BackupGGCode / logkeys

a GNU/Linux keylogger that works!
Other
0 stars 0 forks source link

logkeys and usb keyboard #82

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
What steps will reproduce the problem?
1. Install Ubuntu 11.10
2. Install logkeys via apt
3. Install an USB keyboard
4. Run sudo logkeys -s

What is the expected output?
Recorded keys on the log.

What do you see instead?
Error about keyboard not being detected

What version of the product are you using (`logkeys --help`)?
0.1.0

On what operating system?
Ubuntu 11.10

Please provide any additional information below.
If applicable, also attach contents of /proc/bus/input/devices, the output
of command `dumpkeys -n > dumpkeys.output`, and any
other relevant files.

This device worked for me:
/dev/input/by-path/pci-0000\:00\:1d.3-usb-0\:1\:1.0-event-kbd

Original issue reported on code.google.com by vladimir...@gmail.com on 2 Feb 2012 at 9:27

Attachments:

GoogleCodeExporter commented 9 years ago
yes, 0.1.0 is kind of old. please checkout current revision (0.1.2b) from SVN 
(0.1.1 download won't work).

Original comment by kernc...@gmail.com on 3 Feb 2012 at 12:50

GoogleCodeExporter commented 9 years ago
Is there any .deb for it?, I don't mind compiling but prefer to avoid it when 
possible.

Original comment by vladimir...@gmail.com on 3 Feb 2012 at 3:43

GoogleCodeExporter commented 9 years ago
no deb yet, sorry. the compilation only takes a minute and pulls no 
non-standard dependencies.

Original comment by kernc...@gmail.com on 3 Feb 2012 at 8:45

GoogleCodeExporter commented 9 years ago
svn checkout http://logkeys.googlecode.com/svn/ logkeys-read-only

svn: The OPTIONS response did not include the requested 
activity-collection-set; this often means that the URL is not WebDAV-enabled

-------------

That's the error I got while trying to get the logkeys source from SVN. Has 
anything change related to that info?.

BTW, thanks for the app and the help.

Original comment by vladimir...@gmail.com on 3 Feb 2012 at 8:56

GoogleCodeExporter commented 9 years ago
please try:
$ svn checkout https://logkeys.googlecode.com/svn/trunk logkeys

I don't know. it seems something on Google's end. or yours. certainly not on my 
end. :-) sorry.

Original comment by kernc...@gmail.com on 6 Feb 2012 at 2:46

GoogleCodeExporter commented 9 years ago
Thank you very much, the https did the difference. Now it's up and running!.

Original comment by vladimir...@gmail.com on 6 Feb 2012 at 12:32

GoogleCodeExporter commented 9 years ago
By the way, it reports as 0.1.1a, but you mention 0.1.2b?. I compiled from 
trunk, is this version number the lastest?.

Original comment by vladimir...@gmail.com on 6 Feb 2012 at 2:34

GoogleCodeExporter commented 9 years ago
no, sorry, with --help it should report as 0.1.1b-svn, which it does for me.

Original comment by kernc...@gmail.com on 6 Feb 2012 at 7:13

GoogleCodeExporter commented 9 years ago
Maybe you have not pushed it yet because:

http://code.google.com/p/logkeys/source/browse/trunk/configure
# Generated by GNU Autoconf 2.65 for logkeys 0.1.1a.
..
PACKAGE_VERSION='0.1.1a'
PACKAGE_STRING='logkeys 0.1.1a'

But you have:

http://code.google.com/p/logkeys/source/browse/trunk/src/logkeys.cc
#ifndef  PACKAGE_VERSION
# define PACKAGE_VERSION "0.1.2"  // if PACKAGE_VERSION wasn't defined in 
<config.h>
#endif

It would be 0.1.2 but at ./configure, my config.h gets as follows:

/* Define to the version of this package. */
#define PACKAGE_VERSION "0.1.1a"

I tried to update the code by doin svn update:

$ svn update 
En la revisión 101.

------------

I think I'm only bitching about a number but I guess that there's a possibility 
that you have not pushed the full changes?

Anyway, whatever hybrid version I got it's working fine :)

Original comment by vladimir...@gmail.com on 6 Feb 2012 at 7:51

GoogleCodeExporter commented 9 years ago
ah, thanks! I did push it, but I forgot to `autoreconf`. well, done that now. 
thanks again.

cheers,

Original comment by kernc...@gmail.com on 6 Feb 2012 at 8:24

GoogleCodeExporter commented 9 years ago
LogKeys is not detecting the correct Kbd. I don't know which event is using, 
but the correct is Event #2. This is confirmed by starting logkeys without -d 
and with -d /dev/input/event2

logkeys version: 0.1.1b-svn

$ uname -r -v
2.6.38-13-generic #56-Ubuntu SMP Tue Feb 14 12:40:40 UTC 2012

$ cat /proc/bus/input/devices
I: Bus=0019 Vendor=0000 Product=0001 Version=0000
N: Name="Power Button"
P: Phys=PNP0C0C/button/input0
S: Sysfs=/devices/LNXSYSTM:00/device:00/PNP0C0C:00/input/input0
U: Uniq=
H: Handlers=kbd event0 
B: PROP=0
B: EV=3
B: KEY=100000 0 0 0

I: Bus=0019 Vendor=0000 Product=0001 Version=0000
N: Name="Power Button"
P: Phys=LNXPWRBN/button/input0
S: Sysfs=/devices/LNXSYSTM:00/LNXPWRBN:00/input/input1
U: Uniq=
H: Handlers=kbd event1 
B: PROP=0
B: EV=3
B: KEY=100000 0 0 0

I: Bus=0003 Vendor=04f3 Product=0103 Version=0110
N: Name="HID 04f3:0103"
P: Phys=usb-0000:00:1d.3-1/input0
S: Sysfs=/devices/pci0000:00/0000:00:1d.3/usb5/5-1/5-1:1.0/input/input2
U: Uniq=
H: Handlers=sysrq kbd event2 
B: PROP=0
B: EV=120013
B: KEY=10000 7 ff800000 7ff febeffdf f3cfffff ffffffff fffffffe
B: MSC=10
B: LED=7

I: Bus=0003 Vendor=04f3 Product=0103 Version=0110
N: Name="HID 04f3:0103"
P: Phys=usb-0000:00:1d.3-1/input1
S: Sysfs=/devices/pci0000:00/0000:00:1d.3/usb5/5-1/5-1:1.1/input/input3
U: Uniq=
H: Handlers=kbd event3 
B: PROP=0
B: EV=1f
B: KEY=837fff 2c3027 bf004444 0 0 1 c04 b27c000 267bfa d941dfed 9e0000 0 0 0
B: REL=40
B: ABS=1 0
B: MSC=10

I: Bus=0003 Vendor=093a Product=2510 Version=0111
N: Name="PIXART USB OPTICAL MOUSE"
P: Phys=usb-0000:00:1d.3-2/input0
S: Sysfs=/devices/pci0000:00/0000:00:1d.3/usb5/5-2/5-2:1.0/input/input4
U: Uniq=
H: Handlers=mouse0 event4 
B: PROP=0
B: EV=17
B: KEY=70000 0 0 0 0 0 0 0 0
B: REL=103
B: MSC=10

Original comment by vladimir...@gmail.com on 28 Feb 2012 at 10:15

GoogleCodeExporter commented 9 years ago
this happens with the latest version from the SVN???
weird.

can you please run the following command (it's what logkeys runs) and report 
the output:

grep -E 'Handlers|EV=' /proc/bus/input/devices | grep -B1 'EV=120013' | grep 
-Eo 'event[0-9]+'

The output should be:
event2

I have no clue why it wouldn't work.

Original comment by kernc...@gmail.com on 29 Feb 2012 at 2:45

GoogleCodeExporter commented 9 years ago
Sorry, I think my report was wrong, even with the -d event2 switch it's working 
bad.

This is the output:

2012-02-29 14:36:07-0600 > ae+cghucae+cgh1cȁ܂w܀ty +c܂ u cigiciq 
urhva+i   fy  + zwçwȁ  wȁ +h
ewzwȁnnn h+ȁ d+t hh+v+܂+ȁ ç yw hi v+eç++c + ycinnn   
whwçrei diyȁw
2012-02-29 20:59:09-0600 >  ae+cghucae+cguhucae+cgh1c

With or without -d switch. This is how I start it:
logkeys -s --no-func-keys --us-keymap -d /dev/input/event2

Starting only with "logkeys -s" produces same results.

This did not happen in 0.1.0

Original comment by vladimir...@gmail.com on 1 Mar 2012 at 8:52

GoogleCodeExporter commented 9 years ago
ok, this seems like an encoding issue. what's the output of
$ locale
?

are you sure you want US keymap? have you tried with one of the keymaps posted 
here
http://code.google.com/p/logkeys/wiki/Keymaps#Download
or built a keymap for your own key layout?
(you use a custom keymap file with --keymap (-k) switch.)

Original comment by kernc...@gmail.com on 1 Mar 2012 at 8:59

GoogleCodeExporter commented 9 years ago
~$ locale
LANG=es_SV.UTF-8
LANGUAGE=es_SV:es
LC_CTYPE="es_SV.UTF-8"
LC_NUMERIC="es_SV.UTF-8"
LC_TIME="es_SV.UTF-8"
LC_COLLATE="es_SV.UTF-8"
LC_MONETARY="es_SV.UTF-8"
LC_MESSAGES="es_SV.UTF-8"
LC_PAPER="es_SV.UTF-8"
LC_NAME="es_SV.UTF-8"
LC_ADDRESS="es_SV.UTF-8"
LC_TELEPHONE="es_SV.UTF-8"
LC_MEASUREMENT="es_SV.UTF-8"
LC_IDENTIFICATION="es_SV.UTF-8"
LC_ALL=

As I understood, logkeys without -k | -u will try and detect the correct 
setting?. Also I used to use it with the same switches before upgrading, and 
nothing has changed regarding the keyboard or hardware.

I've just downgraded to 0.1.0 from Repository, same switches, I'll report is if 
works or not.

Original comment by vladimir...@gmail.com on 1 Mar 2012 at 9:07

GoogleCodeExporter commented 9 years ago
Ok, same switches, Ver. 0.1.0:

2012-03-01 15:23:08-0600 > justin beiever

(I swear I did not write that, we're recording keys from the cashier PC to keep 
"key log" proof of ticket cancelations :)

Original comment by vladimir...@gmail.com on 1 Mar 2012 at 9:50

GoogleCodeExporter commented 9 years ago
umm, ok.
please open a new issue ('messed up characters in 0.1.1' or something like 
that) and use as a description the contents of comments #13, #15, and #16 here, 
and I will see to it.

thanks for the report.

Original comment by kernc...@gmail.com on 1 Mar 2012 at 10:03