logKext v2.1 Keylogger question

[mantic]

I've installed this program but can not get it running. I type the sudo command in and it says

Error: logKext Preferences cannot be found. Is logKextDaemon running?

I've read the instruction. Can anyone help?

 

[carlsson]

I've installed this program but can not get it running. I type the sudo command in and it says

Error: logKext Preferences cannot be found. Is logKextDaemon running?

I've read the instruction. Can anyone help?

I have the same problem... It works on my MacBook with Leopard, but not on my iMac G5, also with Leopard.

 

[d235j]

After checking the system log, it seems that /System/Library/LaunchDaemons/logKext.plist has the wrong permissions. (Leopard is much more strict with permissions than Tiger). To fix this, open a Terminal window and type this line:

sudo chown root /System/Library/LaunchDaemons/logKext.plist

Hope it works.

 

[t892e]

I run leopard, and I am getting the same error:

Error: logKext Preferences cannot be found. Is logKextDaemon running?

I tried "sudo chown root /System/Library/LaunchDaemons/logKext.plist" and it is still giving me the same error

Please help. Thanks!

 

[Eraserhead]

Why do you want to put a keylogger on your computer?

 

[yellow]

Why do you want to put a keylogger on your computer?

Monitoring children/roommate/significant other?

I run leopard, and I am getting the same error:

Error: logKext Preferences cannot be found. Is logKextDaemon running?

I tried "sudo chown root /System/Library/LaunchDaemons/logKext.plist" and it is still giving me the same error

Please help. Thanks!

Did you get any error when you did the command above?
Did the prompt come back?
Did you restart afterwards?

 

[Eraserhead]

Monitoring children/roommate/significant other?

I suppose, though what about the concept known as trust? Won't they get really annoyed if they find out.

 

[yellow]

There's always trust, but this shouldn't be turned into a philosophical debate.
Strictly technical.

 

[lancestraz]

Why do you want to put a keylogger on your computer?

If you're a spy.
Or if you want a safeguard for when your text editor crashes and you haven't saved recently! Grrr... I'm looking at you Microsoft Word.

 

[Eraserhead]

There's always trust, but this shouldn't be turned into a philosophical debate.
Strictly technical.

Fair enough.

If you're a spy.
Or if you want a safeguard for when your text editor crashes and you haven't saved recently! Grrr... I'm looking at you Microsoft Word.

I used to use a 386 at School, they crashed so often that I always save really regularly.

 

[t892e]

Thanks! I managed to get it sort of working. I restarted the computer, and the error message stopped appearing. But now the problem is that it is not recording any key strokes. If the "Encrypt" is off, then it works fine -- ie it records all keystrokes. But when the Encrypt is on, then when I hit "print", it displays "(null)". Any ideas?

Thanks.

 

[filchy]

I was having the same problem. I installed logKext 2.2 since it is Leopard compatible but it still gave the dubious permissions problem. After inspecting another launch agent, i noticed the permissions were Read Only for the wheel group, but the /Library/LaunchDaemons/logKext.plist had Read/Write permissions for wheel group. After changing it to Read Only group permissions, logKext started up just fine. (With no need for a reboot or logout)

Only problem I still have left is that encryption is still broken. As long as encryption is off, the log works fine, so be careful.

Cliff Notes:
/Library/LaunchDaemons/logKext.plist should have the following permissions in Leopard:

system Read/Write
wheel Read Only
everyone Read Only

 

[jamesslick]

Filchy - where did you get logkext 2.2 - the fsb site only has the 2.1 version. i would love to get my copy working again... leopard has only caused me endless problems.

thx.

 

[CycleTron]

Okay... found the source for 2.2, but NO clue how to make it, configure it, etc. I have never used Xcode, and honestly haven't programmed in C for about 15 years.

Anyone got a working copy they can send me? Or give me instructions?

I was having the same problem. I installed logKext 2.2 since it is Leopard compatible but it still gave the dubious permissions problem. After inspecting another launch agent, i noticed the permissions were Read Only for the wheel group, but the /Library/LaunchDaemons/logKext.plist had Read/Write permissions for wheel group. After changing it to Read Only group permissions, logKext started up just fine. (With no need for a reboot or logout)

Only problem I still have left is that encryption is still broken. As long as encryption is off, the log works fine, so be careful.

Cliff Notes:
/Library/LaunchDaemons/logKext.plist should have the following permissions in Leopard:

system Read/Write
wheel Read Only
everyone Read Only

 

[CycleTron]

Okay...so trying to figure out what I'm doing wrong with building the source.

I correct the path settings for logKextCommon.h in both the Client & Daemon xcodeproj.

I then correct the path settings in logKext.xcodeproj with reference to the Clint and Daemon packages.

I run build on the whole thing:
1. build the Daemon
2. build the client
3. build logKext

I then go into build/packageGen and run packageMaker against logKext.pmdoc.

When I try install I get an error about something being wrong with logKextKeymap.plist.

from the command line I change the group permissions as suggested, because they are wrong.

Reboot system, still no luck, but I do get an error message upon login that the plist file has something wrong and to contact my vendor.

I've been at this for hours now. Have installed the Xcode set, Darwin ports, GCC43, Apple-gcc4, and STILL no damn luck.

Thoughts?

I was having the same problem. I installed logKext 2.2 since it is Leopard compatible but it still gave the dubious permissions problem. After inspecting another launch agent, i noticed the permissions were Read Only for the wheel group, but the /Library/LaunchDaemons/logKext.plist had Read/Write permissions for wheel group. After changing it to Read Only group permissions, logKext started up just fine. (With no need for a reboot or logout)

Only problem I still have left is that encryption is still broken. As long as encryption is off, the log works fine, so be careful.

Cliff Notes:
/Library/LaunchDaemons/logKext.plist should have the following permissions in Leopard:

system Read/Write
wheel Read Only
everyone Read Only

 

[filchy]

First of all, I can only assume you are running Leopard. Please confirm that. Also, I am running a PPC G5, so that could be a difference also.

However, just for info, this is what I did:

1) Previously installed Leopard XCode
2) Downloaded the source using the command line usage, copy/pasted from the project site. The source downloaded to my home directory.
3) Opened logKext.xcodeproj using XCode.
4) Build client, then daemon(maybe the other way around), then logkext
5) In the "build" folder, I ran logKext.pkg

I got the dubious permissions error, so I then

6) Changed permissions as per my previous post

Never did I change any paths or install any additional software or compilers. I don't code for Mac so I don't have a need for those. I only have Apple's default gcc installed.

The permissions for my logKextKeymap.plist file are 644 with Me as owner. The only file I had a permissions problem with was the logKext.plist file in /Library/LaunchDaemons directory.

More info on your error may help. Also, I assume the error you see is being found in the Console, not an error popup, right?

Hope that helps!

 

[CycleTron]

Yes, I'm running Leopard, on an MacBook Pro (intel duel-core).

When I run the pkg to install, it's says successful, but also tosses me this error message:

The system extension "/System/Library/Extensions/logKext.kext" was installed improperly and cannot be used.

Has me beating my head against the wall to put it mildly.

Thoughts anyone?

First of all, I can only assume you are running Leopard. Please confirm that. Also, I am running a PPC G5, so that could be a difference also.

However, just for info, this is what I did:

1) Previously installed Leopard XCode
2) Downloaded the source using the command line usage, copy/pasted from the project site. The source downloaded to my home directory.
3) Opened logKext.xcodeproj using XCode.
4) Build client, then daemon(maybe the other way around), then logkext
5) In the "build" folder, I ran logKext.pkg

I got the dubious permissions error, so I then

6) Changed permissions as per my previous post

Never did I change any paths or install any additional software or compilers. I don't code for Mac so I don't have a need for those. I only have Apple's default gcc installed.

The permissions for my logKextKeymap.plist file are 644 with Me as owner. The only file I had a permissions problem with was the logKext.plist file in /Library/LaunchDaemons directory.

More info on your error may help. Also, I assume the error you see is being found in the Console, not an error popup, right?

Hope that helps!

 

[filchy]

CycleTron,

I'm sure you already tried this, but have you tried manually copying the logKext.kext file(and others) directly from the build/Development folder to their proper location in the file system?

Also, IIRC, Leopard disables root user on install, even if it was an upgrade install. Perhaps root needs to be enabled using Directory Utility(in the /Applications/Utilities folder)? Mine is enabled, but I don't know whether it is necessary or not. Many of the functions of logKext need root access, so perhaps...

Or maybe it just doesn't work on Intel

Edit: Also, I'm assuming your user is an Administrator, which I believe would be necessary (just covering all the bases. believe me, i've done some pretty embarassing things, like calling tech support for a device I've been professionally repairing for 10 years, only to have them remind me to try unplugging/plugging it in. Fixed)

 

[kuebby]

I used to use a 386 at School, they crashed so often that I always save really regularly.

Yeah, I used to use Windows and it crashed enough that I've gotten into the habit of saving very regularly. Even in the age of auto-save that actually works.

 

[analyze]

i had the same message pop up after building and installing according to the instructions above...
I then looked at the output on the console and realized that the kext was not being loaded. I then tried to load it manually with -t to see what was going on...
It turns out that some files in the extension itself (logKext.kext) had some wrong permissions set... they need to be set to owner:root and group:wheel

the following files/directories needed permissions to be changed:

/System/Library/Extension/logKext.kext/Content
/System/Library/Extension/logKext.kext/Content/Info.plist
/System/Library/Extension/logKext.kext/Content/MacOS
/System/Library/Extension/logKext.kext/Content/MacOS/logkext

so i ran sudo chown root and sudo chgrp wheel on each of them and now it works (without encryption though, still haven't figured that one out yet.. any ideas?)

cheers

 

[filchy]

According to the author, this permissions thing should get taken care of in the official release of 2.2. This is from the author in an email to me:

"Yeah, the packagemaker document is messed up. I'm working on it for the initial release of logKext 2.2"

So, I guess just look at the permissions and fix them manually for now. Hey, not bad for free software!!!

 

[tazzmaniac]

logKext beginner

hi everyone!!
im a complete beginner at this. hope someone can help me!!!
i installed logKext, its running however the logfile text are jumbled up...could it be because i am using an 'azerty' keyboard instead of a 'qwerty' keyboard?
how do i fix this?

and how do i change the password or turn off the encryption?

please help ! someone please clear my confusion !!
uhuhu

 

[creppie]

logKext residual?

Hello --

I'm a pc guy analyzing a macbook that had logKext on it and either had been running until at least 4 days ago or still is. I researched how to run the client as well as the footprint of the daemon.

- Sudo logKextClient in the terminal is unable to find the command.

- The following files do not exist:
/System/Library/Extensions/logKext.kext
/System/Library/Filesystems/logKextDaemon
/System/Library/LaunchDaemons/logKext.plist
/usr/bin/logKextClient
(as described here)

My question is, is there anything else I can check to see that the daemon isn't in fact still active? I want to be absolutely sure that it's not running, even under a different name, for example.

Thanks so much.