那些遇到过的问题

如何逆向工程USB/HID /蓝牙加密狗.使用什么工具？

9 usb bluetooth hid pyusb

需要逆向工程蓝牙usb鼠标加密狗,并使用鼠标板测量距离,并用matplotlib绘制它们

在此输入图像描述

我发现这些工具可以帮助完成这项任务:

Linux的

  • 的lsusb
  • usbmon
  • USBHID转储
  • RFCOMM
  • hidrd-转换
  • XXD
  • hcitool
  • 了evdev转储

视窗

参考书目:

  1. https://www.silabs.com/Support Documents/TechnicalDocs/AN249.pdf
  2. www.usb.org/developers/devclass_docs/HID1_11.pdf
  3. Usbhid-dump - digimend
  4. Linux,HID和PyUSB
  5. Linux中的MagTek信用卡读卡器
  6. Evdev-dump - digimend

例子:

lnx#> lsusb -s 2

Bus 005 Device 002: ID 0a12:0001 Cambridge Silicon Radio, Ltd Bluetooth Dongle (HCI mode)
Bus 003 Device 002: ID 192f:0716 Avago Technologies, Pte. 
Bus 002 Device 002: ID 1bcf:053a Sunplus Innovation Technology Inc. Targa Silvercrest OMC807-C optische Funkmaus
Run Code Online (Sandbox Code Playgroud) 
lnx#> sudo lsusb -s 2:4 -v

Bus 002 Device 004: ID 1bcf:053a Sunplus Innovation Technology Inc. Targa Silvercrest OMC807-C optische Funkmaus
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0         8
  idVendor           0x1bcf Sunplus Innovation Technology Inc.
  idProduct          0x053a Targa Silvercrest OMC807-C optische Funkmaus
  bcdDevice           a0.31
  iManufacturer           0 
  iProduct                2 2.4GHz 2way RF Receiver
  iSerial                 0 
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           34
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0xa0
      (Bus Powered)
      Remote Wakeup
    MaxPower               46mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         3 Human Interface Device
      bInterfaceSubClass      1 Boot Interface Subclass
      bInterfaceProtocol      2 Mouse
      iInterface              0 
        HID Device Descriptor:
          bLength                 9
          bDescriptorType        33
          bcdHID               1.00
          bCountryCode            0 Not supported
          bNumDescriptors         1
          bDescriptorType        34 Report
          wDescriptorLength     179
         Report Descriptors: 
           ** UNAVAILABLE **
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0008  1x 8 bytes
        bInterval              10
Device Status:     0x0000
  (Bus Powered)
Run Code Online (Sandbox Code Playgroud) 
lnx#> lsusb -t     
/:  Bus 05.Port 1: Dev 1, Class=root_hub, Driver=uhci_hcd/2p, 12M
    |__ Port 2: Dev 2, If 0, Class=Wireless, Driver=btusb, 12M
    |__ Port 2: Dev 2, If 1, Class=Wireless, Driver=btusb, 12M
/:  Bus 04.Port 1: Dev 1, Class=root_hub, Driver=uhci_hcd/2p, 12M
/:  Bus 03.Port 1: Dev 1, Class=root_hub, Driver=uhci_hcd/2p, 12M
    |__ Port 2: Dev 2, If 0, Class=Human Interface Device, Driver=usbhid, 1.5M
/:  Bus 02.Port 1: Dev 1, Class=root_hub, Driver=uhci_hcd/2p, 12M
    |__ Port 1: Dev 4, If 1, Class=Human Interface Device, Driver=usbhid, 1.5M
    |__ Port 2: Dev 3, If 0, Class=Human Interface Device, Driver=usbhid, 12M
    |__ Port 2: Dev 3, If 1, Class=Human Interface Device, Driver=usbhid, 12M
    |__ Port 2: Dev 3, If 2, Class=Human Interface Device, Driver=usbhid, 12M
/:  Bus 01.Port 1: Dev 1, Class=root_hub, Driver=ehci-pci/8p, 480M
    |__ Port 3: Dev 4, If 0, Class=Video, Driver=uvcvideo, 480M
    |__ Port 3: Dev 4, If 1, Class=Video, Driver=uvcvideo, 480M
    |__ Port 3: Dev 4, If 2, Class=Audio, Driver=snd-usb-audio, 480M
    |__ Port 3: Dev 4, If 3, Class=Audio, Driver=snd-usb-audio, 480M
Run Code Online (Sandbox Code Playgroud) 
lnx#> sudo usbmon -f0
ffff8800764640c0 4022916298 C Ii:003:01 0 8 = 00000000 00000000
ffff8800764640c0 4022916321 S Ii:003:01 -115 8 <
ffff880076464a80 4025994204 C Ii:004:01 0 6 = 0100ff00 0000
ffff880076464a80 4025994229 S Ii:004:01 -115 7 <
ffff880076464a80 4026010207 C Ii:004:01 0 6 = 0100ff00 0000
ffff880076464a80 4026010238 S Ii:004:01 -115 7 <
ffff880076464a80 4026018204 C Ii:004:01 0 6 = 0100ff00 0000
ffff880076464a80 4026018225 S Ii:004:01 -115 7 <
ffff880076464a80 4026026199 C Ii:004:01 0 6 = 0100ff00 0000
Run Code Online (Sandbox Code Playgroud) 
lnx#> sudo usbhid-dump -s 2:4                                                 
002:004:001:DESCRIPTOR         1393614919.941888
 05 01 09 02 A1 01 85 01 05 09 19 01 29 08 15 00
 25 01 95 08 75 01 81 02 05 01 09 01 A1 00 09 30
 09 31 09 38 15 81 25 7F 75 08 95 03 81 06 05 0C
 0A 38 02 95 01 81 06 C0 06 00 FF 09 01 15 00 26
 FF 00 75 08 95 07 B1 02 C0 06 F3 F1 0A F3 F1 A1
 01 85 02 09 00 95 01 75 08 15 00 26 FF 00 81 02
 C0 05 0C 09 01 A1 01 85 03 15 00 26 FF 03 19 00
 2A FF 03 75 10 95 03 81 00 C0 05 01 09 80 A1 01
 85 04 05 01 19 81 29 83 15 00 25 01 95 03 75 01
 81 06 95 01 75 05 81 01 C0 06 BC FF 09 88 A1 01
 85 05 19 00 2A FF 00 15 00 26 FF 00 75 08 95 01
 81 00 C0
Run Code Online (Sandbox Code Playgroud) 
lnx#> sudo usbhid-dump -s 2:4 | tail -n +2 | xxd -r -p | hidrd-convert -o spec            
Usage Page (Desktop),               ; Generic desktop controls (01h)
Usage (Mouse),                      ; Mouse (02h, application collection)
Collection (Application),
    Report ID (1),
    Usage Page (Button),            ; Button (09h)
    Usage Minimum (01h),
    Usage Maximum (08h),
    Logical Minimum (0),
    Logical Maximum (1),
    Report Count (8),
    Report Size (1),
    Input (Variable),
    Usage Page (Desktop),           ; Generic desktop controls (01h)
    Usage (Pointer),                ; Pointer (01h, physical collection)
    Collection (Physical),
        Usage (X),                  ; X (30h, dynamic value)
        Usage (Y),                  ; Y (31h, dynamic value)
        Usage (Wheel),              ; Wheel (38h, dynamic value)
        Logical Minimum (-127),
        Logical Maximum (127),
        Report Size (8),
        Report Count (3),
        Input (Variable, Relative),
        Usage Page (Consumer),      ; Consumer (0Ch)
        Usage (AC Pan),             ; AC pan (0238h, linear control)
        Report Count (1),
        Input (Variable, Relative),
    End Collection,
    Usage Page (FF00h),             ; FF00h, vendor-defined
    Usage (01h),
    Logical Minimum (0),
    Logical Maximum (255),
    Report Size (8),
    Report Count (7),
    Feature (Variable),
End Collection,
Usage Page (F1F3h),                 ; F1F3h, reserved
Usage (F1F3h),
Collection (Application),
    Report ID (2),
    Usage (00h),
    Report Count (1),
    Report Size (8),
    Logical Minimum (0),
    Logical Maximum (255),
    Input (Variable),
End Collection,
Usage Page (Consumer),              ; Consumer (0Ch)
Usage (Consumer Control),           ; Consumer control (01h, application collection)
Collection (Application),
    Report ID (3),
    Logical Minimum (0),
    Logical Maximum (1023),
    Usage Minimum (00h),
    Usage Maximum (03FFh),
    Report Size (16),
    Report Count (3),
    Input,
End Collection,
Usage Page (Desktop),               ; Generic desktop controls (01h)
Usage (Sys Control),                ; System control (80h, application collection)
Collection (Application),
    Report ID (4),
    Usage Page (Desktop),           ; Generic desktop controls (01h)
    Usage Minimum (Sys Power Down), ; System power down (81h, one-shot control)
    Usage Maximum (Sys Wake Up),    ; System wake up (83h, one-shot control)
    Logical Minimum (0),
    Logical Maximum (1),
    Report Count (3),
    Report Size (1),
    Input (Variable, Relative),
    Report Count (1),
    Report Size (5),
    Input (Constant),
End Collection,
Usage Page (FFBCh),                 ; FFBCh, vendor-defined
Usage (88h),
Collection (Application),
    Report ID (5),
    Usage Minimum (00h),
    Usage Maximum (FFh),
    Logical Minimum (0),
    Logical Maximum (255),
    Report Size (8),
    Report Count (1),
    Input,
End Collection
Run Code Online (Sandbox Code Playgroud) 
lnx#> sudo usbhid-dump -s 2:4 -es
Starting dumping interrupt transfer stream
with 1 minute timeout.

002:004:001:STREAM             1393615361.032412
 01 00 01 FF 00 00

002:004:001:STREAM             1393615361.392401
 01 00 FF 00 00 00

002:004:001:STREAM             1393615361.400380
 01 00 FC 02 00 00

002:004:001:STREAM             1393615361.424382
 01 00 FF 01 00 00

002:004:001:STREAM             1393615361.432377
 01 00 FE 00 00 00

002:004:001:STREAM             1393615361.440378
 01 00 FF 01 00 00

002:004:001:STREAM             1393615361.592374
 01 00 FF 00 00 00

002:004:001:STREAM             1393615361.608392
 01 00 FF 00 00 00

002:004:001:STREAM             1393615361.616373
 01 00 FF 00 00 00
Run Code Online (Sandbox Code Playgroud)

Onl*_*jus 1

我成功地用以下代码读取了我的鼠标： orangecoat

归档时间：

查看次数：

6670 次

最近记录：

11 年，1 月 前
相关归档
如何定期扫描android上的蓝牙设备 31
你怎么能拥有一个隐藏设备？ 23
即使插入耳机,如何通过蓝牙扬声器播放音频？ 9
如何使用Linux和Python3读出模拟HID键盘的USB Rfid阅读器 5
linux上的USB设备的权限ATTR {idVendor}使用表mobii protab2 XXL 5
launchd.plist每10秒运行一次，而不是一次 5
如何在 Android 中以编程方式启用或禁用蓝牙配置文件？ 5
如何在c#中读取字节 4
将音频发送到支持蓝牙的扬声器,IOS 2
如何检查我的蓝牙模块是否支持 Linux 中的 BLE 功能 0
难疑归档
Java是"通过引用传递"还是"传递价值"？ 6270
如何从列表列表中制作一个平面列表？ 2950
如何在Java中将String转换为int？ 2882
什么是三法则？ 2067
如何退出PostgreSQL命令行实用程序:psql 1770
C#在foreach中重用变量是否有原因？ 1631
如何在JavaScript正则表达式中访问匹配的组？ 1277
application/x-www-form-urlencoded或multipart/form-data？ 1268
如何列出使用ATTACH打开的SQLite数据库文件中的表？ 1151
简单的面试问题变得更难:给出数字1..100,找到丢失的数字 1115