1
tshark -r .\easyUSB.pcapng -T fields -e usb.capdata
2

3
-r   指定流量包文件
4
-T   指定筛选的字段名称（可以通过右键进行复制字段名称）

1
#!/usr/bin/env python
2

3
import sys
4
import os
5

6
DataFileName = "usb.dat"
7

8
presses = []
9

10
normalKeys = {"04": "a", "05": "b", "06": "c", "07": "d", "08": "e", "09": "f", "0a": "g", "0b": "h", "0c": "i",
11
              "0d": "j", "0e": "k", "0f": "l", "10": "m", "11": "n", "12": "o", "13": "p", "14": "q", "15": "r",
12
              "16": "s", "17": "t", "18": "u", "19": "v", "1a": "w", "1b": "x", "1c": "y", "1d": "z", "1e": "1",
13
              "1f": "2", "20": "3", "21": "4", "22": "5", "23": "6", "24": "7", "25": "8", "26": "9", "27": "0",
14
              "28": "<RET>", "29": "<ESC>", "2a": "<DEL>", "2b": "\t", "2c": "<SPACE>", "2d": "-", "2e": "=", "2f": "[",
15
              "30": "]", "31": "\\", "32": "<NON>", "33": ";", "34": "'", "35": "<GA>", "36": ",", "37": ".", "38": "/",
16
              "39": "<CAP>", "3a": "<F1>", "3b": "<F2>", "3c": "<F3>", "3d": "<F4>", "3e": "<F5>", "3f": "<F6>",
17
              "40": "<F7>", "41": "<F8>", "42": "<F9>", "43": "<F10>", "44": "<F11>", "45": "<F12>"}
18

19
shiftKeys = {"04": "A", "05": "B", "06": "C", "07": "D", "08": "E", "09": "F", "0a": "G", "0b": "H", "0c": "I",
20
             "0d": "J", "0e": "K", "0f": "L", "10": "M", "11": "N", "12": "O", "13": "P", "14": "Q", "15": "R",
21
             "16": "S", "17": "T", "18": "U", "19": "V", "1a": "W", "1b": "X", "1c": "Y", "1d": "Z", "1e": "!",
22
             "1f": "@", "20": "#", "21": "$", "22": "%", "23": "^", "24": "&", "25": "*", "26": "(", "27": ")",
23
             "28": "<RET>", "29": "<ESC>", "2a": "<DEL>", "2b": "\t", "2c": "<SPACE>", "2d": "_", "2e": "+", "2f": "{",
24
             "30": "}", "31": "|", "32": "<NON>", "33": ":", "34": "\"", "35": "<GA>", "36": "<", "37": ">", "38": "?",
25
             "39": "<CAP>", "3a": "<F1>", "3b": "<F2>", "3c": "<F3>", "3d": "<F4>", "3e": "<F5>", "3f": "<F6>",
26
             "40": "<F7>", "41": "<F8>", "42": "<F9>", "43": "<F10>", "44": "<F11>", "45": "<F12>"}
27

28

29
def main():
30
    # check argv
31
    # if len(sys.argv) != 2:
32
    #     print("Usage : ")
33
    #     print("        python UsbKeyboardHacker.py data.pcap")
34
    #     print("Tips : ")
35
    #     print("        To use this python script , you must install the tshark first.")
36
    #     print("        You can use `sudo apt-get install tshark` to install it")
37
    #     print("Author : ")
38
    #     print("        WangYihang <wangyihanger@gmail.com>")
39
    #     print("        If you have any questions , please contact me by email.")
40
    #     print("        Thank you for using.")
41
    #     exit(1)
42

43
    # get argv
44
    # pcapFilePath = sys.argv[1]
45
    pcapFilePath = 'easyUSB.pcapng'
46

47
    # get data of pcap
48
    # os.system("tshark -r %s -T fields -e usbhid.data 'usb.data_len == 8' > %s" % (pcapFilePath, DataFileName))
49
    # os.system("tshark -r %s -T fields -e usbhid.data" % (pcapFilePath))
50
    os.system("tshark -r %s -T fields -e usb.capdata > %s" % (pcapFilePath, DataFileName))
51

52
    # read data
53
    with open(DataFileName, "r") as f:
54
        for line in f:
55
            presses.append(line[0:-1])
56
    # handle
57
    result = ""
58
    for press in presses:
59
        if press == '':
60
            continue
61
        if ':' in press:
62
            Bytes = press.split(":")
63
        else:
64
            Bytes = [press[i:i + 2] for i in range(0, len(press), 2)]
65
        if Bytes[0] == "00":
66
            if Bytes[2] != "00" and normalKeys.get(Bytes[2]):
67
                result += normalKeys[Bytes[2]]
68
        elif int(Bytes[0], 16) & 0b10 or int(Bytes[0], 16) & 0b100000:  # shift key is pressed.
69
            if Bytes[2] != "00" and normalKeys.get(Bytes[2]):
70
                result += shiftKeys[Bytes[2]]
71
        else:
72
            print("[-] Unknow Key : %s" % (Bytes[0]))
73
    print("[+] Found : %s" % (result))
74

75
    # clean the temp data
76
    # os.system("rm ./%s" % (DataFileName))
77

78

79
if __name__ == "__main__":
80
    main()