Lion Cipher Lab
Decode USB keyboard keystrokes from a usbmon capture: read the raw HID reports and reconstruct exactly what was typed
- Foundations
- Intermediate
- ~45 min
- Free · no account required
Why it matters
When a suspicious USB device is plugged into a machine, the only way to prove what it actually TYPED is to read the USB traffic itself. A BadUSB device — a thumb drive or cable that secretly claims to be a keyboard — works because the operating system obeys anything that says 'I am a keyboard' and injects keystrokes faster than a human could. At the wire, those keystrokes are plain 8-byte reports. Learning to capture and decode them is exactly how a forensic analyst reconstructs a malicious device's payload, and it makes the HID trust problem concrete: the computer never checks whether a…
What you'll learn
- capturing USB traffic with usbmon and Wireshark/tshark
- identifying HID Interrupt IN transfers in a capture
- reading the 8-byte HID Boot Protocol keyboard report
- decoding the modifier bitmask (Ctrl/Shift/Alt/GUI)
- mapping HID usage codes back to literal keystrokes
- reconstructing 'what was typed' from raw USB — malicious-device forensics
- understanding why HID is a trust problem at the wire level
Steps in this lab
- What we're doing, and the words you need first
- Authorization first — this captures literal keystrokes
- Load the usbmon module
- Find which bus your external keyboard is on
- Start capturing — Wireshark or tshark
- Type a known short word on the external keyboard
- Isolate the HID Interrupt IN reports
- Learn the 8-byte report layout and the codes
- Decode your reports back into the typed text
- Confirm your decode matches what you typed
- Do it better — scripts, other dumpers, and Windows