1

I have a USB keyboard which has an Electron app to set the macros on the keyboard. I unpacked the app.asar file, and the JS files seem to indicate that it is a ReactJS app, and is a minified production build, and obfuscated too much to reverse engineer.

Another way to approach the problem seemed to be to use USB sniffer. I chose WireShark for the job. I wanted to capture all the data packets sent from the app to the keyboard, and hoped to reverse engineer that. The problem is, I can't find a way to capture the raw USB stream. I tried using WireShark to monitor usbmon0, but there is too much metadata, and separating the raw data from the protocol metadata seems to be a daunting task.

I do not have a hardware USB sniffer or a JTAG debugger. Is there a simple way to capture all the raw data going from the app to the keyboard?

4
  • Wireshark has built-in filter. Why don't you use him? Check which method it uses to send/read data and apply correct filter like usb.transfer_type == 0x01 – morsisko May 29 '20 at 17:28
  • @morsisko unfortunately, all the transfer type is 0x01. However, this is an example of a packet: 0000 c0 75 90 00 22 91 ff ff 53 01 84 06 03 00 2d 3c 0010 4b 71 d1 5e 00 00 00 00 7c 67 0d 00 8d ff ff ff 0020 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0030 08 00 00 00 00 00 00 00 04 02 00 00 00 00 00 00 Unfortunately, I can't make heads or tails of this packet. – Sabyasachi Mukherjee May 29 '20 at 22:02
  • Was there a driver installed? – multithr3at3d May 30 '20 at 13:03
  • @multithr3at3d no driver. Like I said, this is a keyboard on Linux. There was no driver installed. – Sabyasachi Mukherjee May 30 '20 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.