Can you tell me how each function works?? THx!
I actually made a keystroke logger that is fully functional (it even logs the keystrokes. HOWEVER.. it hashes the contents before it is stored, otherwise it would be illegal).
The repl attached to the share contains the script which has comments with a detailed explanation of how it works.
Basically what sixbeeps said.
However, sometimes the hacker wants to retrieve the contents. In that case the program would send the contents of the file (or stream the key presses directly) to the person in which they can see what you logged.
The program can be even more complex in that it filters out useless keystrokes and detects focus on a username/password input field and/or a document program (like microsoft word) and logging whatever you type in the document.