Only print to-the-second resolution by default.

Put microseconds behind a flag.

This makes it harder to do timing analysis on the log file to try to
turn this into a keylogger.

(More precise timing information is still available to an on-line attack
by watching the flush timings or by watching the CPU usage and run state
of the process.)

diff --git a/keystroke-timestamps.c b/keystroke-timestamps.c
index 7c82a65f16e2743fd0ddf02b538c6bff5194c141..6e3de63127e590c97721dc4583f8ee304dda0bf5 100644 (file)
--- a/keystroke-timestamps.c
+++ b/keystroke-timestamps.c
@@ -2,19 +2,25 @@
 #include <fcntl.h>
 #include <linux/input.h>
 #include <stdio.h>
 #include <fcntl.h>
 #include <linux/input.h>
 #include <stdio.h>

+#include <string.h>

 #include <sysexits.h>
 #include <unistd.h>
 
 #include <sysexits.h>
 #include <unistd.h>
 

-int main ()
+int main (int argc, char **argv)

 {
 {

-  struct input_event i;
+  int print_usec = argc > 1 && strcmp(argv[1], "--usec") == 0;

   int fd = open("/dev/input/by-path/platform-i8042-serio-0-event-kbd", O_RDONLY);
   if (fd < 0) {
     err(EX_NOINPUT, "Could not open keyboard event file");
   }
   int fd = open("/dev/input/by-path/platform-i8042-serio-0-event-kbd", O_RDONLY);
   if (fd < 0) {
     err(EX_NOINPUT, "Could not open keyboard event file");
   }

+  struct input_event i;

   while (read(fd, &i, sizeof(i)) == sizeof(i)) {
     if (i.type == 1 && i.value == 1) {
   while (read(fd, &i, sizeof(i)) == sizeof(i)) {
     if (i.type == 1 && i.value == 1) {

-      printf("%ld.%ld\n", i.time.tv_sec, i.time.tv_usec);
+      if (print_usec) {
+        printf("%ld.%ld\n", i.time.tv_sec, i.time.tv_usec);
+      } else {
+        printf("%ld\n", i.time.tv_sec);
+      }

       fflush(stdout);
     }
   }
       fflush(stdout);
     }
   }