DIY hardware keylogger

We present the prototype version of the KeyLogger with full documentation, electrical schematics, and program. Operation of this device is similar to the KeyLogger Pro version, although download is initiated by a special button. Also the DIY keylogger version logs all data on the PS/2 keyboard line, so memory isn't used as efficiently as in the commercial version. Nevertheless, this is a 100% operational and checked hardware keyboard logger. We provide a special software application with full source code for analysis of the memorized data. You may use data here provided as you wish, although we do not take any responsibility for the way you use this keylogger device.

What you need

Before you start, go down this list and see if you have all the basic stuff needed to do this project on your own:

Put it togethe

rThe first thing to do is program the microcontroller. Start your programmer software, pick the AT89C2051, and burn the flash with the binary file or the hex version (make sure your browser downloads these files in binary mode!). You can also compile the program on your own using the source code and a 8051 compiler.
Now comes the soldering. This is probably the most difficult part in the whole project, as the keyboard logger should be made as small as possible. The electrical schematics below shows how connections should be made between components.

Solder the components together starting from the microcontroller and the EEPROM. Unused pins can be removed. Make sure the push button is accessible. When mounting the 10uF capacitor, make sure it is biased correctly (minus should be connected to pin 1).

Recording mode

The keyboard logger starts recording key-strokes once plugged between the keyboard and the computer. Only PC keyboards of PS/2 standard are supported. The logger is completely transparent for computer operation and cannot be detected by software in recording mode. All data sent by the keyboard will be logged in internal non-volatile EEPROM memory (up to 65536 bytes). Recording mode is completely independent from the operating system installed on the computer.

Playback mode

Once data has been recorded into the keyboard logger, it can be retrieved to a PC running Windows 9X/Me/XP/2000. The keyboard logger does this by simulating the keyboard. The transmitted characters are acquired by a special application called KeyGrab. You can download this application in the download section at the end of this page. Once data has been transmitted to the computer, it can be processed by software and analyzed. Follow the instructions for initiating data download.

Data analysis

When data when been downloaded into the KeyGrab main table, it has been preprocessed automatically to show what keys have been pressed during recording. As you have probably noticed, data was transmitted in descending order. This is to show keys pressed recently first. Keystrokes that occurred a long time ago are transmitted later. You can analyze the table on your own, or you can use some of the program options to search for some particular strings.

The position in the keyboard loggers memory used by a keyboard event (hex form).

1. The key pressed or released - the thing that interests us the most.
2. The event that took place - a key press or release.
3. The character that the keyboard generated.
4. The last memory position that was written during recording.
5. The memory size in kilobits (hex form).

Things you should know

We encourage you to read this section to avoid problems that might occur using the keyboard recorder.

1. Countries have different laws about logging keyboard data. Not knowing the law does not allow you not to obey it. Please read the our user agreement.
2. We do not take any responsibility for any damage caused by the use of this device.
3. Use the keyboard logger only when necessary. Discovering a device like this will not do you any good.
4. When installing the logger, make sure you didn't disrupt computer operation. Test the computer after installation.

1. The keyboard logger has 64kbytes of non-volatile EEPROM memory. When this memory is full, writing will start over again from the first memory location. The oldest data will be lost.
2. On power-up writing starts from the last used memory location. The first 80 bytes of memory are reserved for this purpose. The last write address is updated approximately every 10 seconds.
3. Do not leave the logger connected in record mode when unnecessary. This will use memory and cause old, sometimes important, data to be overwritten.

1. For data transmission you will need at least a 100MHz Pentium class computer with Windows 9X/Me/XP/2000 installed.
2. The keyboard logger transmits data back to the computer simulating the keyboard. The real keyboard has to be disconnected during transmission (otherwise the computer will hang).
3. The active application must be KeyGrab (otherwise Windows will start interpreting the simulated keystrokes).
4. Data is transmitted in reverse chronological order. This is to provide recent data first. You have to wait a while to get very old keyboard data. The whole transmission process can last up to 20 minutes.
5. You have to end the transmission manually by pressing the button on the logger again. Do this when the data starts getting duplicated.

1. The PC keyboard is a bit more complicated than you might think. You can notice this analyzing raw data logged by the device. The PC keyboard generates one character each time a key is pressed. When the key is released, the character is generated again with a preceding F0 character. There are also extended keys using the E0 character. You can read about this in the short PC keyboard documentation.
2. Although the keyboard logger has 64kbytes of memory, this doesn't mean 64 thousand keystrokes can be memorized. One key-press-release sequence requires 3 bytes for a standard key and 5 bytes for an extended key. Logging has been improved in the commercial versions.

1. Read the help file in the KeyGrab application for instructions on using special features. You will need an WWW browser for this.

Špión počítačovej klávesnice What is it ?

The KeyLogger is a hardware keyboard recorder capable of memorizing over
260 000 keys pressed on a PC keyboard. KeyLogger is in fact a small electronic device plugged in between a standard PS/2 type keyboard and a Personal Computer. It's main function is to log all keys pressed on the keyboard to internal non-volatile memory. Stored data can be later recalled and analyzed by special software on any other computer.

	Where do you use it? The KeyLogger has a few basic applications: children monitoring employee monitoring data intercepting data backuping Features small and discrete completely undetectable for software transparent for computer operation over 260 000 character memory capacity (256kB version) independent from operating system in recording mode special KeeLog software for data retrieve and analysis national keyboard layout support data retention without power for over 100 years Requirements record mode - a PC class computer with a PS/2 keyboard playback mode - Pentium class PC with Windows 9X/ME/XP/2000
	Record mode - quick install Installing the hardware keylogger in record mode is fairly simple - just plug it in between the keyboard and the PS/2 connector on the PC rear panel. On power-up the keylogger will start recording all data typed on the keyboard. Previous data will not be overwritten because recording will continue from the last used memory location. 1. Find the PS/2 connector at the computer rear panel. 2. Disconnect the keyboard. 3. Connect the keyboard logger in place of the keyboard. 4. Connect the keyboard to the logger. On computer power-up data will start being recorded. You can find more details about installing the KeyLogger in record mode in the section Install Guide.
	Playback mode Once data has been acquired in record mode, you can transmit it to any other computer running Windows 9X/ME/XP/2000. Install the provided KeeLog Downloader 3.0 or KeeLog Downloader Lite application first. You may obtain these applications for trial purposes in the download section. The keyboard logger should be connected in the same way as in record mode. Typing in a special password provided with the keyboard logger will initiate data transmission to the computer. Do not disturb the computer while transmitting. Connect the keyboard logger in the same as in record mode on any computer running Windows 9X/ME/XP/2000.
	Run the one of the provided applications: KeeLog Downloader Lite (for quick and easy, text-based playback) or the KeeLog Downloader 3.0 (table and text analysis features).
	Type in the password supplied with the device and press Enter. Data download from the keyboard logger will occur automatically. Transmission can be stopped at any time by pressing a key.
	Data can now be analyzed. You can use the applications automatic search options and save the log file.
	Quick data analysis Data transmission from the keyboard logger to the computer can take up to 20 minutes. However, you don't have to wait this long, as download can be finished at any time by pressing any key. This is usually the case, as the most recent data (usually the most interesting data too) is transmitted first. The longer you wait during transmission, the older the retrieved memory locations will be. When download is finished, you will be able to see raw data in the KeeLog Downloader main table. This table will contain single character text data and special keys pressed during recording. The data may be analyzed manually by scrolling the table. However, an easier way for analyzing captured data is to view it in text mode (Tools->View as Text). This will show all typed and downloaded data as text, discarding special keys. You can save this data to a text file in form of a table or in text form with File->Save as Table... and File->Save as Text...   Another useful option is phrase search (Search->Find text...). This option will scan through downloaded data discarding special characters. This option is often used to quickly find out if any 'forbidden' phrases were entered in record mode. KeeLog Downloader also allows to quickly move through the downloaded data. This includes jumping to the first and last memory location, and the first and last downloaded character. Use the options in the search menu (Search->Jump to...). For more detailed information, see the software section Hardware installation - KeyLogger, KeyLogger Pro, KeeVirus Installing the KeyLoggers and KeeVirus is fairly simple - just plug the device in between the keyboard and the PS/2 connector. On power-up the device will self-activate. 1. Find the PS/2 connector at the computer rear panel. 2. Disconnect the keyboard. 3. Connect the KeyLogger, KeyLogger Pro, or KeeVirus in place of the keyboard. 4. Connect the keyboard to the KeyLogger, KeyLogger Pro, or KeeVirus. On computer power-up the device will self-activate. You can find more details about installing and using these devices in the User Guides, available in the download section.