Argus Keylogger

A lightweight, asynchronous hardware keylogger built for Linux systems running modern display servers like Wayland or X11.

By using the kernel-level evdev interface, Argus captures raw hardware input events directly from /dev/input/, completely bypassing the application isolation security barriers imposed by Wayland desktop environments.

🚀 Features

• Wayland Compatible: Bypasses display server restrictions by reading input devices directly.
• Asynchronous Execution: Powered by asyncio to monitor inputs efficiently without burning CPU cycles.
• Intelligent Formatting: Cleans up raw event codes into human-readable text (converts spaces, tabs, and captures backspace sequences).
• Session Timestamps: Structures logs chronologically by tagging the exact time lines are finished.

📦 Prerequisites

Since this tool interacts directly with kernel-level device input files, you need to make sure the core Linux development packages are present on your system.

For Fedora / RHEL / CentOS:

sudo dnf install python3-devel kbd

🛠️ Installation

1. Clone or navigate to your project directory:

   cd ~/Argus

2. Set up a virtual environment and activate it:

   python3 -m venv .venv
   source .venv/bin/activate

3. Install dependencies:

   pip install evdev

🖥️ Usage

Running Interactively

Because the script reads directly from hardware device streams (/dev/input/*), it requires root administrative privileges. Run it while passing your virtual environment's path parameters:

sudo env "PATH=$PATH" python3 keylogger.py

Press ESC at any point to exit cleanly.

Running Silently in the Background

To run the keylogger in the background without keeping a terminal terminal window open, execute:

sudo nohup env "PATH=$PATH" python3 keylogger.py > /dev/null 2>&1 &

To stop the background process later, locate its Process ID (PID) and terminate it:

ps aux | grep keylogger.py
sudo kill <PID>

📝 Log Format Example

Captured keystrokes are securely written downstream directly into log.txt with formatted timestamps:

--- Logging Started: 2026-08-21 14:45:12 ---
[Session Started] hello my name is shatta wale  [14:45:22]
testing out the backspace[BACKSPACE] stability  [14:46:01]

--- Logging Ended: 2026-08-21 14:46:18 ---

⚠️ Disclaimer

This tool is built strictly for authorized educational research, personal accessibility prototyping, or authorized penetration testing modules. Do not deploy this on systems you do not own or lack explicit permission to monitor.