Search code examples
linuxlinux-kernellinux-device-driver

Linux keyboard event capturing /dev/inputX

I was trying to capture keyboard events. e.g. I want to drill down a keylogger from the scratch. After 2 hours of fighting I found the following

neel@pc1$ ls -l /dev/input/by-id
lrwxrwxrwx 1 root root 9 2010-05-05 21:33 usb-Plus_More_Enterprise_LTD._USB-compliant_keyboard-event-kbd -> ../event1
lrwxrwxrwx 1 root root 9 2010-05-05 21:33 usb-Plus_More_Enterprise_LTD._USB-compliant_keyboard-event-mouse -> ../event2
lrwxrwxrwx 1 root root 9 2010-05-05 21:33 usb-Plus_More_Enterprise_LTD._USB-compliant_keyboard-mouse -> ../mouse1

But when I tried to 

neel@pc1$ sudo cat /dev/input/usb-Plus_More_Enterprise_LTD._USB-compliant_keyboard-event-kbd

It yields nothing THERE WAS NO OUTPUT

after a bit more searching Now I am thinking probabbly something in Xorg blocks it.

So Any more Information ?? and atthe end of the say how can I read the input from that file ?? or is there any other way of capturing keyboard events ??

Solution

  • Thank you for the clue about ls -l /dev/input/by-id it helped me a lot !.

    defenderdz@defenderdz-pc:~$ ls -l /dev/input/by-id | grep kbd
lrwxrwxrwx 1 root root  9 nov.  28 14:04 usb-Logitech_USB_Receiver-event-kbd -> ../event7
lrwxrwxrwx 1 root root 10 nov.  29 00:33 usb-NOVATEK_USB_Keyboard-event-kbd -> ../event26
lrwxrwxrwx 1 root root  9 nov.  28 14:04 usb-SONiX_USB_DEVICE-event-kbd -> ../event3
defenderdz@defenderdz-pc:~$

    'kbd' is the suffix used for keyboard devices (I have 3 keyboards connected).

    Your error is that you're accessing the wrong folder :

    /dev/input/ instead of /dev/input/by-id

    In my example the correct path is : 

    defenderdz@defenderdz-pc:~$ sudo cat /dev/input/by-id/usb-NOVATEK_USB_Keyboard-event-kbd
���]�I���]�I���]�Ia���]�b���]�b���]�b���]�����]�����]��s���]����]����]����]�>
���]�>
 ���]�>
d���]�8
       ���]�8
              ���]�8
                    ���]�����]�����]��s���]H|���]H|���]H|���]�����]�� ���]��d���]Ǵ���]Ǵ ���]Ǵ

    In your case 

    neel@pc1$ sudo cat /dev/input/by-id/usb-Plus_More_Enterprise_LTD._USB-compliant_keyboard-event-kbd

    I'm not saying that it's the best solution but it works fine for me. You can even create an automatic detection of the keyboard by parsing the ls result ...