I am building a kernel module that overwrites read system call. In there I want to replace a key press from keyboards. I successfully was able to do that for terminal inputs by replacing scan codes of file descriptor=0. However, GUI applications use X11 in ubuntu and it does not use stdin input to read the keyboard. How can I intercept and replace key presses before they reach the X11 server? Is there a specific file descriptor X11 uses?

1 Answer 1


The Xorg X11 server on Linux reads input from evdev devices at /dev/input/event*. Each read() call returns at least one struct input_event.

You don't need a custom kernel module to replace events – you can use just userspace tools to read them, alter as needed, and forward them to the existing 'uinput' module which lets you create custom evdev devices (much like FUSE or CUSE), and somehow tell Xorg to ignore the original device. The interception-tools kit can do so.

Additionally, nowadays Xorg on most systems uses the libinput library to pre-process events from keyboards and mice. (Most Wayland display servers also use libinput exclusively.) You could patch this library to

Finally, if you only want to remap a single key (or scancode), the evdev subsystem already has built-in support for that. Systemd-udev already comes with a helper that allows udev rules to define custom scancode-to-key mappings, as can be seen in this database.

In fact, if you still want to patch the kernel, it would probably be better to leave read() alone and perform your translation at the evdev layer. (After all, file descriptor 0 isn't always the keyboard – you really don't want to mess with data piped from another program.)

  • Thanks for the detailed response. It helped me get a clear understanding. My goal is to replace the key press before any user space program can access it. In case I use /dev/input/event* or libinput library. A malicious userspace program can access the unreplaced characters before I replace them. Which would be the best way to go forward if I want to replace the key press before they reach where a user space program can access them?
    – tarun14110
    Nov 25, 2021 at 19:14
  • To be honest, this description already sounds malicious in itself. I'm not sure I'm comfortable helping with that any further. Nov 25, 2021 at 19:31
  • It's for academic research purposes. Thanks for explaining the details of how X11 works at a high level. I'll try to figure that out from here.
    – tarun14110
    Nov 25, 2021 at 19:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .