From 9779d071833a13aa6163e294a45a0d14ad2cf8e9 Mon Sep 17 00:00:00 2001 From: Scott Worley Date: Wed, 4 Sep 2013 22:06:29 -0700 Subject: [PATCH 1/1] Only print to-the-second resolution by default. Put microseconds behind a flag. This makes it harder to do timing analysis on the log file to try to turn this into a keylogger. (More precise timing information is still available to an on-line attack by watching the flush timings or by watching the CPU usage and run state of the process.) --- keystroke-timestamps.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/keystroke-timestamps.c b/keystroke-timestamps.c index 7c82a65..6e3de63 100644 --- a/keystroke-timestamps.c +++ b/keystroke-timestamps.c @@ -2,19 +2,25 @@ #include #include #include +#include #include #include -int main () +int main (int argc, char **argv) { - struct input_event i; + int print_usec = argc > 1 && strcmp(argv[1], "--usec") == 0; int fd = open("/dev/input/by-path/platform-i8042-serio-0-event-kbd", O_RDONLY); if (fd < 0) { err(EX_NOINPUT, "Could not open keyboard event file"); } + struct input_event i; while (read(fd, &i, sizeof(i)) == sizeof(i)) { if (i.type == 1 && i.value == 1) { - printf("%ld.%ld\n", i.time.tv_sec, i.time.tv_usec); + if (print_usec) { + printf("%ld.%ld\n", i.time.tv_sec, i.time.tv_usec); + } else { + printf("%ld\n", i.time.tv_sec); + } fflush(stdout); } } -- 2.51.2