Windows系统USB键盘KEYBOARD_INPUT_DATA12字节解析(BUSHOUND可抓包)
2022-06-07
624
0
和鼠标的MOUSE_INPUT_DATA结构一样,键盘使用的是KEYBOARD_INPUT_DATA,并且这个不是HID键盘报告描述符定义的数据,而是系统转换后的数据。
该结构体定义如下:
typedef struct _KEYBOARD_INPUT_DATA {
USHORT UnitId;
USHORT MakeCode;
USHORT Flags;
USHORT Reserved;
ULONG ExtraInformation;
} KEYBOARD_INPUT_DATA, *PKEYBOARD_INPUT_DATA;
各字段定义详见:https://docs.microsoft.com/zh-cn/windows/win32/api/ntddkbd/ns-ntddkbd-keyboard_input_data
bushound定义KEYBOARD_INPUT_DATA如下:
Offset | Length | Content |
---|---|---|
0 | 2 | Not used |
2 | 2 | Scan code of key |
4 | 2 | Flags: |
0000h = key pressed | ||
0001h = key released | ||
0002h = extended scan code E0 | ||
0004h = extended scan code E1 | ||
6 | 2 | Not used |
8 | 4 | Device specific information |
我们通过BUSHOUND抓内容如下:
注意,这里抓的是12设备的数据,而不是10的数据,10设备的是HID报告描述符定义的HID键盘数据,而12设备才是转化后的数据。
Device Length Phase Data
------ -------- ----- --------------------------------------------
10.1 8 IN 00 00 04 00 00 00 00 00
12 12 IN 01 00 1e 00 00 00 00 00 00 00 00 00
10.1 8 IN 00 00 00 00 00 00 00 00
12 12 IN 01 00 1e 00 01 00 00 00 00 00 00 00
10.1 8 IN 00 00 05 00 00 00 00 00
12 12 IN 01 00 30 00 00 00 00 00 00 00 00 00
10.1 8 IN 00 00 00 00 00 00 00 00
12 12 IN 01 00 30 00 01 00 00 00 00 00 00 00
10.1 8 IN 00 00 06 00 00 00 00 00
12 12 IN 01 00 2e 00 00 00 00 00 00 00 00 00
10.1 8 IN 00 00 00 00 00 00 00 00
12 12 IN 01 00 2e 00 01 00 00 00 00 00 00 00
10.1 8 IN 00 00 07 00 00 00 00 00
12 12 IN 01 00 20 00 00 00 00 00 00 00 00 00
10.1 8 IN 00 00 00 00 00 00 00 00
12 12 IN 01 00 20 00 01 00 00 00 00 00 00 00
10.1 8 IN 00 00 08 00 00 00 00 00
12 12 IN 01 00 12 00 00 00 00 00 00 00 00 00
10.1 8 IN 00 00 00 00 00 00 00 00
12 12 IN 01 00 12 00 01 00 00 00 00 00 00 00
10.1 8 IN 00 00 09 00 00 00 00 00
12 12 IN 01 00 21 00 00 00 00 00 00 00 00 00
10.1 8 IN 00 00 00 00 00 00 00 00
12 12 IN 01 00 21 00 01 00 00 00 00 00 00 00
10.1 8 IN 00 00 0a 00 00 00 00 00
12 12 IN 01 00 22 00 00 00 00 00 00 00 00 00
10.1 8 IN 00 00 00 00 00 00 00 00
12 12 IN 01 00 22 00 01 00 00 00 00 00 00 00
10.1 8 IN 00 00 0b 00 00 00 00 00
12 12 IN 01 00 23 00 00 00 00 00 00 00 00 00
10.1 8 IN 00 00 00 00 00 00 00 00
12 12 IN 01 00 23 00 01 00 00 00 00 00 00 00
HID人机交互QQ群:564808376
UAC音频QQ群:218581009
UVC相机QQ群:331552032
BOT&UASP大容量存储QQ群:258159197
STC-USB单片机QQ群:315457461
USB技术交流QQ群2:580684376
USB技术交流QQ群:952873936