Tags: forensics usb-keyboard 


1. Take the mappings from the pdf documentation, and create a dictionary of hex -> key value pairs.
2. Write a script which loads the `pcap` file, using `scapy` for example.
3. Read the 6th and 8th bytes counting from the end of each packet data.
4. Use the 8th byte to detect `Shift` presses.
5. Use the 6th byte to determine the symbol being typed.
6. String it all together (we can also handle backspace by removing the last element from our string).

Original writeup (https://kblagoev.com/blog/key-mission-cyberapocalypse-2021-ctf/).