How to intercept all keystrokes

Question

First of all, I don't expect that something like this already exists, but I am interested in knowing how something like this would be accomplished.

I want a program that I can have running in the background that will intercept ALL keystrokes entered (I'm assuming X is running and perhaps even that Unity is also running), process those keystrokes and then send the original or modified keystrokes on to be handled as normal.

My ultimate goal is creating a sort of keymapping that more closely mimics OS X shortcut behavior. This is very difficult with a standard Ubuntu install since things like ctrl+c seem to be set in stone whereas to mimic OS X behavior, it would need to be cmd+c. Anyway, I'm less interested in discussing the why and more interested in discussing the how. I'm not adverse to writing a daemon in Python, C or whatever else might be needed (I'm also somewhat comfortable with standard UNIX apis). I am, however, completely ignorant about where to begin with something like this.

When the keystrokes are intercepted and processed, it should be able to send them back to the OS following the same interface that the strokes were originally sent with. Maybe this would have to be a patch to X itself? Or would something be able to be in place between the keyboard and X?

Solution 1

To show events from keyboards, but also other input devices, there is also evtest.
It can not create keypresses in itself, but see below.

It shows events on a lower level than xev would, for example.

Also, it shows which events can be created by the device.

As it happens, event4 refers to my main keyboard.

So I create the example output below with the command

sudo evtest /dev/input/event4

and pressing aB:

[ ... ]
Event: time 1429316964.681508, type 4 (EV_MSC), code 4 (MSC_SCAN), value 70004
Event: time 1429316964.681508, type 1 (EV_KEY), code 30 (KEY_A), value 1
Event: time 1429316964.681508, -------------- SYN_REPORT ------------
aEvent: time 1429316964.761540, type 4 (EV_MSC), code 4 (MSC_SCAN), value 70004
Event: time 1429316964.761540, type 1 (EV_KEY), code 30 (KEY_A), value 0
Event: time 1429316964.761540, -------------- SYN_REPORT ------------
Event: time 1429316965.385461, type 4 (EV_MSC), code 4 (MSC_SCAN), value 700e1
Event: time 1429316965.385461, type 1 (EV_KEY), code 42 (KEY_LEFTSHIFT), value 1
Event: time 1429316965.385461, -------------- SYN_REPORT ------------
Event: time 1429316965.577461, type 4 (EV_MSC), code 4 (MSC_SCAN), value 70005
Event: time 1429316965.577461, type 1 (EV_KEY), code 48 (KEY_B), value 1
Event: time 1429316965.577461, -------------- SYN_REPORT ------------
BEvent: time 1429316965.641460, type 4 (EV_MSC), code 4 (MSC_SCAN), value 70005
Event: time 1429316965.641460, type 1 (EV_KEY), code 48 (KEY_B), value 0
Event: time 1429316965.641460, -------------- SYN_REPORT ------------
Event: time 1429316965.713470, type 4 (EV_MSC), code 4 (MSC_SCAN), value 700e1
Event: time 1429316965.713470, type 1 (EV_KEY), code 42 (KEY_LEFTSHIFT), value 0
[ ... ]

_{(To find the right event number (like my event4), you could look at cat /proc/bus/input/devices. The Name may not refer to a keyboard, but look for the entry Handlers containing sysrq kbd and leds. Or just try them all.)}

---

Keypress events can not be created by evdev, but there is an implementation of a key remapping using evdev that can create new events,
It seems to match what you are looking for:

At Home Modifier by Evdev (ahm or at-home-modifier-evdev):

It enables for example "Space/Shift dual role key." When you press the Space key alone, it's a space; but when you press it with another key, it's a shift. E.g., space + x = X, roughly speaking.

Any pairs of keys are possible. For example you can turn your Left Alt into BS/Alt in addition to Space/Shift. In this example, Space followed by LAlt sends Shift + BS, LAlt followed by Space does Alt + Space, and Space + LAlt + x and LAlt + Space + x is Alt + Shift + x.

It's a fork of Xorg "evdev" driver [ ... ]

It does not claim to be a clean implementation - but that does not prevent to learn from it.

Solution 2

Yes there is a keylogger for ubuntu..

You can download it from here

Or you install it via apt-get

Enable universe repositories,and then run the following in terminal

sudo aptitude update
sudo aptitude install lkl

To run,type the following in terminal

lkl -l -k us_km -o log.file

for seeing results

tail log.file

Comments

[Admin]

Good place to start.. you're basically looking for a keylogger, but with slightly modified behaviour? askubuntu.com/questions/14180/how-can-i-install-a-keylogger

[Admin]

sort of, I definitely need to be able grab all keys entered. But I'm more interested in how to intercept and process the input before X or whatever else might handle it rather than just recording it.

[Admin]

perhaps a compiz plugin is the way to go?

[gregghz]

I'm not looking for a keylogger. I'm more looking for a way to create a keylogger. I want to effectively modify the keyboard layout and cause certain keys to be sent on to X as something different than what was actually pressed. I don't need to a log keys hit from a user's session.

[RobotHumans]

This is what you're looking for, you just don't want to read source

[eddygeek]

I would amend "Keypress events can not be created by evdev": injectinput.py claims to be doing just that, "entering keystrokes using evdev", using evdev.UInput().write(...).

[Volker Siegel]

@eddygeek Thanks! That's a good example for the confusing terminology involved. "To create Keypress events by evdev" and "To enter keystrokes using evdev" is not the same at all! In common cases Keypress events and keystrokes seem "very similar" - but they are conceptually different , and they get very practically different in complicated cases. (Note I did not look into the code. It could be that we are talking about almost the same, implemented two languages. )

[Volker Siegel]

A comment above reminded me of a pretty important related issue. In short: The terminology related to character input is massively confusing! The basic terminology is quite well defined. But input is processed an many levels of a system, for example BIOS, driver, kernel, X11, Gnome, and javascript. In many cases, a term used in context of one level means not exactly the same as on another level. And when using a term that has multiple definitions - there are at least two levels involved - means which one is meant needs to be clear from the context.

[Volker Siegel]

(Exercise: Do I get keypress events from a speech input interface? Keystrokes? Chords? Does it have a NumLock? In which state? )