views:

140

answers:

3

Hello everyone!

I wonder if it is possible to figure out what keys user was pressing while his Mac OS was starting up?

Any way will do. As far as I understand it there is no easy way to simply hook an app/script to start working and capturing keystrokes simultaneously along with the OS. But maybe there is a way to some kind of reverse engineer this? Maybe looking into a specific log file or something like that?

Any results will do. Basically what I'm interested in is in finding out, which key the user pressed/held during the OS startup. It may be string, a character code or a hex, doesn't really matter.

UPDATE: guided by Pekka's advice I've found a kernel extension that should do the job. And it, hopefully, will do it, after this follow-up question - Why this keyboard intercepting kernel extension doesn’t work? is answered. :)

+1  A: 

I'm no OS guru, but I think very, very, very hardly. I don't suppose stuff like this is automatically recorded anywhere.

I guess you would have to look whether the part of the system that handles the startup keys is somehow accessible, and can be extended to invoke a command defined by you.

The second best thing that comes to mind is for you to write some sort of custom device driver or startup script that gets loaded at startup, and listens to keypress events.

Pekka
Thanks for the clue, I'll start digging in the startup script direction. I will not mark your answer as the answer yet, I'll try to find out if it is possible to insert a script into the very OS startup process.
Ivan Karpan
Due to http://tiny.cc/TheBootProcess in System Startup Programming Topics at Mac Dev the device driver approach is the key. It allows to start working ASAP, as far as it will get loaded along with the kernel.Though something tells me that it's not going to be easy to, firstly, catch all the keyboard input and, secondly, somehow tell about it to an app launched after the system started up.
Ivan Karpan
Two very good points :) Another idea that came to my mind was maybe look at some open-source low-level driver (not necessary keyboard related) that can write into the syslog, and copy from that. To get suggestions on what driver would be a good idea for this, you could maybe open another question.
Pekka
After digging here and there I'm now pretty sure so called 'Generic Kernel Extension' will do the job. And it's definitely a good idea to look for an open source implementation of a similar task.Pekka thanks a lot for guidance. :)
Ivan Karpan
You're welcome, and good luck!
Pekka
If you are in any way interested, just FYI, I've found a prototype that almost exactly does what I need (even too much). Though finding it made me ask this question: Why this keyboard intercepting kernel extension doesn’t work? (http://stackoverflow.com/questions/2042795/why-this-keyboard-intercepting-kernel-extension-doesnt-work) :D
Ivan Karpan
Interesting, I'll follow your question! Thanks for letting me know.
Pekka
A: 

It's not just not recorded anywhere, for quite a while during startup there is no keyboard driver. So from the point of view of software, during that interval the keyboard simply doesn't exist.

Andrew McGregor
There must be a very, very low level "driver" (or a number of them) running from the very start in order to capture the startup key commands. I remember from old DOS times that it's actually very easy to listen to the keyboard on a hardware level.
Pekka
Due to the same http://tiny.cc/TheBootProcess it's the BootROM firmware that handles startup keys commands.Trying to hack into the computer's firmware itself sounds hardly possible and not very polite. :)
Ivan Karpan
I think standard keyboard handling is an interrupt thing. It should be really easy to listen to without any drivers if I remember correctly.
Pekka
Modern Macs all have USB keyboards, even the laptops, which is vastly more complicated than old DOS machines. After loading the kernel, it's quite a while before USB starts up; watch the LEDs in a USB mouse some time, they go out for quite a while.So I guess after the kernel loads USB and HID drivers and finally gets around to loading extension modules, you could hook on to the keyboard then.
Andrew McGregor
Andrew, thanks a lot for this tip. After I (hopefully) succeed in implementing the actual functionality I will test it also with an external USB and Bluetooth keyboards. The thing is that I'm a MacBook Pro user and didn't even think about external keyboards and the fact that they may use more slower to load driver chains...
Ivan Karpan
+1  A: 

How to approach this depends completely on what point in the boot process you want to check for keys.

  • If you want to check really early, your only choice is to play with the EFI (firmware) environment -- maybe you could modify rEFIt to do what you want?
  • After the firmware, control passes to boot.efi (BootX on PPC Macs). This could presumably be replaced/hacked, and I'd expect the source to be available from as part of Darwin, but I don't see it on a quick inspection.
  • After that, the kernel loads (you could build your own kernel) with a minimal set of cached drivers (you could write a driver, not sure how to get it to be cached, though).
  • After that, all sorts of things happen more or less at once. Normal drivers get loaded, /etc/rc.local gets run, launchd items in /System/Library/LaunchDaemons and Library/LaunchDaemons become active... If you're willing to wait until this phase of the boot process, you have many options.
Gordon Davisson