关于usb流量分析关于usb流量分析

我的天啊战队那个页面，卡到昏迷，嗦不出发（
等想起来每月一篇的时候已经是30号下午四点了，整个人都我的冷静就是这样.jpg
我知道这篇水了我反省……求不打……
总之前略，朋友，usb了解一下（不是）
http://www.usb.org/developers/hidpage/Hut1_12v2.pdf
文中提到的例题下载：
链接：https://pan.baidu.com/s/1g-cAdNzl3YoCFZoq1F6UCA 密码：rltz
鼠标流量

鼠标移动时表现为连续性，与键盘击键的离散性不一样，不过实际上鼠标动作所产生的数据包也是离散的

每一个数据包的数据区有四个字节，第一个字节代表按键，当取0x00时，代表没有按键、为0x01时，代表按左键，为0x02时，代表当前按键为右键。第二个字节可以看成是一个signed byte类型，其最高位为符号位，当这个值为正时，代表鼠标水平右移多少像素，为负时，代表水平左移多少像素。第三个字节与第二字节类似，代表垂直上下移动的偏移。
键盘流量键盘数据包的数据长度为8个字节，击键信息集中在第3个字节

BYTE1 -- |--bit0:Left Control是否按下，按下为1 |--bit1:Left Shift是否按下，按下为1 |--bit2:Left Alt是否按下，按下为1 |--bit3:Left GUI是否按下，按下为1 |--bit4:Right Control是否按下，按下为1 |--bit5:Right Shift 是否按下，按下为1 |--bit6:Right Alt是否按下，按下为1 |--bit7:Right GUI是否按下，按下为1 BYTE2 -- 暂不清楚，有的地方说是保留位 BYTE3--BYTE8 -- 这六个为普通按键

例如：
键盘发送 02 00 0e 00 00 00 00 00，
表示同时按下了Left Shift + ‘k’，即大写K。
具体键位对应参见Hut1_12v2.pdf第53页。
eg：HITCTF2018-MISC-键盘流量分析
常规操作感谢一航大佬造福民众写了两个方便快捷的工具向大佬低头.jpg
从流量包中提取

tshark -r keyboard.pcap -T fields -e usb.capdata > usbdata.txt

#python脚本 #18.8.10 同学问才想起来这里还有个坑，稍改了下，自动识别大小写+删除 normalKeys = {"04":"a", "05":"b", "06":"c", "07":"d", "08":"e", "09":"f", "0a":"g", "0b":"h", "0c":"i", "0d":"j", "0e":"k", "0f":"l", "10":"m", "11":"n", "12":"o", "13":"p", "14":"q", "15":"r", "16":"s", "17":"t", "18":"u", "19":"v", "1a":"w", "1b":"x", "1c":"y", "1d":"z","1e":"1", "1f":"2", "20":"3", "21":"4", "22":"5", "23":"6","24":"7","25":"8","26":"9","27":"0","28":"","29":"","2a":"", "2b":"\t","2c":"","2d":"-","2e":"=","2f":"[","30":"]","31":"\\","32":"","33":"; ","34":"'","35":"","36":",","37":".","38":"/","39":"","3a":"","3b":"", "3c":"","3d":"","3e":"","3f":"","40":"","41":"","42":"","43":"","44":"","45":""} shiftKeys = {"04":"A", "05":"B", "06":"C", "07":"D", "08":"E", "09":"F", "0a":"G", "0b":"H", "0c":"I", "0d":"J", "0e":"K", "0f":"L", "10":"M", "11":"N", "12":"O", "13":"P", "14":"Q", "15":"R", "16":"S", "17":"T", "18":"U", "19":"V", "1a":"W", "1b":"X", "1c":"Y", "1d":"Z","1e":"!", "1f":"@", "20":"#", "21":"$", "22":"%", "23":"^","24":"&","25":"*","26":"(","27":")","28":"","29":"","2a":"", "2b":"\t","2c":"","2d":"_","2e":"+","2f":"{","30":"}","31":"|","32":"","33":"\"","34":":","35":"","36":"<","37":">","38":"?","39":"","3a":"","3b":"", "3c":"","3d":"","3e":"","3f":"","40":"","41":"","42":"","43":"","44":"","45":""} output = [] keys = open('usbdata.txt') for line in keys: try: if line[0]!='0' or (line[1]!='0' and line[1]!='2') or line[3]!='0' or line[4]!='0' or line[9]!='0' or line[10]!='0' or line[12]!='0' or line[13]!='0' or line[15]!='0' or line[16]!='0' or line[18]!='0' or line[19]!='0' or line[21]!='0' or line[22]!='0' or line[6:8]=="00": continue if line[6:8] in normalKeys.keys(): output += [[normalKeys[line[6:8]]],[shiftKeys[line[6:8]]]][line[1]=='2'] else: output += ['[unknown]'] except: pass keys.close()flag=0 print("".join(output)) for i in range(len(output)): try: a=output.index('') del output[a] del output[a-1] except: pass for i in range(len(output)): try: if output[i]=="": flag+=1 output.pop(i) if flag==2: flag=0 if flag!=0: output[i]=output[i].upper() except: pass print ('output :' + "".join(output))