Repository files navigation

Simple X11 keylogger.

• Simple output format: One line onstdout per key event.
• Simple to audit: One short file of modern C.
• Simple to run: Does not needsudo.

Given no options,xkbcat prints only keypresses, one per line. Here's theoutput when I type "Hi":

Shift_Lhi

With key-ups enabled (xkbcat -up), the format changes to show them:

+Shift_L+h-h-Shift_L+i-i

Lines starting+ are key-downs;- are key-ups.

Justmake.

Don't haveX11/extensions/XInput2.h? Install your distro'slibxi-develpackage.

Options you can pass (all optional):

• -display <display>: set target X display (default:0)
• -up: also prepend key-ups (default: don't)
• -help: print usage hints and exit

Then just use your computer as usual. Interrupt signal (C-c) to quit.

• If you need to log keys across a whole Linux system (also in theframebuffer—not just in X11), trykeysniffer. It works via a kernelmodule, and needssudo.
• If you want to see what characters the user actually typed (with modifierkeys, backspace, etc resolved into text),xspy orlogkeysmight be better for you.

• If you want to add timestamps to each line for logging purposes, I recommendpiping to themoreutils package'sts.These answers featurevarious other tools good for the purpose.
• If you only want to see key names when you press keys in the same terminalwherexkbcat is running, you can temporarily disable terminal echo withstty -echo && xkbcat. (stty is in coreutils.)

• xinput invoked asxinput --test-xi2 --root logs everythinginput-related; even mouse movements and clicks, and touchpad stuff. Itsoutput is very comprehensive, but harder to parse.

• If you need to log X11 events more generally, various protocol monitoringprograms are listed in theX11 debugging guide.

The git-tagged version numbers followsemver.

Error outputs (on stderr) are intended to be read by people. Changes to theirwording are not considered breaking changes. Don't parse themprogrammatically.

ISC.