Actions

Difference between revisions of "Raspberry Pi Pikeyd165 keylogging"

From falz.net

(Created page with "I ran in to a few issues where ghost button presses were happing on my Neo Geo Arcade Cabinet so resorted to debugging with a the [https://github.com/kernc/logkeys logkeys...")
(No difference)

Revision as of 15:25, 10 February 2018

I ran in to a few issues where ghost button presses were happing on my Neo Geo Arcade Cabinet so resorted to debugging with a the logkeys keylogger. Here's how to install it on a Rapsberry pi and debug the pikeyd165 driver:


Install required packages to build logkeys. You may already have some of these installed:

sudo apt-get install autoconf automake libtool autotools-dev git


Download and compile logkeys. If the autogen.sh command gives an error I may have missed a package above.

git clone https://github.com/kernc/logkeys.git
cd logkeys
./autogen.sh
cd build
../configure
make
sudo make install


Now you must determine which input device pikeyd165 is showing up as, this will depend on if you have a keyboard and some other things. in my case it was 'event4'. Look at the file /proc/bus/input/devices to find yours. Mine is 'event4' below:

less /proc/bus/input/devices
<snip removed the real keyboard stuff>
I: Bus=0003 Vendor=0001 Product=0001 Version=0001
N: Name="uinput-sample"
P: Phys=
S: Sysfs=/devices/virtual/input/input4
U: Uniq=
H: Handlers=sysrq kbd event4 rfkill 
B: PROP=0
B: EV=100003
B: KEY=ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff ffffffff fffffffe


I put this in the pi user's .bashrc to start on boot. modify event4 to whatever yours is:

sudo logkeys --start --device /dev/input/event4 --output /var/log/logkeys.log


All output from pikeyd165 should now be logged to /var/log/logkeys.log. In my case it was registering all buttons mapped in pikeyd165.conf. Note that a few seem odd due to the shift key being virtually pressed. ! is 1, % is 5, ^ is 6.

<F2><Esc> <LShft>ZXIKWQ<Left><Right><LCtrl><LAlt>SAGd%!<Up><Down>FR"^

I'm currently working to determine what is actually causing this.