path: root/docs/forensics/USB_Packet_Capture.txt

Keyboards
=========

To disect what a keyboard was typing from a USB pcap file, refer to the
"Leftover Capture Data" (as Wireshark calls it).  This field will contain
bytes describing pressed keys (scancodes), including modifier keys.

At the time of writing this, my understanding of the data format is still a
little limited.  So, this is just what I know.  Update it, over time.

First byte of Leftover Data will contain any modifier keys.  I've seen 0x20 and
0x02 both mean Shift (perhaps one is left and one is right).

Starting 3 bytes in to the data (that is, offset 2), there will be codes for any
other pressed keys.  Their meanings are in the table below.  You may see multiple
bytes here.  As best I can tell, these are just multiple keys being pressed at
the same time.

Note that when keys are released, there will be a packet with zero bytes, which
tell the host that there are no keys being pressed.

Code Table
Byte value      Unshifted       Shifted
--------------------------------------------------------------------------------

KEYBOARD
    00          Reserved (no event indicated)
    01          Keyboard ErrorRollOver
    02          Keyboard POSTFail
    03          Keyboard ErrorUndefined
    04              a              A
    05              b              B
    06              c              C
    07              d              D
    08              e              E
    09              f              F
    0A              g              G
    0B              h              H
    0C              i              I
    0D              j              J
    0E              k              K
    0F              l              L
    10              m              M
    11              n              N
    12              o              O
    13              p              P
    14              q              Q
    15              r              R
    16              s              S
    17              t              T
    18              u              U
    19              v              V
    1A              w              W
    1B              x              X
    1C              y              Y
    1D              z              Z
    1E              1              !
    1F              2              @
    20              3              #
    21              4              $
    22              5              %
    23              6              ^
    24              7              &
    25              8              *
    26              9              (
    27              0              )
    28          Return (Enter)
    29          Escape
    2A          Delete (Backspace)
    2B          Tab
    2C          Spacebar
    2D              -              _
    2E              =              +
    2F              [              {
    30              ]              }
    31              \              |
    32              #              ~                  (non US)
    33              ;              :
    34              '              "
    35              `              ~
    36              ,              <
    37              .              >
    38              /              ?
    39          Caps Lock
    3A              F1
    3B              F2
    3C              F3
    3D              F4
    3E              F5
    3F              F6
    40              F7
    41              F8
    42              F9
    43              F10
    44              F11
    45              F12
    46          Print Screen
    47          Scroll Lock
    48          Pause
    49          Insert
    4A          Home
    4B          Page Up
    4C          Delete Forward
    4D          End
    4E          Page Down
    4F          Right Arrow
    50          Left Arrow
    51          Down Arrow
    52          Up Arrow
    53          Num Lock        Clear

KEYPAD                       (column means Num Lock off)
    54              /
    55              *
    56              -
    57              +
    58          Enter
    59              1           End
    5A              2           Down Arrow
    5B              3           Page Down
    5C              4           Left Arrow
    5D              5
    5E              6           Right Arrow
    5F              7           Home
    60              8           Up Arrow
    61              9           Page Up
    62              0           Insert
    63              .           Delete
    64              \              |                  (non US)
    65          Keyboard Application
    66          Keyboard Power
    67              =


Source: https://www.youtube.com/watch?v=0HXL4RGmExo