Not sure about your architecture, but for my Lenovo laptop, when I do a "cat /dev/input/by-path/platform-i8042-serio-0-event-kbd" and redirect to a file, every single key input I entered is captured into the the file.

Therefore, looking into the kernel source, we can infer the files drivers/input/serio/i8042.c are responsible for the keyboard processing.   Of course, this file is compiled into the kernel, not as a kernel module.   So if u want to make any changes, instead of recompile the kernel and rebooting, one way to do dynamically is called "inline hooking" - look elsewhere for this method.   It is explained in the following article:

but note the difference between the Phrack's interception and intercepting the API inside the i8042.c:   when you do a "cat  /dev/input/by-path/platform-i8042-serio-0-event-kbd" the keyboard entry is always captured - irregardless of whichever windows/terminal you are in.   But the Phrack's method is cleaner - it is intercepting at the tty (eg drivers/tty/n_tty.c:receive_buf() inside the kernel source) level - so if you switch over to another window, the input got switch away - it is thus targetted to only that TTY.

And btw, USB keyboard's processing path is altogether different again....another 

and perhaps u can read here many good writeups:

--
Regards,
Peter Teoh