Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

macOS Capture all key events in the system

R

robj

macrumors regular
Original poster
Dec 23, 2009
230
0
Madrid, Spain
I want to make a program to capture all the key events in the system, either the App is on foreground or not :)

You could think, hey, this is a keylogger. Well, It's pretty much the same, I don't want to make a keylogger at all, but a program that capture key strokes to act as a shortcut to perform another actions, maybe it could run an applescript or maybe run a program.

So, is there any way to do that? In Windows it's pretty easy and I think that this is a kind of security issue because anyone can make a keylogger in a few minutes, but hey, this isn't always done for bad things ;)

Thanks for reading ;)
 
I don't know how to do this, but i know quicksilver captures hotkeys. I don't know if you have to register for each one, or if you can just check every keystroke against your list, etc. In any event, this isn't going to be the answer you're hoping for, but the quicksilver source is available here:
http://code.google.com/p/blacktree-alchemy/downloads/list

You can grab it and dig around. Hopefully someone can point you in the right direction without you having to resort to that, but it's at least out there if you want to peruse it.

-Lee
 
robj said:
I want to make a program to capture all the key events in the system, either the App is on foreground or not
...
capture key strokes to act as a shortcut to perform another actions, maybe it could run an applescript or maybe run a program ...
Click to expand...

Do you really want to make a program to do that, or just use one?

In Snow Leopard, the Services menu is a lot more powerful.
http://www.macworld.com/article/142419/2009/08/snowleopardservices.html

You can bind keys to services using System Preferences > Keyboard > Keyboard Shortcuts and then select Services from the list.

You can create and use AppleScripts as services.
http://macscripter.net/viewtopic.php?id=30255

There's also this nifty tool that lets you encapsulate shell-scripts, etc. as services:
http://wafflesoftware.net/thisservice/
 
One way is to use event taps.
Lookup CGEventTapCreate() and related functions in the developer docs.
 
iSee said:
One way is to use event taps.
Lookup CGEventTapCreate() and related functions in the developer docs.
Click to expand...

And note that you won't get _all_ keystrokes. Any keystrokes in password fields will be hidden from you.
 
Thank you all for the responses :)

I'll take a look to them and told you then.

The Password fields not sending their contents is really GREAT, does this also aply to password fields in a webpage open with Safari or Firefox ?
 
^^^
Yes, you shouldn't be able the receive events while the user is typing in a password field, no matter which app. I haven't tried it, but surely neither safari nor firefox bypass this.

If you are interested, I have an event tap sample. It's implemented as a system daemon that converts enter key presses to right mouse button presses.

For your utility, I'd guess you want to implement it as a daemon or user agent (pretty much the same thing as a daemon but user-spefic), so that aspect of the sample may be userful too.
 
Hello,

I want to achieve the same: be able to capture keystrokes, while my app works in background (actually I have a more complex setup; I have a Java app that executes the C code via JNI).

I already use the CGEventTapCreate() method to capture the mouse and it's working fine. However, the doc states that if this function is used for the keyboard, either the user is an admin or the "assistive devices" is enabled. (cf. http://developer.apple.com/mac/libr...ence.html#//apple_ref/c/func/CGEventTapCreate)

Is there another method for capturing the keys, without needing to enable the "assistive devices" option?

I think there should be, as there are many apps that seem to be able to do this (e.g. the TeamViewer remote assistence program, that is able to capture & modify both mouse & keyboard).

Do you have some hints?

Best regards,
Cristi.
 
There is an open source Mac OS X keystroke logger
called logKext. It's a kernel extension that does keylogging.

I tried it once on Leopard and it worked, but I don't know
if it works under Snow Leopard.

If you for some odd reason need to capture passwords
and login credentials that a user types into Safari, etc.,
that can be done by bundle injection. There's example
code in the Mac Hacker's Handbook by Dino Dai Zovi
and Charlie Miller.

Frank
 
Hello Frank,

And thanks for your reply.
There is an open source Mac OS X keystroke logger
called logKext. It's a kernel extension that does keylogging.
Click to expand...

It supports Snow Leopard, but from what I've seen in the doc, a sudo command is necessary. So admin rights are needed...
I am wondering how remote assistance programs (like TeamViewer) do it, given the fact that they don't have an installer or root user permissions.

If you for some odd reason need to capture passwords
and login credentials that a user types into Safari, etc.,
that can be done by bundle injection.
Click to expand...

Interesting tip. I don't need this feature and it seems to make use of hacks and workarounds. Upwards compatibility is not guaranteed in this case I suppose.

Best regards,
Cristian.
 
cristian607 said:
I am wondering how remote assistance programs (like TeamViewer) do it, given the fact that they don't have an installer or root user permissions.
Click to expand...

I read somewhere else that Quartz event taps can also be used to grab keystroke info,
but I don't have first-hand knowledge of how it is done or done it myself.

Frank
 
Yes indeed, cf. http://developer.apple.com/mac/libr...ence.html#//apple_ref/c/func/CGEventTapCreate

But you need either admin user permissions or Assistive Device Option turned on, cf.:
Event taps receive key up and key down events if one of the following conditions is true:
* The current process is running as the root user.
* Access for assistive devices is enabled. In Mac OS X v10.4, you can enable this feature using System Preferences, Universal Access panel, Keyboard view.
Click to expand...

My question would be if there is another way of capturing key strokes, without having these constraints.

Thanks and best regards,
Cristian.
 
cristian607, unfortunately, I do not know. Maybe just go ahead and install logKext on the user's system if you put it in your terms of service and the user approves the terms?

If you don't want to ask the user for system privileges, I suppose you could just take them. I suppose you could investigate the issue in IOSurface that the iPhone dev team used to root the iPhone. I wouldn't be surprised if there are lots of privilege escalation issues in Mac OS X.

Frank
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back