objective-see / ReiKey

Malware and other applications may install persistent keyboard "event taps" to intercept your keystrokes. ReiKey can scan, detect, and monitor for such taps!
GNU General Public License v3.0
326 stars 36 forks source link

Changed bitwise logic for keyboard event taps #13

Open kaiser37 opened 4 years ago

kaiser37 commented 4 years ago

ReiKey does not find or detect keyboard event taps that are monitoring only a keydown event or only a keyup event. Based on the bitwise logic, it only finds taps that are monitoring at least both of these settings.

I know a key press is technically made up of both a keydown event and a keyup event, but malware could gather similar data by only monitoring keyup events and ReiKey would not detect it. I think ReiKey should still present these taps to the user, even if it would be a crappy keylogger.

The bitmask is defined here: https://github.com/objective-see/ReiKey/blob/master/shared/EventTaps.m#L38

And the bitmask is used here: https://github.com/objective-see/ReiKey/blob/master/shared/EventTaps.m#L83

I took a shot at changing the logic.