Sunday, September 23. 2007
X11 Keylogger w/o root-permissions
Most keylogging solutions deserve to be called as root-user; Userspace-Loggers as well as Kernelspace-Loggers. This simple piece of code shows you how you can use X11 to get a nice workaround for keylogging X-sessions.There are generally two types of keyloggers under Linux. Firstly, the kernelspace keyloggers. Writing a kernelspace logger isn't that easy, and deserves skills in writing kernel code. Morover, running a kernel module still needs root access to the machine.
The second type of loggers are userspace keyloggers. Normally, the logging is done via io-Calls and catching interrupts; which can also be only done as root.
That's the reason why I tried to find a way to catch keys without root access and found a wonderful lovely hack (or "workaround"), making fun out of the mighty Xlib.
For some reason, the XGrabKey/XGrabKeyboard functions won't result in more than BadAccess Errors of Xorg. Fortunately, Xlib provides a function called XQueryKeymap(), which puts the whole keyboard status into a large 32-Byte character vector.
The code basically reruns the XQueryKeymap call infinitely and checks if changes have been recognized; if this is the case, check which key has been pressed, get the keycode, get the keysym and print out a human-readable representation of the key.
You may browse the source here.
