Script for USB PCAP codes

decode.py

#!/usr/bin/python
# coding: utf-8
# Original source from https://blog.stayontarget.org/2019/03/decoding-mixed-case-usb-keystrokes-from.html
# Modified to add support for more keys and support for alt modifier. Could be improved upon more...
from __future__ import print_function
import sys,os

lcasekey = {}
ucasekey = {}

#associate USB HID scan codes with keys
#ex: key 4  can be both "a" and "A", depending on if SHIFT is held down
# 0-3 are protocol values: NoEvent, ErrorRollOver, POSTFail, ErrorUndefined
lcasekey[4]="a";			ucasekey[4]="A"
lcasekey[5]="b";			ucasekey[5]="B"
lcasekey[6]="c";			ucasekey[6]="C"
lcasekey[7]="d";			ucasekey[7]="D"
lcasekey[8]="e";			ucasekey[8]="E"
lcasekey[9]="f";			ucasekey[9]="F"
lcasekey[10]="g";			ucasekey[10]="G"
lcasekey[11]="h";			ucasekey[11]="H"
lcasekey[12]="i";			ucasekey[12]="I"
lcasekey[13]="j";			ucasekey[13]="J"
lcasekey[14]="k";			ucasekey[14]="K"
lcasekey[15]="l";			ucasekey[15]="L"
lcasekey[16]="m";			ucasekey[16]="M"
lcasekey[17]="n";			ucasekey[17]="N"
lcasekey[18]="o";			ucasekey[18]="O"
lcasekey[19]="p";			ucasekey[19]="P"
lcasekey[20]="q";			ucasekey[20]="Q"
lcasekey[21]="r";			ucasekey[21]="R"
lcasekey[22]="s";			ucasekey[22]="S"
lcasekey[23]="t";			ucasekey[23]="T"
lcasekey[24]="u";			ucasekey[24]="U"
lcasekey[25]="v";			ucasekey[25]="V"
lcasekey[26]="w";			ucasekey[26]="W"
lcasekey[27]="x";			ucasekey[27]="X"
lcasekey[28]="y";			ucasekey[28]="Y"
lcasekey[29]="z";			ucasekey[29]="Z"
lcasekey[30]="1";			ucasekey[30]="!"
lcasekey[31]="2";			ucasekey[31]="@"
lcasekey[32]="3";			ucasekey[32]="#"
lcasekey[33]="4";			ucasekey[33]="$"
lcasekey[34]="5";			ucasekey[34]="%"
lcasekey[35]="6";			ucasekey[35]="^"
lcasekey[36]="7";			ucasekey[36]="&"
lcasekey[37]="8";			ucasekey[37]="*"
lcasekey[38]="9";			ucasekey[38]="("
lcasekey[39]="0";			ucasekey[39]=")"
lcasekey[40]="<Enter>";		ucasekey[40]="<Enter>"
lcasekey[41]="<Escape>";	ucasekey[41]="<Escape>"
lcasekey[42]="<Backspace>";	ucasekey[42]="<Backspace>"
lcasekey[43]="<Tab>";		ucasekey[43]="<Tab>"
lcasekey[44]="<Space>";		ucasekey[44]="<Space>"
lcasekey[45]="-";			ucasekey[45]="_"
lcasekey[46]="=";			ucasekey[46]="+"
lcasekey[47]="[";			ucasekey[47]="{"
lcasekey[48]="]";			ucasekey[48]="}"
lcasekey[49]="\\";			ucasekey[49]="|"
lcasekey[50]=" ";			ucasekey[50]=" "
lcasekey[51]=";";			ucasekey[51]=":"
lcasekey[52]="'";			ucasekey[52]="\""
lcasekey[53]="`";			ucasekey[53]="~"
lcasekey[54]=",";			ucasekey[54]="<"
lcasekey[55]=".";			ucasekey[55]=">"
lcasekey[56]="/";			ucasekey[56]="?"
lcasekey[57]="<CapsLock>";	ucasekey[57]="<CapsLock>"
lcasekey[58]="<F1>";		ucasekey[58]="<F1>"
lcasekey[59]="<F2>";		ucasekey[59]="<F2>"
lcasekey[60]="<F3>";		ucasekey[60]="<F3>"
lcasekey[61]="<F4>";		ucasekey[61]="<F4>"
lcasekey[62]="<F5>";		ucasekey[62]="<F5>"
lcasekey[63]="<F6>";		ucasekey[63]="<F6>"
lcasekey[64]="<F7>";		ucasekey[64]="<F7>"
lcasekey[65]="<F8>";		ucasekey[65]="<F8>"
lcasekey[66]="<F9>";		ucasekey[66]="<F9>"
lcasekey[67]="<F10";		ucasekey[67]="<F10>"
lcasekey[68]="<F11";		ucasekey[68]="<F11>"
lcasekey[69]="<F12>";		ucasekey[69]="<F12>"
lcasekey[70]="<PrtScr>";		ucasekey[70]="<PrtScr>"
lcasekey[71]="<ScrollLock>";	ucasekey[71]="<ScrollLock>"
lcasekey[72]="<Pause>";		ucasekey[72]="<Pause>"
lcasekey[73]="<Insert>";		ucasekey[73]="<Insert>"
lcasekey[74]="<Home>";		ucasekey[74]="<Home>"
lcasekey[75]="<PageUp>";		ucasekey[75]="<PageUp>"
lcasekey[76]="<ForwardDelete>";	ucasekey[76]="<ForwardDelete>"
lcasekey[77]="<End>";		ucasekey[77]="<End>"
lcasekey[78]="<PageDown>";	ucasekey[78]="<PageDown>"
lcasekey[79]="<RightArrow>";	ucasekey[79]="<RightArrow>"
lcasekey[80]="<LeftArrow>";	ucasekey[80]="<LeftArrow>"
lcasekey[81]="<DownArrow>";	ucasekey[81]="<DownArrow>"
lcasekey[82]="<UpArrow>";	ucasekey[82]="<UpArrow>"
lcasekey[83]="<NumLock>";	ucasekey[83]="<NumLock>"
lcasekey[84]="/";			ucasekey[84]="/"
lcasekey[85]="*";			ucasekey[85]="*"
lcasekey[86]="-";			ucasekey[86]="-"
lcasekey[87]="+";			ucasekey[87]="+"
lcasekey[88]="Enter";		ucasekey[88]="Enter"
lcasekey[89]="1";			ucasekey[89]="upper 1"
lcasekey[90]="2";			ucasekey[90]="upper 2"
lcasekey[91]="3";			ucasekey[91]="upper 3"
lcasekey[92]="4";			ucasekey[92]="upper 4"
lcasekey[93]="5";			ucasekey[93]="upper 5"
lcasekey[94]="6";			ucasekey[94]="upper 6"
lcasekey[95]="7";			ucasekey[95]="upper 7"
lcasekey[96]="8";			ucasekey[96]="upper 8"
lcasekey[97]="9";			ucasekey[97]="upper 9"
lcasekey[98]="0";			ucasekey[98]="upper 0"
lcasekey[99]=".";			ucasekey[99]="."
lcasekey[100]="\\";			ucasekey[100]="|"

def get_output_for_code(rawcode):
	rawcode = rawcode.rstrip()
	bytesArray = bytearray.fromhex(rawcode)					#dump line to bytearray
	val = int(bytesArray[2])								#see if we have a key code
	if val > 3:												#ignore protocol codes
		if bytesArray[0] == 0x02 or bytesArray[0] == 0x20 : #see if left shift or right shift was held down
			try:
				return ucasekey[val]
			except:
				return f"Unknown upper key: {val}"
		elif bytesArray[0] == 0x40:							#this isnt entirely accurate but I'm too lazy to properly implement
			try:
				return f"<Alt>+{lcasekey[val]}"
			except:
				return f"Unknown <Alt> + lower key: {val}"
		else:
			try:
				return lcasekey[val]
			except:
				return f"Unknown lower key: {val}"


#make sure filename to open has been provided
if len(sys.argv) == 2:
	with open(sys.argv[1]) as keycodes:
		for line in keycodes:
			line = line.rstrip()
			output = get_output_for_code(line)
			if output!=None:
				#print(f"{output}", end=''),  				#single line output
				print(f"{line}\t{output}")   				#newline output
		
else:
    print("USAGE: python %s [filename]" % os.path.basename(__file__))