/input/devices file will yield all the keyboards plugged into the machine:

 grep -E  'Handlers|EV=' /proc/bus/input/devices | \
 grep -B1 'EV=120013' | \
 grep -Eo 'event[0-9]+'

Where EV=120013 is the bitmask for events supported by the device. As explained here.

This is the way it is implemented in logkeys

Community
  • 1
  • 1
Rage5quid
  • 151
  • 1
  • 5
  • Awesome. Returned event2 for me, and I was able to see data going through on there. – sudo May 31 '16 at 18:49
15

Hello,

I was recently trying to accomplish something similar.

Have a look at the logkeys project:

http://code.google.com/p/logkeys/

If you download the source code, and have a look at the logkeys.cc file, you will find one method how to auto-detect which /dev/input/event is used by your keyboard. This will let you read raw scan codes from the keyboard, regardless of which program currently has focus. The logkeys program also shows how to translate the scan codes into characters, and other useful tricks.

Hope this helps,

Markus.

msvilans
  • 151
  • 1
  • 3
  • 1
    though the post is old , i want something related to it , if two keyboards are connected how to know from where the input came , in short i want to print the sourceId when any key is pressed ? any leads – r4jiv007 May 11 '16 at 11:34
10

I'd recommend using the evtest application, it lists all your input devices and allows you monitor their events.

madhat1
  • 676
  • 9
  • 15
10

You are reading the wrong device. Either try all /dev/input/event* or look in /var/log/Xorg.0.log for which device is used for your keyboard.

Florian Diesch
  • 1,025
  • 10
  • 16
  • keyboard is /dev/input/event4 on my fedora box – zdav May 05 '10 at 18:21
  • keyboard is /dev/input/event3, also symlinked as /dev/input/by-path/platform-i8042-serio-0-event-kbd on ubuntu(9.10) – phoenix24 May 05 '10 at 18:27
  • 1
    Ya tested on all all 6 event files. only event5 was responding and writing some shits on beeps. Latter I found Its speaker However probabbly you haven't noticed. I am using USB Keyboard !!!!! -- EDIT -- `(**) Plus More Enterprise LTD. USB-compliant keyboard: Device: "/dev/input/event2"` But no output in `sudo cat /dev/input/event2` – Neel Basu May 05 '10 at 18:59
5

Thank you for the clue about ls -l /dev/input/by-id it helped me a lot !.

defenderdz@defenderdz-pc:~$ ls -l /dev/input/by-id | grep kbd
lrwxrwxrwx 1 root root  9 nov.  28 14:04 usb-Logitech_USB_Receiver-event-kbd -> ../event7
lrwxrwxrwx 1 root root 10 nov.  29 00:33 usb-NOVATEK_USB_Keyboard-event-kbd -> ../event26
lrwxrwxrwx 1 root root  9 nov.  28 14:04 usb-SONiX_USB_DEVICE-event-kbd -> ../event3
defenderdz@defenderdz-pc:~$

'kbd' is the suffix used for keyboard devices (I have 3 keyboards connected).

Your error is that you're accessing the wrong folder :

/dev/input/ instead of /dev/input/by-id

In my example the correct path is : 

defenderdz@defenderdz-pc:~$ sudo cat /dev/input/by-id/usb-NOVATEK_USB_Keyboard-event-kbd
���]�I���]�I���]�Ia���]�b���]�b���]�b���]�����]�����]��s���]����]����]����]�>
���]�>
 ���]�>
d���]�8
       ���]�8
              ���]�8
                    ���]�����]�����]��s���]H|���]H|���]H|���]�����]�� ���]��d���]Ǵ���]Ǵ ���]Ǵ

In your case 

neel@pc1$ sudo cat /dev/input/by-id/usb-Plus_More_Enterprise_LTD._USB-compliant_keyboard-event-kbd

I'm not saying that it's the best solution but it works fine for me. You can even create an automatic detection of the keyboard by parsing the ls result ...

Neel Basu
  • 12,638
  • 12
  • 82
  • 146
DzDev
  • 123
  • 1
  • 8
  • Aha. It was silly mistake then. Its a 9 year old post. And I don't remember what I was trying to do then. Thanks for pointing that out. – Neel Basu Nov 29 '19 at 09:59
  • 1
    hhh, I know, it's more for those who will face this issue (like me), good to see that you're still active in the forum ^^. – DzDev Dec 02 '19 at 14:53
0

For people coming here to find a way to debug their keyboard-issues: Try using the terminal command xev. It displays all the input events your peripherals (keyboard and mouse) emit. Might also prove useful for building a keylogger.

user2139393
  • 1
  • 1
    As it’s currently written, your answer is unclear. Please [edit] to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – MD. RAKIB HASAN Dec 21 '21 at 12:45
  • In my tests it haven't captured keyboard events in windows other than that created by the app itself ( the docu says it should ). – Claudio May 05 '23 at 01:13