summaryrefslogtreecommitdiffstats
path: root/hidd/fakehid.txt
blob: 000d0ee2fce59437dea477ae7a380bc1076ebd45 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
EPox Presenter
==============

# hcitool inq
Inquiring ...
        00:04:61:aa:bb:cc       clock offset: 0x1ded    class: 0x004000

# hcitool info 00:04:61:aa:bb:cc
Requesting information ...
        BD Address:  00:04:61:aa:bb:cc
        OUI Company: EPOX Computer Co., Ltd. (00-04-61)
        Device Name: EPox BT-PM01B aabbcc
        LMP Version: 1.1 (0x1) LMP Subversion: 0xf78
        Manufacturer: Cambridge Silicon Radio (10)
        Features: 0xff 0xff 0x0f 0x00 0x00 0x00 0x00 0x00
                <3-slot packets> <5-slot packets> <encryption> <slot offset> 
                <timing accuracy> <role switch> <hold mode> <sniff mode> 
                <park state> <RSSI> <channel quality> <SCO link> <HV2 packets> 
                <HV3 packets> <u-law log> <A-law log> <CVSD> <paging scheme> 
                <power control> <transparent SCO> 

# sdptool records --raw 00:04:61:aa:bb:cc
Sequence
        Attribute 0x0000 - ServiceRecordHandle
                UINT32 0x00010000
        Attribute 0x0001 - ServiceClassIDList
                Sequence
                        UUID16 0x1101 - SerialPort
        Attribute 0x0004 - ProtocolDescriptorList
                Sequence
                        Sequence
                                UUID16 0x0100 - L2CAP
                        Sequence
                                UUID16 0x0003 - RFCOMM
                                UINT8 0x01
        Attribute 0x0100
                String Cable Replacement


J-Three Keyboard
================

# hcitool inq
Inquiring ...
        00:0A:3A:aa:bb:cc       clock offset: 0x3039    class: 0x001f00

# hcitool info 00:0A:3A:aa:bb:cc
Password:
Requesting information ...
        BD Address:  00:0A:3A:aa:bb:cc
        OUI Company: J-THREE INTERNATIONAL Holding Co., Ltd. (00-0A-3A)
        Device Name: KEYBOARD
        LMP Version: 1.1 (0x1) LMP Subversion: 0x2c2
        Manufacturer: Cambridge Silicon Radio (10)
        Features: 0xbc 0x06 0x07 0x00 0x00 0x00 0x00 0x00
                <encryption> <slot offset> <timing accuracy> <role switch> 
                <sniff mode> <RSSI> <channel quality> <CVSD> <paging scheme> 
                <power control> 

# sdptool records --raw 00:0A:3A:aa:bb:cc
Sequence
        Attribute 0x0000 - ServiceRecordHandle
                UINT32 0x00010000
        Attribute 0x0001 - ServiceClassIDList
                Sequence
                        UUID16 0x1101 - SerialPort
        Attribute 0x0004 - ProtocolDescriptorList
                Sequence
                        Sequence
                                UUID16 0x0100 - L2CAP
                        Sequence
                                UUID16 0x0003 - RFCOMM
                                UINT8 0x01
        Attribute 0x0006 - LanguageBaseAttributeIDList
                Sequence
                        UINT16 0x656e
                        UINT16 0x006a
                        UINT16 0x0100
        Attribute 0x0100
                String SPP slave


Celluon Laserkey Keyboard
=========================

# hcitool inq
Inquiring ...
       00:0B:24:aa:bb:cc       clock offset: 0x3ab6    class: 0x400210

# hcitool info 00:0B:24:aa:bb:cc
Requesting information ...
       BD Address:  00:0B:24:aa:bb:cc
       OUI Company: AirLogic (00-0B-24)
       Device Name: CL800BT
       LMP Version: 1.1 (0x1) LMP Subversion: 0x291
       Manufacturer: Cambridge Silicon Radio (10)
       Features: 0xff 0xff 0x0f 0x00 0x00 0x00 0x00 0x00
               <3-slot packets> <5-slot packets> <encryption> <slot offset>
               <timing accuracy> <role switch> <hold mode> <sniff mode>
               <park state> <RSSI> <channel quality> <SCO link> <HV2 packets>
               <HV3 packets> <u-law log> <A-law log> <CVSD> <paging scheme>
               <power control> <transparent SCO>

# sdptool records --raw 00:0B:24:aa:bb:cc
Sequence
         Attribute 0x0000 - ServiceRecordHandle
                 UINT32 0x00010000
         Attribute 0x0001 - ServiceClassIDList
                 Sequence
                         UUID16 0x1101 - SerialPort
         Attribute 0x0004 - ProtocolDescriptorList
                 Sequence
                         Sequence
                                 UUID16 0x0100 - L2CAP
                         Sequence
                                 UUID16 0x0003 - RFCOMM
                                 UINT8 0x01
         Attribute 0x0100
                 String Serial Port

Packet format is as follows (all fields little-endian):
     0 uint16  magic            # 0x5a5a
     2 uint32  unknown          # ???
     6 uint8   action           # 0 = keyup, 1 = keydown, 2 = repeat
                                # 3, 4, 5, 6 = ??? (Mouse mode)
     7 uint8   unknown[9]       # ???
    16 uint8   action2          # ??? same as action
    17 uint16  x                # Horizontal coordinate
    19 uint16  y                # Vertical coordinate
    21 uint16  time             # Some sort of timestamp
    23 uint8   unknown[5]       # ???
    28 uint8   key[]            # single byte keycode or 0xff byte
                                # follwed by special keycode byte.
    Each packet followed by a checksum byte.