How to intercept all keystrokes

First of all, I don't expect that something like this already exists, but I am interested in knowing how something like this would be accomplished.

I want a program that I can have running in the background that will intercept ALL keystrokes entered (I'm assuming X is running and perhaps even that Unity is also running), process those keystrokes and then send the original or modified keystrokes on to be handled as normal.

My ultimate goal is creating a sort of keymapping that more closely mimics OS X shortcut behavior. This is very difficult with a standard Ubuntu install since things like ctrl+c seem to be set in stone whereas to mimic OS X behavior, it would need to be cmd+c. Anyway, I'm less interested in discussing the why and more interested in discussing the how. I'm not adverse to writing a daemon in Python, C or whatever else might be needed (I'm also somewhat comfortable with standard UNIX apis). I am, however, completely ignorant about where to begin with something like this.

When the keystrokes are intercepted and processed, it should be able to send them back to the OS following the same interface that the strokes were originally sent with. Maybe this would have to be a patch to X itself? Or would something be able to be in place between the keyboard and X?

Solution 1:

To show events from keyboards, but also other input devices, there is also evtest.
It can not create keypresses in itself, but see below.

It shows events on a lower level than xev would, for example.

Also, it shows which events can be created by the device.

As it happens, event4 refers to my main keyboard.

So I create the example output below with the command

sudo evtest /dev/input/event4

and pressing aB:

[ ... ]
Event: time 1429316964.681508, type 4 (EV_MSC), code 4 (MSC_SCAN), value 70004
Event: time 1429316964.681508, type 1 (EV_KEY), code 30 (KEY_A), value 1
Event: time 1429316964.681508, -------------- SYN_REPORT ------------
aEvent: time 1429316964.761540, type 4 (EV_MSC), code 4 (MSC_SCAN), value 70004
Event: time 1429316964.761540, type 1 (EV_KEY), code 30 (KEY_A), value 0
Event: time 1429316964.761540, -------------- SYN_REPORT ------------
Event: time 1429316965.385461, type 4 (EV_MSC), code 4 (MSC_SCAN), value 700e1
Event: time 1429316965.385461, type 1 (EV_KEY), code 42 (KEY_LEFTSHIFT), value 1
Event: time 1429316965.385461, -------------- SYN_REPORT ------------
Event: time 1429316965.577461, type 4 (EV_MSC), code 4 (MSC_SCAN), value 70005
Event: time 1429316965.577461, type 1 (EV_KEY), code 48 (KEY_B), value 1
Event: time 1429316965.577461, -------------- SYN_REPORT ------------
BEvent: time 1429316965.641460, type 4 (EV_MSC), code 4 (MSC_SCAN), value 70005
Event: time 1429316965.641460, type 1 (EV_KEY), code 48 (KEY_B), value 0
Event: time 1429316965.641460, -------------- SYN_REPORT ------------
Event: time 1429316965.713470, type 4 (EV_MSC), code 4 (MSC_SCAN), value 700e1
Event: time 1429316965.713470, type 1 (EV_KEY), code 42 (KEY_LEFTSHIFT), value 0
[ ... ]

_{(To find the right event number (like my event4), you could look at cat /proc/bus/input/devices. The Name may not refer to a keyboard, but look for the entry Handlers containing sysrq kbd and leds. Or just try them all.)}

Keypress events can not be created by evdev, but there is an implementation of a key remapping using evdev that can create new events,
It seems to match what you are looking for:

At Home Modifier by Evdev (ahm or at-home-modifier-evdev):

It enables for example "Space/Shift dual role key." When you press the Space key alone, it's a space; but when you press it with another key, it's a shift. E.g., space + x = X, roughly speaking.

Any pairs of keys are possible. For example you can turn your Left Alt into BS/Alt in addition to Space/Shift. In this example, Space followed by LAlt sends Shift + BS, LAlt followed by Space does Alt + Space, and Space + LAlt + x and LAlt + Space + x is Alt + Shift + x.

It's a fork of Xorg "evdev" driver [ ... ]

It does not claim to be a clean implementation - but that does not prevent to learn from it.

Solution 2:

Yes there is a keylogger for ubuntu..

You can download it from here

Or you install it via apt-get

Enable universe repositories,and then run the following in terminal

sudo aptitude update
sudo aptitude install lkl

To run,type the following in terminal

lkl -l -k us_km -o log.file

for seeing results

tail log.file