Capture all key events in the system

Discussion in 'Mac Programming' started by robj, Jan 26, 2010.

  1. robj macrumors regular

    Dec 23, 2009
    Madrid, Spain
    I want to make a program to capture all the key events in the system, either the App is on foreground or not :)

    You could think, hey, this is a keylogger. Well, It's pretty much the same, I don't want to make a keylogger at all, but a program that capture key strokes to act as a shortcut to perform another actions, maybe it could run an applescript or maybe run a program.

    So, is there any way to do that? In Windows it's pretty easy and I think that this is a kind of security issue because anyone can make a keylogger in a few minutes, but hey, this isn't always done for bad things ;)

    Thanks for reading ;)
  2. lee1210 macrumors 68040


    Jan 10, 2005
    Dallas, TX
    I don't know how to do this, but i know quicksilver captures hotkeys. I don't know if you have to register for each one, or if you can just check every keystroke against your list, etc. In any event, this isn't going to be the answer you're hoping for, but the quicksilver source is available here:

    You can grab it and dig around. Hopefully someone can point you in the right direction without you having to resort to that, but it's at least out there if you want to peruse it.

  3. chown33 macrumors 604

    Aug 9, 2009
    Sailing beyond the sunset
    Do you really want to make a program to do that, or just use one?

    In Snow Leopard, the Services menu is a lot more powerful.

    You can bind keys to services using System Preferences > Keyboard > Keyboard Shortcuts and then select Services from the list.

    You can create and use AppleScripts as services.

    There's also this nifty tool that lets you encapsulate shell-scripts, etc. as services:
  4. iSee macrumors 68040


    Oct 25, 2004
    One way is to use event taps.
    Lookup CGEventTapCreate() and related functions in the developer docs.
  5. gnasher729 macrumors P6


    Nov 25, 2005
    And note that you won't get _all_ keystrokes. Any keystrokes in password fields will be hidden from you.
  6. robj thread starter macrumors regular

    Dec 23, 2009
    Madrid, Spain
    Thank you all for the responses :)

    I'll take a look to them and told you then.

    The Password fields not sending their contents is really GREAT, does this also aply to password fields in a webpage open with Safari or Firefox ?
  7. iSee macrumors 68040


    Oct 25, 2004
    Yes, you shouldn't be able the receive events while the user is typing in a password field, no matter which app. I haven't tried it, but surely neither safari nor firefox bypass this.

    If you are interested, I have an event tap sample. It's implemented as a system daemon that converts enter key presses to right mouse button presses.

    For your utility, I'd guess you want to implement it as a daemon or user agent (pretty much the same thing as a daemon but user-spefic), so that aspect of the sample may be userful too.
  8. cristian607 macrumors newbie

    Aug 5, 2010

    I want to achieve the same: be able to capture keystrokes, while my app works in background (actually I have a more complex setup; I have a Java app that executes the C code via JNI).

    I already use the CGEventTapCreate() method to capture the mouse and it's working fine. However, the doc states that if this function is used for the keyboard, either the user is an admin or the "assistive devices" is enabled. (cf.

    Is there another method for capturing the keys, without needing to enable the "assistive devices" option?

    I think there should be, as there are many apps that seem to be able to do this (e.g. the TeamViewer remote assistence program, that is able to capture & modify both mouse & keyboard).

    Do you have some hints?

    Best regards,
  9. frankpuccino macrumors newbie

    Jul 24, 2010
    There is an open source Mac OS X keystroke logger
    called logKext. It's a kernel extension that does keylogging.

    I tried it once on Leopard and it worked, but I don't know
    if it works under Snow Leopard.

    If you for some odd reason need to capture passwords
    and login credentials that a user types into Safari, etc.,
    that can be done by bundle injection. There's example
    code in the Mac Hacker's Handbook by Dino Dai Zovi
    and Charlie Miller.

  10. cristian607 macrumors newbie

    Aug 5, 2010
    Hello Frank,

    And thanks for your reply.
    It supports Snow Leopard, but from what I've seen in the doc, a sudo command is necessary. So admin rights are needed...
    I am wondering how remote assistance programs (like TeamViewer) do it, given the fact that they don't have an installer or root user permissions.

    Interesting tip. I don't need this feature and it seems to make use of hacks and workarounds. Upwards compatibility is not guaranteed in this case I suppose.

    Best regards,
  11. frankpuccino macrumors newbie

    Jul 24, 2010
    I read somewhere else that Quartz event taps can also be used to grab keystroke info,
    but I don't have first-hand knowledge of how it is done or done it myself.

  12. cristian607 macrumors newbie

    Aug 5, 2010
    Yes indeed, cf.

    But you need either admin user permissions or Assistive Device Option turned on, cf.:
    My question would be if there is another way of capturing key strokes, without having these constraints.

    Thanks and best regards,
  13. frankpuccino macrumors newbie

    Jul 24, 2010
    cristian607, unfortunately, I do not know. Maybe just go ahead and install logKext on the user's system if you put it in your terms of service and the user approves the terms?

    If you don't want to ask the user for system privileges, I suppose you could just take them. I suppose you could investigate the issue in IOSurface that the iPhone dev team used to root the iPhone. I wouldn't be surprised if there are lots of privilege escalation issues in Mac OS X.

  14. kainjow Moderator emeritus


    Jun 15, 2000

Share This Page