| 12
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
 100
 101
 102
 103
 104
 105
 106
 107
 108
 109
 110
 111
 112
 113
 114
 115
 116
 117
 118
 119
 120
 121
 122
 123
 124
 125
 126
 127
 128
 129
 130
 131
 132
 133
 134
 135
 136
 137
 138
 139
 140
 141
 142
 143
 144
 145
 146
 147
 148
 149
 150
 151
 152
 153
 154
 155
 156
 157
 158
 159
 160
 161
 162
 163
 164
 165
 166
 167
 168
 169
 170
 171
 172
 173
 174
 175
 176
 177
 178
 179
 180
 181
 182
 183
 184
 185
 186
 187
 188
 189
 190
 191
 192
 193
 194
 195
 196
 197
 198
 199
 200
 201
 202
 203
 204
 205
 206
 207
 208
 209
 210
 211
 212
 213
 214
 215
 216
 217
 218
 219
 220
 221
 222
 223
 224
 225
 226
 227
 228
 229
 230
 231
 232
 233
 234
 235
 236
 237
 238
 239
 240
 241
 242
 243
 244
 245
 246
 247
 248
 249
 250
 251
 252
 253
 254
 255
 256
 257
 258
 259
 260
 261
 262
 263
 264
 265
 266
 267
 268
 269
 270
 271
 272
 273
 274
 275
 276
 277
 278
 279
 280
 281
 282
 283
 284
 285
 286
 287
 288
 289
 290
 291
 292
 293
 294
 295
 296
 297
 298
 299
 300
 301
 302
 303
 304
 305
 306
 307
 308
 309
 310
 311
 312
 313
 314
 315
 316
 317
 318
 319
 320
 321
 322
 323
 324
 325
 326
 327
 328
 329
 330
 331
 332
 333
 334
 335
 336
 337
 338
 339
 340
 341
 342
 343
 344
 345
 346
 347
 348
 349
 350
 351
 352
 353
 354
 355
 356
 357
 358
 359
 360
 361
 362
 363
 364
 365
 366
 367
 368
 369
 370
 371
 372
 373
 374
 375
 376
 377
 378
 379
 380
 381
 382
 383
 384
 385
 386
 387
 388
 389
 390
 391
 392
 393
 394
 395
 396
 397
 398
 399
 400
 401
 402
 403
 404
 405
 406
 407
 408
 409
 410
 411
 412
 413
 414
 415
 416
 417
 418
 419
 420
 421
 422
 423
 424
 425
 426
 427
 428
 429
 430
 431
 432
 433
 434
 435
 436
 437
 438
 439
 440
 441
 442
 443
 444
 445
 446
 447
 448
 449
 450
 451
 452
 453
 454
 455
 456
 457
 458
 459
 460
 461
 462
 463
 464
 465
 466
 467
 468
 469
 470
 471
 472
 473
 474
 475
 476
 477
 478
 479
 480
 481
 482
 483
 484
 485
 486
 487
 488
 489
 490
 491
 492
 493
 494
 495
 496
 497
 498
 499
 500
 501
 502
 503
 504
 505
 506
 507
 508
 509
 510
 511
 512
 513
 514
 515
 516
 517
 518
 519
 520
 
 | #!/usr/bin/env python
#
# Copyright 2009 Joshua Wright, Michael Ossmann
# 
# This file is part of gr-bluetooth
# 
# gr-bluetooth is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2, or (at your option)
# any later version.
# 
# gr-bluetooth is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
# 
# You should have received a copy of the GNU General Public License
# along with gr-bluetooth; see the file COPYING.  If not, write to
# the Free Software Foundation, Inc., 51 Franklin Street,
# Boston, MA 02110-1301, USA.
import sys
import struct
import time
from pcapdump.pcapdump import *
DLT_EN10MB = 1
DLT_BLUETOOTH_HCI_H4 = 187
ELLISYS_CSV_HDR = "\"Depth\",\"Time\",\"Name\",\"Data\"\x0d\x0a"
ELLISYS_HID_INPUT = "HID Input 1"
USBHID_MAP = {
    0x04 : "a",
    0x05 : "b",
    0x06 : "c",
    0x07 : "d",
    0x08 : "e",
    0x09 : "f",
    0x0A : "g",
    0x0B : "h",
    0x0C : "i",
    0x0D : "j",
    0x0E : "k",
    0x0F : "l",
    0x10 : "m",
    0x11 : "n",
    0x12 : "o",
    0x13 : "p",
    0x14 : "q",
    0x15 : "r",
    0x16 : "s",
    0x17 : "t",
    0x18 : "u",
    0x19 : "v",
    0x1A : "w",
    0x1B : "x",
    0x1C : "y",
    0x1D : "z",
    0x1E : "1",
    0x1F : "2",
    0x20 : "3",
    0x21 : "4",
    0x22 : "5",
    0x23 : "6",
    0x24 : "7",
    0x25 : "8",
    0x26 : "9",
    0x27 : "0",
    0x28 : "[Return]\n",
    0x29 : "[Esc]",
    0x2A : "[Backspace]",
    0x2B : "[Tab]\t",
    0x2C : " ",
    0x2D : "-",
    0x2E : "=",
    0x2F : "[",
    0x30 : "]",
    0x31 : "\\",
    0x32 : "#",
    0x33 : ";",
    0x34 : "'",
    0x35 : "[Grave Accent]",
    0x36 : ",",
    0x37 : ".",
    0x38 : "/",
    0x39 : "[Caps Lock]",
    0x3A : "[F1]",
    0x3B : "[F2]",
    0x3C : "[F3]",
    0x3D : "[F4]",
    0x3E : "[F5]",
    0x3F : "[F6]",
    0x40 : "[F7]",
    0x41 : "[F8]",
    0x42 : "[F9]",
    0x43 : "[F10]",
    0x44 : "[F11]",
    0x45 : "[F12]",
    0x46 : "[PrintScreen]",
    0x47 : "[Scroll]",
    0x48 : "[Pause]",
    0x49 : "[Insert]",
    0x4A : "[Home]",
    0x4B : "[PageUp]",
    0x4C : "[Delete]",
    0x4D : "[End]",
    0x4E : "[PageDown]",
    0x4F : "[RightArrow]",
    0x50 : "[LeftArrow]",
    0x51 : "[DownArrow]",
    0x52 : "[UpArrow]",
    0x53 : "[Keypad Num Lock and Clear]",
    0x54 : "[Keypad /]",
    0x55 : "[Keypad *]",
    0x56 : "[Keypad -]",
    0x57 : "[Keypad +]",
    0x58 : "[Keypad Enter]\n",
    0x59 : "[Keypad 1 and End]",
    0x5A : "[Keypad 2 and Down Arrow]",
    0x5B : "[Keypad 3 and PageDn]",
    0x5C : "[Keypad 4 and Left Arrow]",
    0x5D : "[Keypad 5]",
    0x5E : "[Keypad 6 and Right Arrow]",
    0x5F : "[Keypad 7 and Home]",
    0x60 : "[Keypad 8 and Up Arrow]",
    0x61 : "[Keypad 9 and PageUp]",
    0x62 : "[Keypad 0 and Insert]",
    0x63 : "[Keypad . and Delete]",
    0x64 : "\\",
    0x65 : "[WinKey]",
    0x66 : "[Power9]",
    0x67 : "[Keypad =]",
    0x68 : "[F13]",
    0x69 : "[F14]",
    0x6A : "[F15]",
    0x6B : "[F16]",
    0x6C : "[F17]",
    0x6D : "[F18]",
    0x6E : "[F19]",
    0x6F : "[F20]",
    0x70 : "[F21]",
    0x71 : "[F22]",
    0x72 : "[F23]",
    0x73 : "[F24]",
    0x74 : "[Execute]",
    0x75 : "[Help]",
    0x76 : "[Menu]",
    0x77 : "[Select]",
    0x78 : "[Stop]",
    0x79 : "[Again]",
    0x7A : "[Undo]",
    0x7B : "[Cut]",
    0x7C : "[Copy]",
    0x7D : "[Paste]",
    0x7E : "[Find]",
    0x7F : "[Mute]",
    0x80 : "[Volume Up]",
    0x81 : "[Volume Down]",
    0x82 : "[Locking Caps Lock]",
    0x83 : "[Locking Num Lock]",
    0x84 : "[Locking Scroll Lock]",
    0x85 : "[Keypad Comma]",
    0x86 : "[Keypad Equal]",
    0x87 : "[International1]",
    0x88 : "[International2]",
    0x89 : "[International3]",
    0x8A : "[International4]",
    0x8B : "[International5]",
    0x8C : "[International6]",
    0x8D : "[International7]",
    0x8E : "[International8]",
    0x8F : "[International9]",
    0x90 : "[LANG1]",
    0x91 : "[LANG2]",
    0x92 : "[LANG3]",
    0x93 : "[LANG4]",
    0x94 : "[LANG5]",
    0x95 : "[LANG6]",
    0x96 : "[LANG7]",
    0x97 : "[LANG8]",
    0x98 : "[LANG9]",
    0x99 : "[Alternate Erase]",
    0x9A : "[SysReq/Attention]",
    0x9B : "[Cancel]",
    0x9C : "[Clear]",
    0x9D : "[Prior]",
    0x9E : "[Return]\n",
    0x9F : "[Separator]",
    0xA0 : "[Out]",
    0xA1 : "[Oper]",
    0xA2 : "[Clear/Again]",
    0xA3 : "[CrSel/Props]",
    0xA4 : "[ExSel]",
    0xB0 : "[Keypad 00]",
    0xB1 : "[Keypad 000]",
    0xB2 : "[Thousands Separator]",
    0xB3 : "[Decimal Separator]",
    0xB4 : "[Currency Unit]",
    0xB5 : "[Currency Sub-unit]",
    0xB6 : "[Keypad (]",
    0xB7 : "[Keypad )]",
    0xB8 : "[Keypad {]",
    0xB9 : "[Keypad }]",
    0xBA : "[Keypad Tab]\t",
    0xBB : "[Keypad Backspace]",
    0xBC : "[Keypad A]",
    0xBD : "[Keypad B]",
    0xBE : "[Keypad C]",
    0xBF : "[Keypad D]",
    0xC0 : "[Keypad E]",
    0xC1 : "[Keypad F]",
    0xC2 : "[Keypad XOR]",
    0xC3 : "[Keypad ^]",
    0xC4 : "[Keypad %]",
    0xC5 : "[Keypad <]",
    0xC6 : "[Keypad >]",
    0xC7 : "[Keypad &]",
    0xC8 : "[Keypad &&]",
    0xC9 : "[Keypad |]",
    0xCA : "[Keypad ||]",
    0xCB : "[Keypad :]",
    0xCC : "[Keypad #]",
    0xCD : "[Keypad Space]",
    0xCE : "[Keypad @]",
    0xCF : "[Keypad !]",
    0xD0 : "[Keypad Memory Store]",
    0xD1 : "[Keypad Memory Recall]",
    0xD2 : "[Keypad Memory Clear]",
    0xD3 : "[Keypad Memory Add]",
    0xD4 : "[Keypad Memory Subtract]",
    0xD5 : "[Keypad Memory Multiply]",
    0xD6 : "[Keypad Memory Divide]",
    0xD7 : "[Keypad +/-]",
    0xD8 : "[Keypad Clear]",
    0xD9 : "[Keypad Clear Entry]",
    0xDA : "[Keypad Binary]",
    0xDB : "[Keypad Octal]",
    0xDC : "[Keypad Decimal]",
    0xDD : "[Keypad Hexadecimal]",
    0xE0 : "[LeftControl]",
    0xE1 : "[LeftShift]",
    0xE2 : "[LeftAlt]",
    0xE3 : "[LeftWinKey]",
    0xE4 : "[RightControl]",
    0xE5 : "[RightShift]",
    0xE6 : "[RightAlt]",
    0xE7 : "[RightWinKey]"
}
# some keycodes represent different things when Shift is held down
USBHID_SHIFT_MAP = {
    0x04 : "A",
    0x05 : "B",
    0x06 : "C",
    0x07 : "D",
    0x08 : "E",
    0x09 : "F",
    0x0A : "G",
    0x0B : "H",
    0x0C : "I",
    0x0D : "J",
    0x0E : "K",
    0x0F : "L",
    0x10 : "M",
    0x11 : "N",
    0x12 : "O",
    0x13 : "P",
    0x14 : "Q",
    0x15 : "R",
    0x16 : "S",
    0x17 : "T",
    0x18 : "U",
    0x19 : "V",
    0x1A : "W",
    0x1B : "X",
    0x1C : "Y",
    0x1D : "Z",
    0x1E : "!",
    0x1F : "@",
    0x20 : "#",
    0x21 : "$",
    0x22 : "%",
    0x23 : "^",
    0x24 : "&",
    0x25 : "*",
    0x26 : "(",
    0x27 : ")",
    0x2D : "_",
    0x2E : "+",
    0x2F : "{",
    0x30 : "}",
    0x31 : "|",
    0x32 : "~",
    0x33 : ":",
    0x34 : "\"",
    0x35 : "~",
    0x36 : "<",
    0x37 : ">",
    0x38 : "?",
    0x64 : "|"
}
# global variable to track currently depressed keys
active_keys = []
def hid2ascii(scancode, shift):
    '''
    Convert the specified scancode value to the ASCII equivalent using the
    USBHID_MAP list.
    '''
    if shift:
        try:
            code = USBHID_SHIFT_MAP[scancode]
            return code
        except KeyError:
            pass
    try:
        code = USBHID_MAP[scancode]
    except KeyError:
        return "[Reserved]" 
    return code
def usage():
    print >>sys.stderr, "Usage: btaptap [-r pcapfile.pcap | -e ellisysfile.csv] [-c count] [-h]\n"
    sys.exit(0)
def parse_l2cap_keydata(l2cappkt):
    global active_keys
    TRANS_HDR_IN_DATA = 0xA1
    REPORT_ID_KEYBOARD = 0x01
    CTRL = 1
    SHIFT = 2
    ALT = 4
    GUI = 8
    # Keyboard keystrokes are only seen in L2CAP packets at least 10 bytes long
    l2clen = (ord(l2cappkt[1]) << 8) | ord(l2cappkt[0])
    if l2clen < 10:
        return
    # Keyboard keystrokes are only carried by Channel ID >= 0x40
    cid = (ord(l2cappkt[3]) << 8) | ord(l2cappkt[2])
    if cid < 0x40:
        return
    # Ideally we would check for the particular CID for the HID_INTERRUPT
    # channel, but we don't handle the negotiation (and may not have even
    # seen it).
    # Transaction Header should indicate input data
    thdr = ord(l2cappkt[4])
    if thdr != TRANS_HDR_IN_DATA:
        return
    # Report ID should indicate this is a keyboard
    rid = ord(l2cappkt[5])
    if rid != REPORT_ID_KEYBOARD:
        return
    # This byte describes modifier key status (one bit per key)
    mod = ord(l2cappkt[6])
    # We don't care whether left or right modifier keys are pressed, so we
    # combine the status bits.
    leftmod = mod & 0x0f
    rightmod = (mod & 0xf0) >> 4
    mod = leftmod | rightmod
    # up to six keys can be reported at once
    keycodes = []
    #for byte in range(8,14):
    for byte in range(8,11):
        keystroke = ord(l2cappkt[byte])
        if keystroke != 0x00:
            keycodes.append(keystroke)
    
    for keystroke in keycodes:
        # don't repeat keys that are still held down
        if active_keys.count(keystroke) == 0:
            if (mod & CTRL):
                sys.stdout.write("CTRL^")
            if (mod & ALT):
                sys.stdout.write("ALT^")
            if (mod & GUI): # e.g. Windows key
                sys.stdout.write("GUI^")
            sys.stdout.write(hid2ascii(keystroke, mod & SHIFT))
    active_keys = keycodes
def parse_ellisys_export(exportfile):
    try:
        cap = open(exportfile, "r")
    except (OSError, IOError) as e:
        print >>sys.stderr, "Unable to open Ellisys capture file."
        return
    # Check to make sure the CSV file header matches out expectations
    hdr=cap.readline()
    if (hdr != ELLISYS_CSV_HDR):
        print >>sys.stderr, "Invalid CSV file (does not match Ellisys export format)"
        return
    for packetline in cap.xreadlines():
        try:
            (edepth, etime, ename, edata) = packetline.replace('"', '').strip().split(",")
        except ValueError:
            continue
        # We are only interedted in HID Input data
        if (ename != ELLISYS_HID_INPUT): continue
        parse_ellisys_keydata(edata)
def parse_ellisys_keydata(payload):
    TRANS_HDR_IN_DATA = "\xA1"
    DEST_CHANNEL_ID = "\x06\x03"
    # Convert space-separated hex into string
    payload = payload.replace(' ','').decode("hex")
    # The Ellisys CSV file format doesn't give us the L2CAP data, so we fake it here by adding
    # a 2-byte length field, destination CID, and transaction header
    packet = chr(len(payload)+1) + "\x00" + DEST_CHANNEL_ID + TRANS_HDR_IN_DATA + payload
    parse_l2cap_keydata(packet)
def parse_bb_keydata(packet):
    BTBBHDR_TYPE_MASK = 0x78
    BTBBHDR_TYPE_SHIFT = 3
    BTBBHDR_TYPE_DM1 = 3
    BTBBPAYLOADHDR_LLID_MASK = 0x03
    BTBBPAYLOADHDR_LLID_SHIFT = 0
    BTBBPAYLOADHDR_LEN_MASK = 0xF8
    BTBBPAYLOADHDR_LEN_SHIFT = 3
    LLID_L2CAP = 2
    # Keyboard keystrokes are only seen in frames at least 40 bytes long
    if len(packet) < 40:
        return
    # Keyboard keystrokes are only seen in DM1 frames
    btbbhdr = packet[20:23]
    type = (ord(btbbhdr[0]) & BTBBHDR_TYPE_MASK) >> BTBBHDR_TYPE_SHIFT
    if type != BTBBHDR_TYPE_DM1:
        return
    # Keyboard keystrokes are only seen in L2CAP packets 14 bytes long
    btbbpayloadhdr = ord(packet[23])
    llid = btbbpayloadhdr & (BTBBPAYLOADHDR_LLID_MASK) >> BTBBPAYLOADHDR_LLID_SHIFT
    l2clen = (btbbpayloadhdr & BTBBPAYLOADHDR_LEN_MASK) >> BTBBPAYLOADHDR_LEN_SHIFT
    #print "Debug btbbpayloadhdr 0x%02x, llid %d, l2clen %d"%(btbbpayloadhdr, llid, l2clen)
    if llid != LLID_L2CAP or l2clen < 14:
        return
    parse_l2cap_keydata(packet[24:38])
def parse_hci_keydata(packet):
    HCI_TYPE_ACL_DATA = 2
    # Keyboard keystrokes are only seen in frames at least 19 bytes long
    if len(packet) < 19:
        return
    # Keyboard keystrokes are only seen in ACL Data frames
    type = ord(packet[0])
    if type != HCI_TYPE_ACL_DATA:
        return
    parse_l2cap_keydata(packet[5:])
if __name__ == '__main__':
    arg_pcapfile = None
    arg_ellisysfile = None
    arg_count = -1
    packetcount = 0
    while len(sys.argv) > 1:
        op = sys.argv.pop(1)
        if op == '-r':
            arg_pcapfile = sys.argv.pop(1)
        if op == '-c':
            arg_count = int(sys.argv.pop(1))
        if op == '-e':
            arg_ellisysfile = sys.argv.pop(1)
        if op == '-h':
            usage()
            sys.exit(0)
    if (arg_ellisysfile == None and arg_pcapfile == None):
        print >>sys.stderr, "Must specify a libpcap capture or an Ellisys CSV file"
        usage()
        sys.exit(0)
    if arg_pcapfile != None:
        cap = PcapReader(arg_pcapfile)
    
        while arg_count != packetcount:
            try:
                (pheader, packet) = cap.pnext()
                pkttime = pheader[0]
                packetcount+=1
        
                if cap.datalink() == DLT_EN10MB:
                    parse_bb_keydata(packet)
                elif cap.datalink() == DLT_BLUETOOTH_HCI_H4:
                    parse_hci_keydata(packet)
                else:
                    print >>sys.stderr, "Unsupported libpcap data link layer: %d\n" % cap.datalink()
            except TypeError: # raised when pnext returns Null (end of capture)
                break
    
        cap.close()
    if arg_ellisysfile != None:
        parse_ellisys_export(arg_ellisysfile)
    print
 |