ttyrpld

ttyrpld is a cool tool that acts as a Kernel-based keylogger and screenlogger for Linux, FreeBSD, and OpenBSD. It even comes with a real-time log analyzer that follows your logs as they happen!

What ttyrpld Supports

This software works well with most tty types. Whether you're using vc, bsd, or unix98-style ptys (like xterm/ssh), or even serial and isdn setups, you’re covered.

Why Kernel Matters

The best part? Since it’s built right into the Kernel, it's pretty much unavoidable for the default user. Plus, if the user-space logging daemon isn’t running, it won’t slow things down at all!

The Four Key Parts of ttyrpld

ttyrpld has four main components:

• kpatch: This is a Kernel patch that adds some lines to create the rpldev extension hooks. These hooks let any module jump on board. Just remember, this system isn’t designed for black-hats looking to cover their tracks.


• rpldev: This Kernel module grabs data from the tty line and provides a character device for the logging daemon in user-space. With the right terminal settings, you can get an exact replay of what happened!


• Integration for OpenBSD: For systems like OpenBSD where loading modules isn’t possible, these two components are combined into one neat kpatch.


• rpld: Once this daemon gets the captured data, it can store it however it likes—compressed or not—thanks to all those handy libraries available in user-space (which you don’t get in Kernel space).

Get Started with ttyrpld!

If you want to check it out or download it now, click here!