joelsernamoreno/EvilCrow-Keylogger

Not logging Caps or special characters - shift key

Opened this issue · 6 comments

Everything is working great but it's not capturing caps or special characters...it's just logging as if the shift key wasn't pressed...am I missing some setting I need to specify in the code to enable that? same result in the log file in the card and on the web page of the keylogger when connected.

Tried with two different keyboards and 3 different operating systems on 2 computers, all the same results

Full log of programming:

┌──(squirrel㉿kaliLaptop)-[~/keylogger-pio]
└─$ ./flash.sh
Processing LilyPadUSB (platform: atmelavr; framework: arduino; board: LilyPadUSB)

Verbose mode can be enabled via -v, --verbose option
CONFIGURATION: https://docs.platformio.org/page/boards/atmelavr/LilyPadUSB.html
PLATFORM: Atmel AVR (4.2.0) > Arduino LilyPad USB
HARDWARE: ATMEGA32U4 8MHz, 2.50KB RAM, 28KB Flash
DEBUG: Current (simavr) External (simavr)
PACKAGES:

  • framework-arduino-avr @ 5.1.0
  • tool-avrdude @ 1.60300.200527 (6.3.0)
  • toolchain-atmelavr @ 1.70300.191015 (7.3.0)
    Converting programmer.ino
    LDF: Library Dependency Finder -> https://bit.ly/configure-pio-ldf
    LDF Modes: Finder ~ chain, Compatibility ~ soft
    Found 5 compatible libraries
    Scanning dependencies...
    No dependencies
    Building in release mode
    Compiling .pio/build/LilyPadUSB/src/programmer.ino.cpp.o
    Linking .pio/build/LilyPadUSB/firmware.elf
    Checking size .pio/build/LilyPadUSB/firmware.elf
    Advanced Memory Usage is available via "PlatformIO Home > Project Inspect"
    RAM: [== ] 21.2% (used 542 bytes from 2560 bytes)
    Flash: [== ] 16.0% (used 4580 bytes from 28672 bytes)
    Configuring upload protocol...
    AVAILABLE: avr109
    CURRENT: upload_protocol = avr109
    Looking for upload port...
    Auto-detected: /dev/ttyACM0
    Forcing reset using 1200bps open/close on port /dev/ttyACM0
    Waiting for the new upload port...
    Uploading .pio/build/LilyPadUSB/firmware.hex

Connecting to programmer: .
Found programmer: Id = "CATERIN"; type = S
Software Version = 1.0; No Hardware Version given.
Programmer supports auto addr increment.
Programmer supports buffered memory access with buffersize=128 bytes.

Programmer supports the following devices:
Device code: 0x44

avrdude: AVR device initialized and ready to accept instructions

Reading | ################################################## | 100% 0.00s

avrdude: Device signature = 0x1e9587 (probably m32u4)
avrdude: reading input file ".pio/build/LilyPadUSB/firmware.hex"
avrdude: writing flash (4580 bytes):

Writing | ################################################## | 100% 0.37s

avrdude: 4580 bytes of flash written
avrdude: verifying flash memory against .pio/build/LilyPadUSB/firmware.hex:
avrdude: load data flash data from input file .pio/build/LilyPadUSB/firmware.hex:
avrdude: input file .pio/build/LilyPadUSB/firmware.hex contains 4580 bytes
avrdude: reading on-chip flash data:

Reading | ################################################## | 100% 0.06s

avrdude: verifying ...
avrdude: 4580 bytes of flash verified

avrdude: safemode: Fuses OK (E:CE, H:D8, L:FF)

avrdude done. Thank you.

=========================================== [SUCCESS] Took 2.83 seconds ===========================================
Processing keylogger (platform: espressif32@6.1.0; framework: arduino; board: pico32)

Verbose mode can be enabled via -v, --verbose option
CONFIGURATION: https://docs.platformio.org/page/boards/espressif32/pico32.html
PLATFORM: Espressif 32 (6.1.0) > ESP32 Pico Kit
HARDWARE: ESP32 80MHz, 320KB RAM, 4MB Flash
DEBUG: Current (cmsis-dap) External (cmsis-dap, esp-bridge, esp-prog, iot-bus-jtag, jlink, minimodule, olimex-arm-usb-ocd, olimex-arm-usb-ocd-h, olimex-arm-usb-tiny-h, olimex-jtag-tiny, tumpa)
PACKAGES:

  • framework-arduinoespressif32 @ 3.20007.0 (2.0.7)
  • tool-esptoolpy @ 1.40500.0 (4.5.0)
  • tool-mkfatfs @ 2.0.1
  • tool-mklittlefs @ 1.203.210628 (2.3)
  • tool-mkspiffs @ 2.230.0 (2.30)
  • toolchain-xtensa-esp32 @ 8.4.0+2021r2-patch5
    Converting ESP32.ino
    LDF: Library Dependency Finder -> https://bit.ly/configure-pio-ldf
    LDF Modes: Finder ~ chain, Compatibility ~ soft
    Found 33 compatible libraries
    Scanning dependencies...
    Dependency Graph
    |-- SPIFFS @ 2.0.0
    |-- EEPROM @ 2.0.0
    |-- WebServer @ 2.0.0
    |-- WiFi @ 2.0.0
    Building in release mode
    Compiling .pio/build/keylogger/src/ESP32.ino.cpp.o
    /home/squirrel/EvilCrow-Keylogger/code/ESP32/ESP32.ino: In lambda function:
    /home/squirrel/EvilCrow-Keylogger/code/ESP32/ESP32.ino:87:3: warning: control reaches end of non-void function [-Wreturn-type]
    });
    ^
    Retrieving maximum program size .pio/build/keylogger/firmware.elf
    Checking size .pio/build/keylogger/firmware.elf
    Advanced Memory Usage is available via "PlatformIO Home > Project Inspect"
    RAM: [= ] 13.6% (used 44508 bytes from 327680 bytes)
    Flash: [====== ] 61.1% (used 801057 bytes from 1310720 bytes)
    Configuring upload protocol...
    AVAILABLE: cmsis-dap, esp-bridge, esp-prog, espota, esptool, iot-bus-jtag, jlink, minimodule, olimex-arm-usb-ocd, olimex-arm-usb-ocd-h, olimex-arm-usb-tiny-h, olimex-jtag-tiny, tumpa
    CURRENT: upload_protocol = esptool
    Looking for upload port...
    Auto-detected: /dev/ttyACM0
    Uploading .pio/build/keylogger/firmware.bin
    esptool.py v4.5
    Found 1 serial ports
    Serial port /dev/ttyACM0
    WARNING: Pre-connection option "no_reset" was selected. Connection may fail if the chip is not in bootloader or flasher stub mode.
    Connecting....
    Chip is ESP32-PICO-D4 (revision v1.0)
    Features: WiFi, BT, Dual Core, 240MHz, Embedded Flash, VRef calibration in efuse, Coding Scheme None
    WARNING: Detected crystal freq 42.39MHz is quite different to normalized freq 40MHz. Unsupported crystal in use?
    Crystal is 40MHz
    MAC: d4:d4:da:88:72:94
    Stub is already running. No upload is necessary.
    Configuring flash size...
    Auto-detected Flash size: 4MB
    Flash will be erased from 0x00001000 to 0x00005fff...
    Flash will be erased from 0x00008000 to 0x00008fff...
    Flash will be erased from 0x0000e000 to 0x0000ffff...
    Flash will be erased from 0x00010000 to 0x000d4fff...
    Compressed 17488 bytes to 12168...
    Writing at 0x00001000... (100 %)
    Wrote 17488 bytes (12168 compressed) at 0x00001000 in 1.4 seconds (effective 101.6 kbit/s)...
    Hash of data verified.
    Compressed 3072 bytes to 146...
    Writing at 0x00008000... (100 %)
    Wrote 3072 bytes (146 compressed) at 0x00008000 in 0.1 seconds (effective 390.0 kbit/s)...
    Hash of data verified.
    Compressed 8192 bytes to 47...
    Writing at 0x0000e000... (100 %)
    Wrote 8192 bytes (47 compressed) at 0x0000e000 in 0.1 seconds (effective 636.6 kbit/s)...
    Hash of data verified.
    Compressed 806800 bytes to 521906...
    Writing at 0x00010000... (3 %)
    Writing at 0x0001c45c... (6 %)
    Writing at 0x00026691... (9 %)
    Writing at 0x00032694... (12 %)
    Writing at 0x000381b4... (15 %)
    Writing at 0x0003dc0a... (18 %)
    Writing at 0x0004306e... (21 %)
    Writing at 0x0004880c... (25 %)
    Writing at 0x0004d923... (28 %)
    Writing at 0x00052a1a... (31 %)
    Writing at 0x00057dd4... (34 %)
    Writing at 0x0005d09b... (37 %)
    Writing at 0x000622b3... (40 %)
    Writing at 0x00067553... (43 %)
    Writing at 0x0006c976... (46 %)
    Writing at 0x00071b78... (50 %)
    Writing at 0x0007770d... (53 %)
    Writing at 0x0007cf81... (56 %)
    Writing at 0x000820ee... (59 %)
    Writing at 0x000875e2... (62 %)
    Writing at 0x0008c7cb... (65 %)
    Writing at 0x00091ec4... (68 %)
    Writing at 0x000976b1... (71 %)
    Writing at 0x0009d376... (75 %)
    Writing at 0x000a2e33... (78 %)
    Writing at 0x000a8614... (81 %)
    Writing at 0x000b0d0e... (84 %)
    Writing at 0x000b916e... (87 %)
    Writing at 0x000be20c... (90 %)
    Writing at 0x000c5312... (93 %)
    Writing at 0x000cabfc... (96 %)
    Writing at 0x000d00aa... (100 %)
    Wrote 806800 bytes (521906 compressed) at 0x00010000 in 48.1 seconds (effective 134.3 kbit/s)...
    Hash of data verified.

Leaving...
Hard resetting via RTS pin...
========================================== [SUCCESS] Took 52.87 seconds ==========================================
Processing LilyPadUSB (platform: atmelavr; framework: arduino; board: LilyPadUSB)

Verbose mode can be enabled via -v, --verbose option
CONFIGURATION: https://docs.platformio.org/page/boards/atmelavr/LilyPadUSB.html
PLATFORM: Atmel AVR (4.2.0) > Arduino LilyPad USB
HARDWARE: ATMEGA32U4 8MHz, 2.50KB RAM, 28KB Flash
DEBUG: Current (simavr) External (simavr)
PACKAGES:

  • framework-arduino-avr @ 5.1.0
  • tool-avrdude @ 1.60300.200527 (6.3.0)
  • toolchain-atmelavr @ 1.70300.191015 (7.3.0)
    Converting ATMEGA32U4.ino
    LDF: Library Dependency Finder -> https://bit.ly/configure-pio-ldf
    LDF Modes: Finder ~ chain, Compatibility ~ soft
    Found 9 compatible libraries
    Scanning dependencies...
    Dependency Graph
    |-- Mouse @ 1.0.1
    |-- SD @ 1.2.4
    |-- Keyboard @ 1.0.1
    |-- SPI @ 1.0
    |-- USB-Host-Shield-20 @ 1.3.2
    Building in release mode
    Compiling .pio/build/LilyPadUSB/src/ATMEGA32U4.ino.cpp.o
    Compiling .pio/build/LilyPadUSB/lib90f/Keyboard/Keyboard.cpp.o
    /home/squirrel/EvilCrow-Keylogger/code/ATMEGA32U4/ATMEGA32U4.ino: In member function 'virtual void KbdRptParser::OnKeyUp(uint8_t, uint8_t)':
    /home/squirrel/EvilCrow-Keylogger/code/ATMEGA32U4/ATMEGA32U4.ino:70:38: warning: right operand of comma operator has no effect [-Wunused-value]
    key_modifier = key|modifiersard,HEX;
    ^
    /home/squirrel/EvilCrow-Keylogger/code/ATMEGA32U4/ATMEGA32U4.ino: In function 'char ProcessCommand()':
    /home/squirrel/EvilCrow-Keylogger/code/ATMEGA32U4/ATMEGA32U4.ino:130:1: warning: no return statement in function returning non-void [-Wreturn-type]
    }
    ^
    Archiving .pio/build/LilyPadUSB/lib90f/libKeyboard.a
    Indexing .pio/build/LilyPadUSB/lib90f/libKeyboard.a
    Linking .pio/build/LilyPadUSB/firmware.elf
    Checking size .pio/build/LilyPadUSB/firmware.elf
    Advanced Memory Usage is available via "PlatformIO Home > Project Inspect"
    RAM: [======= ] 65.8% (used 1685 bytes from 2560 bytes)
    Flash: [==========] 98.4% (used 28208 bytes from 28672 bytes)
    Configuring upload protocol...
    AVAILABLE: avr109
    CURRENT: upload_protocol = avr109
    Looking for upload port...
    Auto-detected: /dev/ttyACM0
    Forcing reset using 1200bps open/close on port /dev/ttyACM0
    Waiting for the new upload port...
    Uploading .pio/build/LilyPadUSB/firmware.hex

Connecting to programmer: .
Found programmer: Id = "CATERIN"; type = S
Software Version = 1.0; No Hardware Version given.
Programmer supports auto addr increment.
Programmer supports buffered memory access with buffersize=128 bytes.

Programmer supports the following devices:
Device code: 0x44

avrdude: AVR device initialized and ready to accept instructions

Reading | ################################################## | 100% 0.00s

avrdude: Device signature = 0x1e9587 (probably m32u4)
avrdude: reading input file ".pio/build/LilyPadUSB/firmware.hex"
avrdude: writing flash (28208 bytes):

Writing | ################################################## | 100% 2.29s

avrdude: 28208 bytes of flash written
avrdude: verifying flash memory against .pio/build/LilyPadUSB/firmware.hex:
avrdude: load data flash data from input file .pio/build/LilyPadUSB/firmware.hex:
avrdude: input file .pio/build/LilyPadUSB/firmware.hex contains 28208 bytes
avrdude: reading on-chip flash data:

Reading | ################################################## | 100% 0.35s

avrdude: verifying ...
avrdude: 28208 bytes of flash verified

avrdude: safemode: Fuses OK (E:CE, H:D8, L:FF)

avrdude done. Thank you.

=========================================== [SUCCESS] Took 5.60 seconds ===========================================

Hello!

Are you pressing the key combination too fast?

Try pressing and holding the shift key, then press and release a key (e.g. the letter a), then release the shift key

Let me know if this works and I will give you a solution

did not work... this is what I typed on the keyboard connected to the keylogger: "This is a test of CAPS and Specal Characters 1234567890 !@#$%^&*()" and this is what the log shows on the web page and on the actual log file in the memory card: "this is a test of caps and special characters 1234567890 1234567890"

So it's logging but not exactly useful. For info I'm in North America and we don't have Alt GR keys on keyboards. I've tried 3 keyboards and all the same result on two different computers so I'm 95% sure it's something in the code or keyboard files.

This is very strange. What is the layout of your keyboard and what is the layout you are using in the keylogger? This is the first time someone reports this problem

the same issue, capslock key is not registered (tried on different keyboards with EN_US layout)