16

I was trying to capture keyboard events. e.g. I want to drill down a keylogger from the scratch. After 2 hours of fighting I found the following

neel@pc1$ ls -l /dev/input/by-id
lrwxrwxrwx 1 root root 9 2010-05-05 21:33 usb-Plus_More_Enterprise_LTD._USB-compliant_keyboard-event-kbd -> ../event1
lrwxrwxrwx 1 root root 9 2010-05-05 21:33 usb-Plus_More_Enterprise_LTD._USB-compliant_keyboard-event-mouse -> ../event2
lrwxrwxrwx 1 root root 9 2010-05-05 21:33 usb-Plus_More_Enterprise_LTD._USB-compliant_keyboard-mouse -> ../mouse1

But when I tried to 

neel@pc1$ sudo cat /dev/input/usb-Plus_More_Enterprise_LTD._USB-compliant_keyboard-event-kbd

It yields nothing THERE WAS NO OUTPUT

after a bit more searching Now I am thinking probabbly something in Xorg blocks it.

So Any more Information ?? and atthe end of the say how can I read the input from that file ?? or is there any other way of capturing keyboard events ??

Improve this question

6 Answers 6

Reset to default
15

Hello,

I was recently trying to accomplish something similar.

Have a look at the logkeys project:

http://code.google.com/p/logkeys/

If you download the source code, and have a look at the logkeys.cc file, you will find one method how to auto-detect which /dev/input/event is used by your keyboard. This will let you read raw scan codes from the keyboard, regardless of which program currently has focus. The logkeys program also shows how to translate the scan codes into characters, and other useful tricks.

Hope this helps,

Markus.

Improve this answer
Sign up to request clarification or add additional context in comments.

1 Comment

though the post is old , i want something related to it , if two keyboards are connected how to know from where the input came , in short i want to print the sourceId when any key is pressed ? any leads
15

A simple grep operation on the /proc/bus/input/devices file will yield all the keyboards plugged into the machine:

 grep -E  'Handlers|EV=' /proc/bus/input/devices | \
 grep -B1 'EV=120013' | \
 grep -Eo 'event[0-9]+'

Where EV=120013 is the bitmask for events supported by the device. As explained here.

This is the way it is implemented in logkeys

Improve this answer

1 Comment

Awesome. Returned event2 for me, and I was able to see data going through on there.
10

You are reading the wrong device. Either try all /dev/input/event* or look in /var/log/Xorg.0.log for which device is used for your keyboard.

Improve this answer

3 Comments

keyboard is /dev/input/event4 on my fedora box
keyboard is /dev/input/event3, also symlinked as /dev/input/by-path/platform-i8042-serio-0-event-kbd on ubuntu(9.10)
Ya tested on all all 6 event files. only event5 was responding and writing some shits on beeps. Latter I found Its speaker However probabbly you haven't noticed. I am using USB Keyboard !!!!! -- EDIT -- (**) Plus More Enterprise LTD. USB-compliant keyboard: Device: "/dev/input/event2" But no output in sudo cat /dev/input/event2
10

I'd recommend using the evtest application, it lists all your input devices and allows you monitor their events.

Improve this answer

Comments

6

Thank you for the clue about ls -l /dev/input/by-id it helped me a lot !.

defenderdz@defenderdz-pc:~$ ls -l /dev/input/by-id | grep kbd
lrwxrwxrwx 1 root root  9 nov.  28 14:04 usb-Logitech_USB_Receiver-event-kbd -> ../event7
lrwxrwxrwx 1 root root 10 nov.  29 00:33 usb-NOVATEK_USB_Keyboard-event-kbd -> ../event26
lrwxrwxrwx 1 root root  9 nov.  28 14:04 usb-SONiX_USB_DEVICE-event-kbd -> ../event3
defenderdz@defenderdz-pc:~$

'kbd' is the suffix used for keyboard devices (I have 3 keyboards connected).

Your error is that you're accessing the wrong folder :

/dev/input/ instead of /dev/input/by-id

In my example the correct path is : 

defenderdz@defenderdz-pc:~$ sudo cat /dev/input/by-id/usb-NOVATEK_USB_Keyboard-event-kbd
���]�I���]�I���]�Ia���]�b���]�b���]�b���]�����]�����]��s���]����]����]����]�>
���]�>
 ���]�>
d���]�8
       ���]�8
              ���]�8
                    ���]�����]�����]��s���]H|���]H|���]H|���]�����]�� ���]��d���]Ǵ���]Ǵ ���]Ǵ

In your case 

neel@pc1$ sudo cat /dev/input/by-id/usb-Plus_More_Enterprise_LTD._USB-compliant_keyboard-event-kbd

I'm not saying that it's the best solution but it works fine for me. You can even create an automatic detection of the keyboard by parsing the ls result ...

Improve this answer

2 Comments

Aha. It was silly mistake then. Its a 9 year old post. And I don't remember what I was trying to do then. Thanks for pointing that out.
hhh, I know, it's more for those who will face this issue (like me), good to see that you're still active in the forum ^^.
0

For people coming here to find a way to debug their keyboard-issues: Try using the terminal command xev. It displays all the input events your peripherals (keyboard and mouse) emit. Might also prove useful for building a keylogger.

Improve this answer

2 Comments

As it’s currently written, your answer is unclear. Please edit to add additional details that will help others understand how this addresses the question asked. You can find more information on how to write good answers in the help center.
In my tests it haven't captured keyboard events in windows other than that created by the app itself ( the docu says it should ).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.