From 959f2acc5627456028a88a1f8f7a7a82df368728 Mon Sep 17 00:00:00 2001 From: Sebastian Lenzlinger <74497638+sebaschi@users.noreply.github.com> Date: Tue, 6 Jun 2023 12:23:22 +0200 Subject: [PATCH] Minor fixes. --- src/__pycache__/kldetect.cpython-311.pyc | Bin 0 -> 11637 bytes src/__pycache__/kldetect.cpython-39.pyc | Bin 0 -> 5838 bytes ...rspace-keylogger-detector.py => kldetect.py} | 12 +++++------- 3 files changed, 5 insertions(+), 7 deletions(-) create mode 100644 src/__pycache__/kldetect.cpython-311.pyc create mode 100644 src/__pycache__/kldetect.cpython-39.pyc rename src/{userspace-keylogger-detector.py => kldetect.py} (95%) diff --git a/src/__pycache__/kldetect.cpython-311.pyc b/src/__pycache__/kldetect.cpython-311.pyc new file mode 100644 index 0000000000000000000000000000000000000000..b68d961b28ce0ff6e86cca0b9533491317d40424 GIT binary patch literal 11637 zcmd5?Yit|Wm7d`Y$ssv>h@wQjY>h415)(=ELyoP7UAuPd#t+$vowQNo)zTbVrbUs; z%*c)jvQYv9rBf}c0P)&gq`TT;n<`Bg@t*~X-DVeV(?x#H2(u6|SS|uA3bemgg%d!? zuRZ4uUqi}mx4(8cb9iU&x$kq&`R=**Ctk0cf=lM!6r(#S>c8=&a@op(C%=He14^Vs zIz>&J|MWCX-fh!1^3O~&qHUTLnQ6PoPCG<<%n1)C+NWKjW0sD&Md!3fa@d4EHqe|^58tQwQJdyD4@at4oh-cE*le5v=H&DIsl#sJ0)R1Wjnq-d{wxV zO2p)ZASI;5v=Ea8DU(rthq*`WhAkr-&e?>LSWJqBeL+g56@!uQ$OfBuBdL5yJ;B1h z8js${%qOC9DxCqATT$r3n~At0N9PiEQkmJ=gfuKd9&sfjMP(@-olBXoBMWy7cl<^o zJ~tyTiW$idnYF?rPXJk>N>10^>|43Jxs}(~ogJ#Pqr`bt-=M}tbS|QDkrL-w=2lwn zd6qo|^4qjiTqp2JUPy20dR-hH<(wc+qB}U@KKP1b?`)H zjts1HQ1R5bL{`D3maoP%A3&`>s@4p|1pBvq-Q+4E(QYjX=1E0N98-q<`l6hW3_DDb z_zhENo~aX>WLj2Ysg$7HNC?+6sZ{26GCeCS#Nu!Z$@7dt{*7?5GGa5gn^FwOo z-eiDhYisK_PPgjm)|@@Mv*#g*x1c%&BHrVloK%lr(k5TjCtuXKmvrtWm3wJhN#6xY zWE|4(wePn5sQ-k^{+OeI#;ckE;;J6zcLw=X359z50E1|kF*oByK!*C?!R5Cqha8e?c!Y>h8>V;?-8&MuSFDRfHjE7NH zZb-W!CW0&nftXt2_IJPY_IFl9&DpIxVelAxsN`>1zP;h^UHA8{vYLO7?%$(wdp`HK z7Cg<`0cDGH5)Y+*mwkYm;c5DyVP1mvn0pP<=IOjG&*T_*zxEDWudWO1by~FDRrC!VeLP34lG$G2ul(1~eam1}^Iokp1(j5&P42N)ZD1|Y`bJaB@#Pc_SA?0$ z2BTu)Ry3JjSX83d?hNA)G)Wka#1jF?efk_2+6OS!S2<9w^gY`x>J{n%4OzNStw;bW zD2WFG)7Un$&)_Pi(_pVBQwbS|K@gV6to_P0Ih#l)-dK>1Wrt7(z?@vm#3XSBYLtv8 zW=M*W$y5fEiF|CN$~_91$b&$(eoOrpL_`f9gL{ozIr30ZTl>t{dP+nh!j%Q{b}Th# zFtPL{Qv#(vIHuzp3sS({_yOJH}DcU!hH^ah(OWAg(-L40Uc& zHWz+JS~ykm2kYDVPcOim7Cfc{^&ivy$3Sg)U!jYEJsW|c^}x_SUj5|2FAo3P3(_gMbz573nq|lwO)HcYV!g!%w!?gCPD3XApnJ+HBZxs^-=pNnZ0c@%_~j43bJX& zfM6T+?JToLc1LUmn*oahHckQ<7-0<-ksui_gT8LC@Nr(o>4*boj$4o*A%YlZ02tx` zOJl%+4;e5}OD->r#>soV%e^oV_P&QFilGj)5PgIcP8E6Y_s_g@X65w5EAL*=_}x0c zTO~J|h`vn*(vXCN{2sIT0!i)LQ$t{0o*G9Yh}C#^=TYVp_5|&G%+f$Da~j2zjNgAk z-~shia0KwF5gcuAOByljD(2pFS(Rd*PLDLetg2E3nAHP-hAdXhY@|Rv6cQP*ULcY6 z@Mo5a+g=47RDoMLSPmc(Zh;K4_C@9T@R95;#5M$nj0*($2-jmUxT2tB1cb+#bi^qk zL^XI5QDhbsP>hB{OvE!{!m!H=siY#cA&2i)Lb{fb6Em3wC7Cg?OvGl&6}ylWWf`YT zMWi@X1^87u4qv|pkBke2C2G@Vw+9Kz*t_O@6k2^#^B>mzhd2Dk*8RtRep~aO(fwyO z{1?{!7c~Dx-G33(0J~N4wCSEfR1LuzDS1FO(5|B;zC{fldZcLlq|Q&O{AAJJQgGpK z(+LSse%urvSUN`p zI-{^IP!?r_ma_IKSQ(FhMVD6tcBunuYmTcMxFkisodj5S6u!dzQKaMo*i{Cmg5fbU zF^Bgs#)E23Ck!46!8N+M=C0V(vThELiB!iRU4WDq;gKCMu3$-nT|d0M+WLcUz5gvO zxM$6!1@|wVLv=m(@Sx`E)m@;l?e_lF{hx>0VD7m32?2%eZ~gw8@4WdCrrdz;9{^42 z?JxHB{ayBNvTJ=mc=P=?*Iw6q_iywbUhh4u^^WPiV=H_y+@}Wc-t<70B;OkOJr?r? zlG?XT2jsfRV5xRX#J0>0X{)cq0$7sQm4I9_j=={f++XLJ$46I0=5b=xG+#hP|^X>wmttXO0tPejDfZ6w)vIgS<(K~c!$X3 ztE*Px;BZWlrDxVQ9J>PKmV}jv*rhO51+9j`#-!O>Mxf@{DQoFt$Vh|e#jaO0cl}zV zRR%Rp!0-%YusEMcE3)(wqPrX3dH(9)@{zalck>nBMbYEGfAGB{u;_yu z#75Z0k=jSkI9MDs$r}G0LVZ3=joF^z-q6OVKwnv1dPJ-P#O#)F$%saI5!o< zvk+&(^lu=SO+t+!odaSqw4r1=sU%~mWHvEV%|Ut@*b>NUIs`UZyWLyzw%i|C?bEz_ zb?;u7?yl(Cu3`t8P;Zow6}A-U+z1Hk0bw=tldd0i{e90r^k{(*Jusq@8=xGpGLVua zCj_9JD+*Aq{#z}!A!I_iKft=R>7ec2BF7V}zqKWgKqKC6JJC-)IB+7&Ja&5^_&Cg- z=ypEtW-z>y#&9nQ_uJ5**G)UBiu{fc8(41vL3ZF5;Tr2&za+m|Em3qe@j)9am*{Sa zt#{F3=`KV7R(lVq(leDEIElVxX&#XyI*uD%WMwb&c$U2rO@Gax?_4qH^y%MW|7W`q zgIgn3wm3Sbezu`E0f4p;DWnR>0>aT`m^w-b_ZN61J5EJ;nDnVsmUn%B%|Bd%&` z-s;7M)ecuSrm#>|lHkHNoaGPTi6c2%*FMs>p@xKHARzx32x2Xl>OQEkqdGgPvZKU< zM%%+MN$lZ*6Z~3**?YcaUjcr=TG;#6g}WD)E|k2%d*59C=F;h+)4S68c77=jCbpmy zUH+AW@9Ze-DEdQ%#m_x~mHqFG6~+i?jcWWpo!_VO`%1ij`5P-Q-aEGp8nV$b?C)Rw z*4pBu7e54BjbK^j4mZQSs;K9n4d}7}HFyNnV4VQeTx2HIrqZ( z^AcJtGU%Z4aNQui0K}s5e3hLG%obb`A~3v#Ovnj<$lr=|9~)zw+K+ zXk5R}^{ZTedFAk&IS7wht1i$jTrrp_o6QpXq6l{QF9?0tXGIUzss4x50L0-~m9M6B zSjx6>;KQq%uFdMJespq8s};JoKM(>31zo?qY*cbt@WSWm<+gecyMpV=@}=OCv3xao z=`Bjts&GIW>s!#Ydthk+co`ez3;dW&lFGC2Z->VL3wd0cmM;Z;TIFk-MT;}%gc%XZ zb2-ND9=g!#y8ILJ_wXZjWm2l3b?5%_; z>Sm}CZj=w@nMw@g8B~UAZz7Z`+MzxG_&$QiykPXEVPU$xG&C8@<%K_KJ~V7oTII$1 zmS<+EcYMUl-VJ@@&N*(;QrkV>pIoCJON;;7(qf0TEZD_Ei-7Q^u3s8wKJ`y3JyJ+7$PgUY#0IV2{=yV z%7~`Oc@Eg0UQCPG(BiNdvnFqc?RgzHjf z9{s^-0OTXW%W!%EH^9j;5*hZG6N7|ai%AiL|8im>CdHJ5a4VKt1SoGdA8J{xT6vAo zvz>YcI4=HZObm$Q$uxJ-cytIVE8-`qqWut)k7=R?KSr#Zgj*m z^9#qad(0CVxW#6k*pTb?)v9d&0~yQxK(=60E&RH9ul0QPntF9Xy@2;a-uwqj@L;5u zoa!JO?!-?*HnyabSj{mc$AJK*%}8+eMtTlk7;v$eEBvl)59XMweX<{i3w20cJF5`w1SqShrrz&sK4X6-t z*W)f#?J93Hwloc|v{Vm(G{ipvH!DHUy_3N^DqTJ9QRL zMsxzpj_0(V!+OtQ+>2y=s{a{{eO70mRoQ1tY`YpBQb%6U*t0r&R%Oqkzsk3C3U(H8 zAqZYoAO#kD75BM^p?7`n`7~}Px-Ckcmiztp<%gs1-g)oNyV3WenrFA}*}ZfMN+@JC zwo7NbRJIEWSWzBMYwV!T4yx=RWZxEEx==o}(FvaYc5{<-(_y!_fb-@*f+y63re<>Tp}PJj5?&tB64<9c9RB{zC+CeV8W{1t-Un+f#Z z)P1YP)gr;w#u)5zLE%^TIxv1D@{d9=S=(<4~ZBUsbj8-d7r zAhOo~@iRYt=EI?%4QYYHdf>21Zmj7MtSRtU2-frn*0k_z7?a}xVogY!j zT?%#maP-H_>IF?WpbH1I?t^;wK`k_@henq!Y&xj!9V#0xc7VLu?1u<}x_QEC@2Kj* zyU6!$@O#(!y{kEmAJzF$l^@;ulBc-#P0DW%f_%Gts&B8x4d~o}$_*4l5vZlBgAmwB z=UZ0#O^*ZdITWtlb1lQJS)GHU*os~cmq`jIF-70Kv&&}-@I$s*3e~q$<9c>J~J1m(Id&J$Nvmg<|YIgcNwpI;C;lI@hg|yVL@mL3NzA{hp$NXKY^(x^%Ya zY*~3}-5FM$VN%?H#trJ+pvnzeiu*jgYa=|c9v;xb5j`Bi<5U$pf!1Q|1)y5^bsfTZ z(yDFge6a(zDQWv8AuwEAXoKrshpO}pt-YrAjBDJ4&P}M~{*4oMGgfj;#X^=hD?)`E+mFX`1?UV)*$(%&#LngnxaAeSXaO>oEqy zlQf2pV))-_+i5$TRhyZak0sMHGq8J!Xfx7fS|c>=rhATB?@hAK4HZn1@mjSl0}yXN_7>x##Aa? zY#CVc60oHkFIB?3@wG|>7GJBx=b(3OQdJUU zXgC*9B|Jw5Kuc9fJ58goSBTq5!+u+pgj_UOrYh-h(q4=$laQYV#b_n{EDa8?D)BAQ pG$@=pDl!zy7qaV2r^<8|**2AJ)7Y@ihCw-*_a<<3K_r1l{|l8lxRC$= literal 0 HcmV?d00001 diff --git a/src/__pycache__/kldetect.cpython-39.pyc b/src/__pycache__/kldetect.cpython-39.pyc new file mode 100644 index 0000000000000000000000000000000000000000..ddab654f5106b2894ed73e8d14fe9f7cf6600ac8 GIT binary patch literal 5838 zcmaJ_%X8bt8OP#9h@xnk*3(uT)Q_ z$`J;dwjY=xs`ui3nB}#6{!D3(7{hq(?+x4cV z${Kz*t>5q;p4YU0QRC>(K;s6UrImzO^cgNn_FH9 zkHf9z1h+fPEAvuwk~@6jiPo&}GM~hIidXm)-c?@Zr|>?-Yy33cHD2du@IK9_`3&B5 zKFjCuKEvnv0^Za7EI)_$41bL;@|T{l<}5$YUq;Uyclj%L&-)Af)lFUe#h>5T80cQr z8n1s19<-IzZO74i&{=xC5lFuk28r}}t1IG;@V1gm@(Y>1G??M_WZc>e!fxgep@C>oBnPXcRIef$gxmc#$qWE?WN7IXkO~> z=H>Q=-`;E`JszLIf{BenV-@BwF^Sq3zr-u;s`!mi;jF{-#Q}6AWEbchOXT3-Ss#O{Ya2>pam&J2{qx+az@h`ZqTf4 z1xbP}Tf?5bG^ib_OORLQ)k5yWc?;-Ercr3jW+tSsvpTEdsh|`z&?dVW{-{p8C{4Ji zK*FrAXW9W1^Qvx8eO1d~b7XhV*-FC{CT8Yl*OME$9VB58ZRU>fy^wkuOw3~VIGs~4 z!4}N{OPGWiBNM6Ug2-;;8U1JnG7%y!`3wb&L%9WK2Mi|i;jfK7wx{nInSs`oFEy$E zUR#I3aN~(1(Fesdv6yLnQ(9oe?w2z5R6Bqxkr`|+ZdZvVxKUbP;{MK35OsTUX>Io+ zkvAqIeL%){i4g)!_ZxqfN%S;HA9;jtHP z=7tyT<`cvH5>X>kNTx~^x%ns#qK28zym0m0B)G^;9*6{fK^qp7o}&d6xeNc7w9A;2 zR8VNJwrSYgEL&vaO|;u2x8aY}Nk*>h>=r5#{>$N;f4Hy*Yl8~wP^GRs-k62OL8`U; zus9R{eS>LH?OiRodRcis(;nchP|#S(+2hoBBPm1ZW()^|OAA0YxHSp2#UeJ#*?MlG zbL+TK))gEocy9s4iT591{>U-`UYF25VGbi!eudHWyn-qw!AJ)H-A9Z=X&wO1?rYI^ z6l__$9~H1AZE;POINXYWsiWCoW>veaag$q5AQZA(GA`Jry&_1msnwI~7q6zT5I!j^ zS#}kAx$7PX=B|ug!u>cpK_`iQ6^}xM4jFD`kCEv2*&p?76Glru)?m4TsL;^GS+sJa z8}Q?TDqkaEw&Shtb<&TdGAr&9s^Mov41L&Ox+?lM5KVa|s z=o^#G80^(C3Yj1X?ZW^MhNh*jhzl6O-UL>;)eb?GP(DFIE67mZQEnsr3S~V%!$_hG zp9!+0v0W{6j4UTbgOe_x?>UX@bFdZ(y>kOjaR*MJt3U{R>+9SE9J{C)6vVi_091o@ znVG4B+WVS*#8FnYZTE!ZgeM%Qw36Bs-`h)RX$i4T_L7{5)LKERviuDjL^w;3a0&sG zF-yqgaUeGYfflqTMbK?nf-s;tSuCQYAl{*I_+RAb6>LIDlS+b)>#nABcVxmZ@ZkVX zYOJC=&|jU28|WR24x~SlvVxOqs7Ot+N5FQZOs2TXb!zQsVv!r3fkdEay@eLMY|y&O zjlBXy;Aa$OQvITL55xJWby!?CFC8NQ3Z!&r}T)A&@;v-5i+tEg*CT`(*bb8b`)>|d5{Vz#8JRm zKcWBSqxuIXRSGP6phY^62N2PKwJ&2caILJpI*KKQLSMmH5mkOfvvj3lah-aP@jD$v zfegGbNd4Am5g!u^wd%Uc39leK5riZsq69&fQmaHol2alUC`K!LI^0F&!rK*$6j?Fb z*C+`<)~Ad2I3Nvm3-ue^MxF5z45EqIj>@4SC_X_#LQh%sm>JEQm;)Ra8BSwzC4KWI zW&dJ}pp{bl<9XoV9I%|4yGzjrIorLLv*^~>~0|_yKoW2Z}(%Q+DPXL zJ3E@Pdr|V(7w)bb3paxFRbpr_Ij|!p`j^=tN$amsUUd$?Z?>+)-{e z3`9Hzff6Q#Qdgw` z^8!nS8A_{&5)`)wN0l0on&F@UWBfk)wy(&NbmW9Oc))Za9CKi(7R*d9V*Z{H0KKt> zg~v{B$+DbOxPM`(OUe8#q4A4tuhtQ{*G9qmgvGIl$QUCNog!?4CzPqic8d?ja| z>B7aj_6Q=XfQZ=wBCzV;Fji7dK3llIqQ46IXNi8b^S_VGQGIIH>RuUh6hJ)Fx1G_P zxu=NMyu7Jn=NssqRIAVT7r5dCJr(MCO1M0}#vOTlJm9!9B+lC#$G@umU@oqWZ&W$YTmpfGii3Wq`gv$wjR9cllC=-BHWs`3!qO%FeK+ zobdEYy70mifV$6cR3?X;4HXE|IfAht<8I^PxX-4}&}q}z+k?Z3TO3wgb#_?Jk+I%I zqPCn??-uCfstb_i;+XAz{`Nz6C3cfu(hb@{+)D@!)V&Ih+P#RU)2k$$zwjz}9sf)j{H@k(8I%%h@G?Aq{bC~zNfB+XWUHAu1rC9BU_ z^UR?XM%PCLuu*0y-bL{rs;GSXjpDY2&WOcr%!?E6m(_)fI_s;9LY>A`HmVLYDjNpI z#sXJb;%%&siwIv9asTWK@4Jc|fKqEg;Xj`{OoWE=DW=?@DIZcnVi7;5VucFI>keW3 zFtbuOAA+)Gl~W3eEh_RTv~EKS^41=7mfh zNnt2~RT^oQ=~k#n*G7vcbTp*k(yWk+3|oboeo3E_uJY3-wDT0*$yX>e(?*1~Q6jcl z6lbffHmI8jO{Q^}71@LOd-R1t(b&PnQIHwuhJ_Mw#bDK+U1Mtn?#(l2Gcg|<{` zc!ipD&sUh8x_Y2XfJ2Kb4Dbf^QJSlgze7!r=pm$NwT{Ggm0l_VJJ+^i-V6QfDqhnO jq~P6wOb-9J^)ejWsW~NQ0`E!3a>`D{DVOW$5f1wwDnltq literal 0 HcmV?d00001 diff --git a/src/userspace-keylogger-detector.py b/src/kldetect.py similarity index 95% rename from src/userspace-keylogger-detector.py rename to src/kldetect.py index 5771e25..61e29ff 100755 --- a/src/userspace-keylogger-detector.py +++ b/src/kldetect.py @@ -6,15 +6,13 @@ import sys # for exiting import signal # for killing processes -# -white_listed_programs_file = 'white_listed_programs.txt' -auto_kill_programs_file = 'auto_kill_programs.txt' -kbd_names_file = 'kbd_names.txt' +white_listed_programs_file = 'config/white_listed_programs.txt' +auto_kill_programs_file = 'config/auto_kill_programs.txt' +kbd_names_file = 'config/kbd_names.txt' auto_kill_option = False verbose_option = False safe_option = False kbd_names = ['kbd'] -fuser_option = "-s" # -s for silent, -v for verbose # Check if the user is in sudo mode def check_sudo(): @@ -63,12 +61,12 @@ def print_list_to_file(list, file): # find pids using file using fuser def get_pids(file): try: - pids = subprocess.check_output(['fuser',fuser_option, file]).decode('utf-8').split() + pids = subprocess.check_output(['fuser', file]).decode('utf-8').split() except subprocess.CalledProcessError: if verbose_option: print("[-] Error: fuser failed to run on", file) return [] - pids = [int(pid) for pid in pids] + #pids = [int(pid) for pid in pids] return pids # clear a file