0
\$\begingroup\$

I bought a new keyboard for windows, datasheet, and I would like to sniff the packets between the keyboard and the pc / USB transmitter.

The datasheet is useless and there is nothing informative for this purpose as I see it.

Firstly to see what protocol they use I have to see what is transmitted, I prefer not to open the keyboard and be in the middle between the computer and the keyboard.

I thought to build some RLC circuit around 2.4 Ghz and see the Voltage changes according to the keystrokes. Is there any smarter and better way to do it?

\$\endgroup\$
  • \$\begingroup\$ You might find more help for this on Super User. The case is that unless you are ready to get into real hardware hacking, which I don't think is the best way to do this at all, Super User can help you get the software to monitor what is going on with your keyboard. \$\endgroup\$ – Kortuk Jan 27 '12 at 11:48
  • \$\begingroup\$ @Kortuk but if he's talking about RF sniffers, could be an interesting topic, don't you think? \$\endgroup\$ – clabacchio Jan 27 '12 at 11:57
  • \$\begingroup\$ @clabacchio, I never said I was closing as off topic, but based on the question I am not sure the user has enough RF background to easily do RF sniffing. I love RF, it is one of my passions, just thought I would note where answers may be found faster. \$\endgroup\$ – Kortuk Jan 27 '12 at 12:40
  • \$\begingroup\$ @Kortuk Got it! I thought you were of the same advise of Qsp whose asnwer, as I see it, is more a Super User way. \$\endgroup\$ – clabacchio Jan 27 '12 at 12:47
  • 1
    \$\begingroup\$ @ZoZo123 What you linked to is not a datasheet at all, it is a user manual. Consumer electronics intentionally don't give out true datasheets because no consumer really needs it and it would make it really easy for someone to reproduce a "fake" version of the same product. \$\endgroup\$ – Kellenjb Jan 27 '12 at 14:03
1
\$\begingroup\$

Of course you can capture the USB packets, although you'd probably find it more useful to capture the keystrokes (if your goal is to mimic what happens when a certain key of your keybard is pressed).

To capture network and usb traffic start with wireshark. It's a great tool to capture and analyse all network traffic.

Because you are interested in USB traffic you should attempt to do this. Note that it'll work only if you are running a windows session on a linux host.

Probably you are not, but i just thought i'd say.

Other options are also listed in wireshark site, and there are also paid tools (although with functional trial), for instance USBlyser, which would work in windows7, they say.

If you just need the keystrokes you could use this or some other software that allows you to record/view the key code received from the keyboard.

Good luck!

\$\endgroup\$
4
\$\begingroup\$

Building an RLC circuit will not work, at least not very well. You will need a 2.4 GHz antenna that is fed into your circuity. This is a lot of work for someone inexperienced, and can even be a lot of work for someone who IS experienced. You will also have issue determining if the signals you are seeing are coming from the keyboard, or a wifi router, or from something else around. Overall, I would not recommend going down this route.

As far as I can tell, this keyboard is not using Bluetooth. If they were using bluetooth, I am sure they would advertise it as such since this is a big selling point for some keyboard (due to interoperability with built in bluetooth). So I wouldn't worry about going down the path of sniffing bluetooth.

Clabacchio linked to some packet sniffers, a quick look at them looks like they can sniff 802.15.4. 802.15.4 is a standard that is used for many things at the physical layer and media access control layer. There is a decent chance the Microsoft would have built their technology on top of 802.15.4, but no promises. If they did use it, then just pick yourself up one of those sniffers and start capturing data. It will take a lot of trial and error of typing a key and seeing what is captured, and just keep doing it and see if there are any patterns. Where problems will arise is if they are encrypting the signal before transmitting it, it would be very difficult to determine anything at all. People devote their lives to trying to crack encryption. It usually take years of work before anyone cracks commercially used encryption. If they are encrypting the signals, you might get lucky and figure out they are using weak encryption, but if not then you should just give up on trying to sniff it.

The other problem you might run into is if they aren't using a standard protocol, you would need to interpret what the signals being sent actually mean. This is a long process that I would not recommend. But if you wanted to go down this path, you would best off to get yourself into an environment with no other 2.4GHz signals around so that you know that every thing you see at the frequency is relevant to the keyboards communication. You would have to follow a similar process as I mentioned before where you press a key and see what you receive, but instead you would be looking at most likely phase changes in a carrier signal and interpreting what those mean as far as 1's and 0's and then would have to interpret what they meant to the keyboard.

\$\endgroup\$
2
\$\begingroup\$

I think this is a very hard task.

Probably the communication will be encrypted, so it's not easy to decode the messages and get in communication with the keyboard. So, even if you sniff the packet, it's likely that there is some sort of messages memory that prevent from sending the same message two times.

Note that encryption is not only used for security, but also to ensure that devices don't interfere; so there's a 90% chance that signals will be encrypted.

So, if you use a sniffer, maybe you can catch the messages that the keyboard is sending, but I think it's hard that you will be able to do anything with them.

One possible solution could be a Texas Instruments SmartRF sniffer

Or, if you want to put your hands in this stuff and write your program, you can use a module like the Jennic, that saves you from building the transceiver and the antenna.

\$\endgroup\$
  • \$\begingroup\$ I assume you are right, but how can I only sniff the data? \$\endgroup\$ – 0x90 Jan 27 '12 at 11:08
  • \$\begingroup\$ I don't know exactly the way to do that, but you need a microcontroller with a 2.4GHz (probably 802.15.4) transceiver, and program it to stay in receive mode while sweeping between all possible channels and sending out (by UART for instance) all the messages that it get (fixing a strength threshold could be a good idea). \$\endgroup\$ – clabacchio Jan 27 '12 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.