An update to fsb's logKext tool. Runs on 10.9 Mavericks!
Release Date: 2014-03-01
Summary: LogKext is an open source keylogger for Mac OS X, a product of FSB software.
Requirements: Mac OS X 10.7.x - 10.9.x
(older versions can be found on the downloads page.)
How to get started: Control and usage of logKext is through logKextClient. LogKextClient runs through the Mac OS X Terminal.
Locate the Terminal Application (
The window that pops up will have a command prompt that looks something like this:
You will be prompted for your account password (you must be an administrator). Enter it. You will not see the password echoed to the screen as you type it.
Next, logKext will prompt you for your logKext password:
Type in your logKext password. The default password is "logKext". You will not see the password echoed to the screen as you type it.
LogKextClient is an interactive client that allows you to change preference values that will change the behavior of your keylogger. Type
helpto get the help screen.
Most likely, you will want to see the logfile! To do this, use the
opencommand. It will save the decrypted logfile to your desktop, and open it in a text editor. If you haven't yet typed 100 characters, you will not yet have a logfile. Come back later and try again.
A standalone script has been installed in your computer's root directory that will uninstall logKext. It is called
LogKextUninstall.command. Double-click it to run.
If you have changed your password or turned encryption on or off, you must delete the logfile before these changes take effect; otherwise your client will try to decrypt using a different password than your daemon is encrypting: this results in "gibberish".
Use the logKextClient
listcommand to see where your logfile is, then quit logKextClient. Find the logfile using the path, and throw it in the trash. If you try to empty the trash, don't worry if it says:
The operation can't be completed because the item "com.fsb.logKext" is in use.
You can also delete the logfile from the terminal if you know how (
sudo rm -f). You will need to enter your administrator password.
Note: For security reasons, it is recommended that you change your password from the default setting.