Skip to main content
Reverse Engineering

Return to Question

Tweeted twitter.com/StackReverseEng/status/1092936098148421632
Added Use of </kbd> Tag
Source Link
edit approved Feb 5, 2019 at 9:06
Cadoiz
edit approved Feb 5, 2019 at 9:06
Cadoiz
  • 103
  • 2

keyboard output | hex value
aa | 0x0400
bb | 0x0500
cc | 0x0600
...
zz | 0x1D00
11 | 0x1E00
22 | 0x1F00
...
99 | 0x2600
00 | 0x2700
returnreturn | 0x2800
escesc | 0x2900
backspacebackspace | 0x2A00
tabtab | 0x2B00
spacespace | 0x2C00
...
Volume UpVolume Up | 0x8000 (XF86AudioRaiseVolume)
Volume DownVolume Down | 0x8100 (XF86AudioLowerVolume)
...

As for the least significant byte, part of that is modifiers, applied as a mask. CtlCtl is (1 << 0), shiftshift is (1 << 1), altalt is (1 << 2) and super/meta/windowssuper/meta/windows is (1<<3). So this way, shift-a shift+a (or capitalcapital A) is 0x0402. Ctl-Alt-aCtl+Alt+a would be 0x0405. All four modifiers give you 0x0F for the least sig. byte. Playing around with the high nybble of the LSB, say with values like 0x0440 gives me more keys, like XF86Mute. So it seems the address space is massive.

Output | hex value
Mouse Scroll upaMouse Scroll up | 0x0143
Mouse Scroll downMouse Scroll down | 0xFF43
WWW SearchWWW Search | 0x2122
WWW BackWWW Back | 0x2422
WWW ForwardWWW Forward | 0x2522
EmailEmail | 0x8A21
Internet Expl BackInternet Expl Back | 0x8842 (presents as mouse button 8 in X11)
IE ForwardIE Forward | 0x9042 (mouse button 9)
CalculatorCalculator | 0x9221
My ComputerMy Computer | 0x9421
MuteMute | 0xE220
Volume UpVolume Up | 0xE920
Volume DownVolume Down | 0xEA20

output | hex
Left ClickLeft Click | 0x8142
Right ClickRight Click | 0x8242
Wheel ClickWheel Click | 0x8442

action | hex Cycle DPI setting

Cycle DPI setting | 0x034A
DPI increaseDPI increase | 0x014A
DPI decreaseDPI decrease | 0x004A
Cycle mouse profileCycle mouse profile | 0x074A
Profile UpProfile Up | 0x054A
Profile DownProfile Down | 0x044A

I can't find any encoding schemes or keyboard mappings that might match this. Alphabetical keys? And If you notice, volume upvolume up is both 0x8000 and 0xE920 while vol downvol down is both 0x8100 and 0xEA20. So somewhat of a light at the end of the tunnel that there is a consistent distance between those.

keyboard output | hex value
a | 0x0400
b | 0x0500
c | 0x0600
...
z | 0x1D00
1 | 0x1E00
2 | 0x1F00
...
9 | 0x2600
0 | 0x2700
return | 0x2800
esc | 0x2900
backspace | 0x2A00
tab | 0x2B00
space | 0x2C00
...
Volume Up | 0x8000 (XF86AudioRaiseVolume)
Volume Down | 0x8100 (XF86AudioLowerVolume)
...

As for the least significant byte, part of that is modifiers, applied as a mask. Ctl is (1 << 0), shift is (1 << 1), alt is (1 << 2) and super/meta/windows is (1<<3). So this way, shift-a (or capital A) is 0x0402. Ctl-Alt-a would be 0x0405. All four modifiers give you 0x0F for the least sig. byte. Playing around with the high nybble of the LSB, say with values like 0x0440 gives me more keys, like XF86Mute. So it seems the address space is massive.

Output | hex value
Mouse Scroll up | 0x0143
Mouse Scroll down | 0xFF43
WWW Search | 0x2122
WWW Back | 0x2422
WWW Forward | 0x2522
Email | 0x8A21
Internet Expl Back | 0x8842 (presents as mouse button 8 in X11)
IE Forward | 0x9042 (mouse button 9)
Calculator | 0x9221
My Computer | 0x9421
Mute | 0xE220
Volume Up | 0xE920
Volume Down | 0xEA20

output | hex
Left Click | 0x8142
Right Click | 0x8242
Wheel Click | 0x8442

action | hex Cycle DPI setting | 0x034A
DPI increase | 0x014A
DPI decrease | 0x004A
Cycle mouse profile | 0x074A
Profile Up | 0x054A
Profile Down | 0x044A

I can't find any encoding schemes or keyboard mappings that might match this. Alphabetical keys? And If you notice, volume up is both 0x8000 and 0xE920 while vol down is both 0x8100 and 0xEA20. So somewhat of a light at the end of the tunnel that there is a consistent distance between those.

keyboard output | hex value
a | 0x0400
b | 0x0500
c | 0x0600
...
z | 0x1D00
1 | 0x1E00
2 | 0x1F00
...
9 | 0x2600
0 | 0x2700
return | 0x2800
esc | 0x2900
backspace | 0x2A00
tab | 0x2B00
space | 0x2C00
...
Volume Up | 0x8000 (XF86AudioRaiseVolume)
Volume Down | 0x8100 (XF86AudioLowerVolume)
...

As for the least significant byte, part of that is modifiers, applied as a mask. Ctl is (1 << 0), shift is (1 << 1), alt is (1 << 2) and super/meta/windows is (1<<3). So this way, shift+a (capital A) is 0x0402. Ctl+Alt+a would be 0x0405. All four modifiers give you 0x0F for the least sig. byte. Playing around with the high nybble of the LSB, say with values like 0x0440 gives me more keys, like XF86Mute. So it seems the address space is massive.

Output | hex value
aMouse Scroll up | 0x0143
Mouse Scroll down | 0xFF43
WWW Search | 0x2122
WWW Back | 0x2422
WWW Forward | 0x2522
Email | 0x8A21
Internet Expl Back | 0x8842 (presents as mouse button 8 in X11)
IE Forward | 0x9042 (mouse button 9)
Calculator | 0x9221
My Computer | 0x9421
Mute | 0xE220
Volume Up | 0xE920
Volume Down | 0xEA20

output | hex
Left Click | 0x8142
Right Click | 0x8242
Wheel Click | 0x8442

action | hex

Cycle DPI setting | 0x034A
DPI increase | 0x014A
DPI decrease | 0x004A
Cycle mouse profile | 0x074A
Profile Up | 0x054A
Profile Down | 0x044A

I can't find any encoding schemes or keyboard mappings that might match this. Alphabetical keys? And If you notice, volume up is both 0x8000 and 0xE920 while vol down is both 0x8100 and 0xEA20. So somewhat of a light at the end of the tunnel that there is a consistent distance between those.

added tag
Source Link
Dan P
Dan P
  • 63
  • 5

edit: All key information I've mapped so far is in this gist including 0x0000 through 0xFF00 (leaving LSByte 0x00). So there is still a massive address space left. And it still makes no sense to me with the extra keys from the windows driver like 0x9421 = XF86Explorer

edit: All key information I've mapped so far is in this gist including 0x0000 through 0xFF00 (leaving LSByte 0x00). So there is still a massive address space left. And it still makes no sense to me with the extra keys from the windows driver like 0x9421 = XF86Explorer

Source Link
Dan P
Dan P
  • 63
  • 5

Does anyone recognize this keyboard encoding scheme?

I am finalizing the reverse-engineering of a linux driver for the Perixx MX-2000 IIB mouse. One of the features the mouse has is arbitrary button mapping. I can assign a button to produce various keys or mouse buttons. I have recorded a few button assignments available in the Windows driver, and figured out a few myself, but there doesn't seem to be a discernible (to me) pattern to map the whole address space.

The keys behave like this: Two bytes control a particular mouse button. I have learned a few keys and modifiers, and will post below. Setting the mouse button to the hex value gives me keyboard output when clicked.

keyboard output | hex value
a | 0x0400
b | 0x0500
c | 0x0600
...
z | 0x1D00
1 | 0x1E00
2 | 0x1F00
...
9 | 0x2600
0 | 0x2700
return | 0x2800
esc | 0x2900
backspace | 0x2A00
tab | 0x2B00
space | 0x2C00
...
Volume Up | 0x8000 (XF86AudioRaiseVolume)
Volume Down | 0x8100 (XF86AudioLowerVolume)
...

I've mapped through 0x8A00 but will spare you the whole table. The interesting things are that thing like XF86 commands appear pretty early, like in 0x6F00 is XF86AudioMicMute, or 0x6600 is the power off key.

As for the least significant byte, part of that is modifiers, applied as a mask. Ctl is (1 << 0), shift is (1 << 1), alt is (1 << 2) and super/meta/windows is (1<<3). So this way, shift-a (or capital A) is 0x0402. Ctl-Alt-a would be 0x0405. All four modifiers give you 0x0F for the least sig. byte. Playing around with the high nybble of the LSB, say with values like 0x0440 gives me more keys, like XF86Mute. So it seems the address space is massive.

On top of this, there are some keys from the windows driver that presented as an entirely different scheme.

Output | hex value
Mouse Scroll up | 0x0143
Mouse Scroll down | 0xFF43
WWW Search | 0x2122
WWW Back | 0x2422
WWW Forward | 0x2522
Email | 0x8A21
Internet Expl Back | 0x8842 (presents as mouse button 8 in X11)
IE Forward | 0x9042 (mouse button 9)
Calculator | 0x9221
My Computer | 0x9421
Mute | 0xE220
Volume Up | 0xE920
Volume Down | 0xEA20

And a few mouse buttons:

output | hex
Left Click | 0x8142
Right Click | 0x8242
Wheel Click | 0x8442

and finally, these are internal mouse commands. They don't register any events on my linux machine, but do change things in the mouse's internal settings

action | hex Cycle DPI setting | 0x034A
DPI increase | 0x014A
DPI decrease | 0x004A
Cycle mouse profile | 0x074A
Profile Up | 0x054A
Profile Down | 0x044A

And finally there is a special set that looks like 0x0a88 that point internally to macro memory.

I can't find any encoding schemes or keyboard mappings that might match this. Alphabetical keys? And If you notice, volume up is both 0x8000 and 0xE920 while vol down is both 0x8100 and 0xEA20. So somewhat of a light at the end of the tunnel that there is a consistent distance between those.

But really, I can't figure out a standard mapping this matches. Or any way to figure out all the keys without manually fiddling with the memory and looping through 0x0000 to 0xFFFF and clicking with xev each time.

Thoughts? is any of this familiar? or other patterns spotted?