In Complete Guide to Keylogging in Linux: Part 1 and Complete Guide to Keylogging in Linux: Part 2, we covered how a keylogger can be written for Linux in userland. Today, we will cover techniques to capture keyboard events in Linux kernel. Linux Kernel & Keyboard
A slightly detailed diagram of keyboard handling is given below.
+———————+ +———–+ (2) +———-+ | USER LAND | | Interrupt | —–>| Keyboard | +———————+ +–=—–>| Handler |<—– | Notifier | ^ | +——-+—+ (3) +———-+ keycode / | | | scancode | | | (5) | |(1) |(4) | | | | | | +–+———-+–+ |
Read more