How to profile the communication protocol of my Microsoft Arc wireless keyboard?

Question

I bought a new keyboard for windows, datasheet, and I would like to sniff the packets between the keyboard and the pc / USB transmitter.

The datasheet is useless and there is nothing informative for this purpose as I see it.

Firstly to see what protocol they use I have to see what is transmitted, I prefer not to open the keyboard and be in the middle between the computer and the keyboard.

I thought to build some RLC circuit around 2.4 Ghz and see the Voltage changes according to the keystrokes. Is there any smarter and better way to do it?

Answer 1

Of course you can capture the USB packets, although you'd probably find it more useful to capture the keystrokes (if your goal is to mimic what happens when a certain key of your keybard is pressed).

To capture network and usb traffic start with wireshark. It's a great tool to capture and analyse all network traffic.

Because you are interested in USB traffic you should attempt to do this. Note that it'll work only if you are running a windows session on a linux host.

Probably you are not, but i just thought i'd say.

Other options are also listed in wireshark site, and there are also paid tools (although with functional trial), for instance USBlyser, which would work in windows7, they say.

If you just need the keystrokes you could use this or some other software that allows you to record/view the key code received from the keyboard.

Good luck!

Answer 2

Building an RLC circuit will not work, at least not very well. You will need a 2.4 GHz antenna that is fed into your circuity. This is a lot of work for someone inexperienced, and can even be a lot of work for someone who IS experienced. You will also have issue determining if the signals you are seeing are coming from the keyboard, or a wifi router, or from something else around. Overall, I would not recommend going down this route.

As far as I can tell, this keyboard is not using Bluetooth. If they were using bluetooth, I am sure they would advertise it as such since this is a big selling point for some keyboard (due to interoperability with built in bluetooth). So I wouldn't worry about going down the path of sniffing bluetooth.

Clabacchio linked to some packet sniffers, a quick look at them looks like they can sniff 802.15.4. 802.15.4 is a standard that is used for many things at the physical layer and media access control layer. There is a decent chance the Microsoft would have built their technology on top of 802.15.4, but no promises. If they did use it, then just pick yourself up one of those sniffers and start capturing data. It will take a lot of trial and error of typing a key and seeing what is captured, and just keep doing it and see if there are any patterns. Where problems will arise is if they are encrypting the signal before transmitting it, it would be very difficult to determine anything at all. People devote their lives to trying to crack encryption. It usually take years of work before anyone cracks commercially used encryption. If they are encrypting the signals, you might get lucky and figure out they are using weak encryption, but if not then you should just give up on trying to sniff it.

The other problem you might run into is if they aren't using a standard protocol, you would need to interpret what the signals being sent actually mean. This is a long process that I would not recommend. But if you wanted to go down this path, you would best off to get yourself into an environment with no other 2.4GHz signals around so that you know that every thing you see at the frequency is relevant to the keyboards communication. You would have to follow a similar process as I mentioned before where you press a key and see what you receive, but instead you would be looking at most likely phase changes in a carrier signal and interpreting what those mean as far as 1's and 0's and then would have to interpret what they meant to the keyboard.

Answer 3

I think this is a very hard task.

Probably the communication will be encrypted, so it's not easy to decode the messages and get in communication with the keyboard. So, even if you sniff the packet, it's likely that there is some sort of messages memory that prevent from sending the same message two times.

Note that encryption is not only used for security, but also to ensure that devices don't interfere; so there's a 90% chance that signals will be encrypted.

So, if you use a sniffer, maybe you can catch the messages that the keyboard is sending, but I think it's hard that you will be able to do anything with them.

One possible solution could be a Texas Instruments SmartRF sniffer

Or, if you want to put your hands in this stuff and write your program, you can use a module like the Jennic, that saves you from building the transceiver and the antenna.