Linux keyboard event capturing /dev/inputX

Question

I was trying to capture keyboard events. e.g. I want to drill down a keylogger from the scratch. After 2 hours of fighting I found the following

neel@pc1$ ls -l /dev/input/by-id
lrwxrwxrwx 1 root root 9 2010-05-05 21:33 usb-Plus_More_Enterprise_LTD._USB-compliant_keyboard-event-kbd -> ../event1
lrwxrwxrwx 1 root root 9 2010-05-05 21:33 usb-Plus_More_Enterprise_LTD._USB-compliant_keyboard-event-mouse -> ../event2
lrwxrwxrwx 1 root root 9 2010-05-05 21:33 usb-Plus_More_Enterprise_LTD._USB-compliant_keyboard-mouse -> ../mouse1

But when I tried to

neel@pc1$ sudo cat /dev/input/usb-Plus_More_Enterprise_LTD._USB-compliant_keyboard-event-kbd

It yields nothing THERE WAS NO OUTPUT

after a bit more searching Now I am thinking probabbly something in Xorg blocks it.

So Any more Information ?? and atthe end of the say how can I read the input from that file ?? or is there any other way of capturing keyboard events ??

Answer 1

You are reading the wrong device. Either try all /dev/input/event* or look in /var/log/Xorg.0.log for which device is used for your keyboard.

Answer 2

Hello,

I was recently trying to accomplish something similar.

Have a look at the logkeys project:

http://code.google.com/p/logkeys/

If you download the source code, and have a look at the logkeys.cc file, you will find one method how to auto-detect which /dev/input/event is used by your keyboard. This will let you read raw scan codes from the keyboard, regardless of which program currently has focus. The logkeys program also shows how to translate the scan codes into characters, and other useful tricks.

Hope this helps,

Markus.

Answer 3

A simple grep operation on the /proc/bus/input/devices file will yield all the keyboards plugged into the machine:

 grep -E  'Handlers|EV=' /proc/bus/input/devices | \
 grep -B1 'EV=120013' | \
 grep -Eo 'event[0-9]+'

Where EV=120013 is the bitmask for events supported by the device. As explained here.

This is the way it is implemented in logkeys

Answer 4

I'd recommend using the evtest application, it lists all your input devices and allows you monitor their events.