https://wiki.yobi.be/index.php?action=history&feed=atom&title=Keyloggers 2026-05-23T21:45:39Z Revision history for this page on the wiki MediaWiki 1.43.8 https://wiki.yobi.be/index.php?title=Keyloggers&diff=2640&oldid=prev 2008-02-08T21:18:10Z

<p></p> <p><b>New page</b></p><div>==lkl==<br /> apt-cache search keylog<br /> lkl - userspace keylogger for x86 architecture<br /> <br /> lkl -l -k /usr/share/lkl/keymaps/us_km -o /tmp/log.file<br /> =&gt; Eats 100% of my CPU, half in syscalls, pfff what a discreet piece of soft, and leaves the keyboard in a dirty state, like ctrl was always pushed down<br /> <br /> I submitted [http://bugs.debian.org/460230 a patch] to solve the problem and [http://bugs.debian.org/464757 another one] to get -h working without having to be root.<br /> <br /> ==lkm==<br /> http://packetstormsecurity.org/UNIX/security/kernel.keylogger.txt<br /> &lt;br&gt;Hijacks the syscall table<br /> original_read = sys_call_table[ SYS_read ]; <br /> sys_call_table[ SYS_read ] = hacked_read; <br /> Logs all sys_read() from stdin (0) with one byte read<br /> &lt;br&gt;Doesn&#039;t hide itself<br /> &lt;br&gt;Code done for old kernels, 2.4.5...<br /> ==vlogger==<br /> http://www.phrack.org/issues.html?issue=59&amp;id=14&amp;mode=txt<br /> &lt;br&gt;Hijacks the syscall table, not on the sys_read() which is solicited quite a lot but on the open() to monitor ttys and hijack their receive_buf() function which is called by the low-level tty driver to send characters received by the hardware to the line discipline for processing<br /> &lt;br&gt;Code done for old kernels, 2.4.18...<br /> ==tcleo==<br /> brought to you by the Argentine government :-)<br /> &lt;br&gt;http://www.citefa.gov.ar/SitioSI6_EN/si6.htm<br /> &lt;br&gt;Supports kernels up to 2.6.5 :-(<br /> &lt;br&gt;Apparently was part of Honeynet project so maybe it&#039;s just ancestor of sebek...<br /> <br /> ==sebek==<br /> part of the honeynet project<br /> &lt;br&gt;http://www.honeynet.org/tools/sebek/<br /> &lt;br&gt;kernel module, hides itself and hides its own network traffic<br /> &lt;br&gt;same syscall table hijacking, monitors read, readv, pread64, open, socketcall, fork, vfork, clone<br /> &lt;br&gt;filtering capabilities<br /> &lt;br&gt;can sniff keystrokes but also uploaded files etc<br /> &lt;br&gt;sends data to a remote server</div>

PhilippeTeuwen