Kee Log

Introduction

Familiar with the concept of hardware keylogging? A hardware keylogger is a perfect solution for monitoring user activity, at very low risk of disclosure. A hardware keylogger is a purely electronic device, so no access to the operating system is required, no traces are left, and software has no possibility of detecting such a device. However, the hardware keylogger concept inherits one weakness: physical access to the keylogger is required for retrieving captured data. This problem has finally found its solution: a Wireless Keylogger.

KeeLog has already released one open source PS/2 hardware keylogger design to the public. Now, we are doing it again with the DIY Wireless Keylogger. This design is fully free for private and commercial use, with the following restrictions:

1. All materials presented on this web page are the intellectual property of KeeLog and using them constitutes acceptance of the license terms below and the general User Agreement.
2. This Wireless Keylogger project is provided as is, with all faults, and with no warranty whatsoever.

The Wireless Keylogger consists of two main building blocks: the transmitter, and the receiver. The actual keylogging takes place in the transmitter, which is in fact a PS/2 hardware keylogger, with a built-in 2.4 GHz wireless module. Captured keystroke data is transmitted through the radio-link in real-time, rather than getting stored. The receiver on the other hand, is a wireless acquisition unit with a USB interface. All keystroke data received from the transmitter is sent to the host computer via USB. From the software side, this data is available through a virtual COM port, allowing any terminal client to be used for visualizing keystroke data.

Wireless Keylogger block scheme

The entire system works in real-time, so text typed on the remote computer is seen immediately on the receiver side. The system has a maximum range of around 50 yards (meters). This corresponds to an effective range of around 20 yards (meters) through 2-4 walls, depending on their thickness.

Wireless Keylogger transmitter

Wireless Keylogger receiver

Both the transmitter and the receiver are based on the same schematics and circuit board. Both have the same form factor, and are intended for mounting on PS/2 and USB extension cables. The recommended housing is an EMC-balun enclosure, which makes the device resemble a standard extension cable.
 

Components

This article describes the entire assembly process of the DIY Wireless Keylogger. Depending on your skills, you may choose to create your own Wireless Keylogger from scratch, or order a preassembled one from us. We can deliver a set of components with pre-programmed microcontrollers and standard casing (as seen on pictures), or a fully assembled and tested set of devices. Please scroll to the kits section for more details.

If you decide to create your own Wireless Keylogger, you should have some basic experience with electronics and soldering, ideally with SMT (Surface Mounted Technology). The easiest option includes ordering a kit with components from us, and doing the soldering, cabling, and final assembly on your own. This involves having a temperature-controlled soldering iron and quite good soldering skills. If you decide to design and produce the PCBs yourself, you should have significant experience in this field and proper equipment.

The table below summarizes the BOM (Bill of Materials) contained in a single transmitter or receiver unit. An additional PS/2 extension cable is required for the transmitter, and a USB type A connector or cable is required for the receiver.
 

Set of electronic components

Cables, enclosure, and PCBs

DesignatorDescriptionFootprintQty

U1Microcontroller AT91SAM7S64TQFP641

U2Transceiver nRF2401QFN241

U3Voltage regulator MCP1700T-330SOT-231

Q1Crystal 18.432 MHzHC-49 SMD1

Q2Crystal 16 MHzHC-49 SMD1

R1, R2Resistor 1.5 kΩ08052

R3, R4Resistor 27 Ω08052

R5Resistor 1 MΩ08051

R6Resistor 22 kΩ08051

C1, C27Capacitor 10 nF08052

C2, C28Capacitor 1 nF08052

C3, C4, C6, C7, C8Capacitor 22 pF08055

C5Capacitor 33 nF08051

C9Capacitor 2.2 pF08051

C10, C11Capacitor 1 pF08052

C12, C22, C23, C24, C25, C26, C32, C33, C34, C42, C43Capacitor 100 nF080511

C21, C31, C41Capacitor 1 µF08053

L1Ferrite Bead08051

L2Inductor 3.6 nH08051

L3Inductor 18 nH08051

Wireless Keylogger BOM (PDF version)

Both the transmitter and the receiver use the same PCB and the same set of components (they differ by cabling and firmware). The Atmel AT91SAM7S64 microcontroller and the nRF2401 wireless transceiver are the core components. Both require crystals for proper operation. Besides the MCP1700 voltage regulator, all other components are passive (resistors, capacitors, and a few inductors). A simple wire is recommended for the dipole antenna. The double-sided two-layer PCB is shown on the pictures below.