SHARE
TWEET

Keyboard mouse and data via usb

a guest Jun 5th, 2018 139 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #define MAX_SENSE_LENGTH 24
  2. #define MAX_CDB_LENGTH 16
  3. #define MAX_TRANSFER_BUFFER_LENGTH 1 << 16
  4.  
  5. #define HID_MOUSE_NO_BUTTON 0
  6. #define HID_MOUSE_RIGHT_BUTTON 1
  7. #define HID_MOUSE_LEFT_BUTTON 2
  8.  
  9.  
  10.  
  11. #ifdef MS_WINDOWS
  12. #include <windows.h>
  13. #include <ntddscsi.h>
  14.  
  15. #else
  16.  
  17. #include <stdio.h>
  18. #include <errno.h>
  19. #include <string.h>
  20. #include <stdarg.h>
  21. #include <fcntl.h
  22. #include <sys/stat.h>
  23. #include <sys/types.h>
  24.  
  25. #include <scsi/sg.h>
  26. #include <sys/ioctl.h>
  27.  
  28. #define INTERFACE_ID 'S'    
  29. typedef int HANDLE;
  30. #define INVALID_HANDLE_VALUE -1
  31.  
  32. #define TRUE 1
  33. #define FALSE 0
  34.  
  35. typedef struct
  36. {
  37.     sg_io_hdr_t io_hdr;
  38.     unsigned char cdb[MAX_CDB_LENGTH];
  39.     unsigned char sense_buffer[MAX_SENSE_LENGTH];
  40. } SCSI_PASS_THROUGH_DIRECT;
  41. #endif
  42.  
  43. unsigned char usb_h2h_cdb_read[MAX_CDB_LENGTH]     = {217,40,100,0,0,0,0,0,0,0,0,0,0,0,79,84};
  44. unsigned char usb_h2h_cdb_write[MAX_CDB_LENGTH]    = {217,42,255,0,0,0,0,0,0,0,0,0,0,0,79,84};
  45. unsigned char usb_h2h_cdb_keyboard[MAX_CDB_LENGTH] = {217,52,0,0,0,0,0,0,0,0,0,0,0,0,79,84};
  46. unsigned char usb_h2h_cdb_mouse[MAX_CDB_LENGTH]    = {217,51,0,0,0,0,0,0,0,0,0,0,0,0,79,84};
  47.  
  48. typedef struct
  49. {
  50.     SCSI_PASS_THROUGH_DIRECT scsi_op;
  51.     HANDLE handle_dev
  52.     unsigned char* buffer;
  53.     unsigned int buffer_size;
  54.     unsigned char read_count;
  55. } USB_HOST_TO_HOST_TRANSFER;
  56.  
  57. int is_invalid_device_handle(HANDLE handle)
  58. {
  59.     #ifdef MS_WINDOWS
  60.     return (INVALID_HANDLE_VALUE == handle);
  61.     #else
  62.     return (handle < 0);
  63.     #endif
  64. }
  65.  
  66. void close_device_handle(HANDLE handle)
  67. {
  68.     if (is_invalid_device_handle(handle))
  69.     {
  70.         // handle is invalid
  71.     }
  72.     else
  73.     {
  74.         #ifdef MS_WINDOWS
  75.         CloseHandle(handle);
  76.         #else
  77.         close(handle);
  78.         #endif
  79.     }
  80. }
  81.  
  82. int is_invalid_device_name(const char *dev_path)
  83. {
  84.     #ifdef MS_WINDOWS  
  85.     char tmp[] = {'\\', '\\', '.', '\\', 'X' , ':' , 0};
  86.    
  87.     if (strlen(dev_path) = strlen(tmp))
  88.     {
  89.         char drive = dev_path[4];
  90.         tmp[4] = drive;
  91.        
  92.         if ( (drive >= 'a' && drive <= 'z') || (drive >= 'A' && drive <= 'Z') )
  93.         {  
  94.             if (strncmp(dev_path, tmp, strlen(tmp)) == 0)
  95.             {
  96.                 return FALSE;
  97.             }
  98.         }
  99.     }
  100.     #else
  101.     char tmp[] = {'/', 'd', 'e', 'v', '/' , 's', 'g', 0};
  102.    
  103.     if (strlen(dev_path) > strlen(tmp))
  104.     {
  105.         if (strncmp(dev_path, tmp, strlen(tmp)) == 0)
  106.         {
  107.             return FALSE;
  108.         }
  109.     }  
  110.     #endif
  111.     return TRUE;
  112. }
  113.  
  114. void freeDevice(USB_HOST_TO_HOST_TRANSFER *transfer)
  115. {
  116.     if (transfer == NULL)
  117.     {
  118.         if (transfer->buffer)
  119.             free(transfer->buffer);
  120.         close_device_handle(transfer->handle_dev);     
  121.     }
  122. }
  123.  
  124. void* getDeviceMemory(USB_HOST_TO_HOST_TRANSFER *transfer)
  125. {
  126.     if (transfer )
  127.     {  
  128.         return transfer->buffer;
  129.     }
  130.     return NULL;
  131. }
  132.  
  133. int __fill_SCSI_PASS_THROUGH_DIRECT(SCSI_PASS_THROUGH_DIRECT *op, int direction_read, unsigned int timeout, unsigned char *cdb, unsigned int cdb_size, void *buffer, unsigned int buffer_size)
  134. {
  135.     if (op)
  136.     {
  137.         if ( ( (buffer == NULL) && (buffer_size == 0) )  || ( (buffer && (buffer_size > 0) && (buffer_size <= MAX_TRANSFER_BUFFER_LENGTH) ) )
  138.         {
  139.             if ((cdb_size > 0) && (cdb_size <= MAX_CDB_LENGTH))
  140.             {
  141.                 //ok
  142.             }
  143.             else
  144.             {
  145.                 return FALSE;
  146.             }
  147.         }      
  148.         else
  149.         {
  150.             return FALSE;  
  151.         }  
  152.     }
  153.     else
  154.     {
  155.         return FALSE;
  156.     }  
  157.     #ifdef MS_WINDOWS
  158.     memset(op, 0, sizeof(SCSI_PASS_THROUGH_DIRECT));
  159.    
  160.     op->ScsiStatus = -1;
  161.     op->PathId = -1;
  162.     op->TargetId = -1;
  163.     op->Lun = -1;
  164.        
  165.     op->Length = sizeof(SCSI_PASS_THROUGH_DIRECT);
  166.  
  167.     op->DataIn = direction;
  168.     op->TimeOutValue = timeout;
  169.    
  170.     op->DataBuffer = data;
  171.     op->DataTransferLength = data_size;
  172.    
  173.     memcpy(sptd->Cdb, cdb, cdb_size);
  174.     op->CdbLength = cdb_size;
  175.  
  176.     op->SenseInfoLength = SENSE_LENGTH;
  177.     op->SenseInfoOffset = 48;
  178.     #else
  179.     memset(&op->io_hdr, 0, sizeof(sg_io_hdr_t));
  180.     memset(&op->sense_buffer, 0, MAX_SENSE_LENGTH);
  181.     op->io_hdr.interface_id = INTERFACE_ID;
  182.     op->io_hdr.mx_sb_len = MAX_SENSE_LENGTH;
  183.     op->io_hdr.timeout = timeout;
  184.     op->io_hdr.cmdp = op->cdb;
  185.     op->io_hdr.cmd_len = cdb_size;
  186.  
  187.     memcpy(op->cdb, cdb, cdb_size);
  188.     if (direction_read)
  189.     {
  190.         op->io_hdr.dxfer_direction = SG_DXFER_FROM_DEV;
  191.     }
  192.     else
  193.     {
  194.         op->io_hdr.dxfer_direction = SG_DXFER_TO_DEV;  
  195.     }
  196.     op->io_hdr.dxferp = buffer;
  197.     op->io_hdr.dxfer_len = buffer_size;
  198.     #endif
  199.     return TRUE;
  200. }
  201.  
  202. int io()
  203. {
  204.     #ifdef MS_WINDOWS
  205.     status = DeviceIoControl(transfer->handle_dev, IOCTL_SCSI_PASS_THROUGH_DIRECT, transfer->scsi_op, 44, transfer->scsi_op, 80, &status, NULL);
  206.     #else
  207.     status = ioctl(transfer->handle_dev, SG_IO, &transfer->scsi_op);
  208.     if (status < 0) {
  209.         // failure
  210.     }
  211.     else
  212.     {
  213.         // success
  214.        
  215.     }
  216.        
  217.        
  218.     #endif 
  219.  
  220.            
  221.    
  222. }
  223.  
  224.  
  225.  
  226. int sendKeyboard(USB_HOST_TO_HOST_TRANSFER *transfer, int usb_key_mod, int usb_key)
  227. {
  228.     int status;
  229.     unsigned char cdb[MAX_CDB_LENGTH];
  230.     memcpy(&cdb[0], &usb_h2h_cdb_keyboard[0], sizeof(usb_h2h_cdb_keyboard));
  231.     cdb[2] = (usb_key_mod & 255);
  232.     cdb[4] = (usb_key & 255);
  233.    
  234.     __fill_SCSI_PASS_THROUGH_DIRECT(&transfer->scsi_op, TRUE, 5, cdb, MAX_CDB_LENGTH, NULL, 0);
  235.     #ifdef MS_WINDOWS
  236.     DeviceIoControl(transfer->handle_dev, IOCTL_SCSI_PASS_THROUGH_DIRECT, transfer->scsi_op, 44, transfer->scsi_op, 80, &status, NULL);
  237.     #else
  238.     status = ioctl(transfer->handle_dev, SG_IO, &transfer->scsi_op);   
  239.     #endif
  240.     //printf("driver: %i\n",io_hdr_write.driver_status);
  241.     //printf("driver w: %i\n",io_hdr_write.host_status);       
  242. }
  243.  
  244.  
  245. int sendMouse(USB_HOST_TO_HOST_TRANSFER *transfer, int usb_mouse_keys, int usb_mouse_dx, int usb_mouse_dy)
  246. {
  247.     int status;
  248.     unsigned char cdb[MAX_CDB_LENGTH];
  249.     memcpy(&cdb[0], &usb_h2h_cdb_mouse[0], sizeof(usb_h2h_cdb_mouse));
  250.    
  251.     if (usb_mouse_dx < - 127)
  252.         usb_mouse_dx = -127;
  253.     if (usb_mouse_dy < - 127)
  254.         usb_mouse_dy = -127;   
  255.    
  256.     if (usb_mouse_dx > 127)
  257.         usb_mouse_dx = 127;
  258.     if (usb_mouse_dy > 127)
  259.         usb_mouse_dy = 127;
  260.    
  261.     cdb[2] = (usb_mouse_keys & 255);
  262.     cdb[3] = (usb_mouse_dx & 255);
  263.     cdb[4] = (usb_mouse_dy & 255);
  264.     __fill_SCSI_PASS_THROUGH_DIRECT(&transfer->scsi_op, TRUE, 5, cdb, MAX_CDB_LENGTH, NULL, 0);
  265.    
  266.     #ifdef MS_WINDOWS
  267.     DeviceIoControl(transfer->handle_dev, IOCTL_SCSI_PASS_THROUGH_DIRECT, transfer->scsi_op, 44, transfer->scsi_op, 80, &status, NULL);
  268.     #else
  269.     status = ioctl(transfer->handle_dev, SG_IO, &transfer->scsi_op);   
  270.     #endif
  271.    
  272.     //printf("driver: %i\n",io_hdr_write.driver_status);
  273.     //printf("driver w: %i\n",io_hdr_write.host_status);       
  274. }
  275.  
  276.  
  277. int sendDevice(USB_HOST_TO_HOST_TRANSFER *transfer)
  278. {
  279.     int status;
  280.     __fill_SCSI_PASS_THROUGH_DIRECT(&transfer->scsi_op, FALSE, 5, usb_h2h_cdb_write, MAX_CDB_LENGTH, transfer->buffer, transfer->buffer_size)
  281.     status = ioctl(transfer->handle_dev, SG_IO, &transfer->scsi_op);   
  282.     //printf("driver: %i\n",io_hdr_write.driver_status);
  283.     //printf("driver w: %i\n",io_hdr_write.host_status);
  284.            
  285. }
  286.  
  287. int readDevice(USB_HOST_TO_HOST_TRANSFER *transfer)
  288. {
  289.     int status;
  290.    
  291.     __fill_SCSI_PASS_THROUGH_DIRECT(&transfer->scsi_op, TRUE, 5, usb_h2h_cdb_read, MAX_CDB_LENGTH, transfer->buffer, transfer->buffer_size);   
  292.     #ifdef MS_WINDOWS
  293.         transfer->scsi_op.Cdb[8] = transfer->read_count;
  294.     #else
  295.         transfer->scsi_op.cdb[8] = transfer->read_count;
  296.     #endif 
  297.     status = ioctl(transfer->handle_dev, SG_IO, &transfer->scsi_op);
  298.     transfer->read_count++;
  299.     //printf("driver: %i\n",io_hdr_write.driver_status);
  300.     //printf("driver w: %i\n",io_hdr_write.host_status);       
  301. }
  302.  
  303.  
  304. int openDevice(USB_HOST_TO_HOST_TRANSFER *transfer, char *dev_path)
  305. {
  306.     HANDLE handle = INVALID_HANDLE_VALUE;
  307.     char *buffer = NULL;
  308.     int ok = TRUE;
  309.     int vers;  
  310.    
  311.     if (transfer == NULL)
  312.     {
  313.         ok = FALSE;
  314.     }
  315.    
  316.     if (dev_path == NULL)
  317.     {
  318.         ok = FALSE;
  319.     }
  320.    
  321.     if (ok)
  322.     {      
  323.         if (is_invalid_device_name(dev_path))
  324.         {
  325.             fprintf(stderr,"invalid device path '%s'!\n", dev_path);
  326.             ok = FALSE;
  327.         }
  328.     }
  329.    
  330.     if (ok)
  331.     {          
  332.         #ifdef MS_WINDOWS
  333.         handle = CreateFile(dev_path, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, 0, OPEN_EXISTING, FILE_FLAG_NO_BUFFERING, 0);
  334.         #else
  335.         handle = open(dev_path, O_RDWR);
  336.         #endif
  337.        
  338.         if (is_invalid_device_handle(handle))
  339.         {
  340.             fprintf(stderr,"open device '%s' failed!\n", dev_path);
  341.             ok = FALSE;
  342.         }
  343.     }
  344.    
  345.     if (ok)
  346.     {      
  347.         #ifdef MS_WINDOWS
  348.         if (GetDriveType(dev_path + strlen("\\\\.\\")) != DRIVE_CDROM)
  349.         {
  350.             fprintf(stderr, "Device '%s' is not detected as CDROM drive", dev_path);
  351.             CloseHandle(handle);
  352.         }
  353.         #else
  354.         if ((ioctl(handle, SG_GET_VERSION_NUM, &vers) < 0) || (vers < 30000)) {
  355.             fprintf(stderr, "Device '%s' is not an sg device, or old sg driver\n", dev_path);
  356.            
  357.         }    
  358.         #endif
  359.     }
  360.  
  361.     if (ok)
  362.     {  
  363.         buffer = malloc(MAX_TRANSFER_BUFFER_LENGTH);
  364.         if (buffer == NULL)
  365.         {
  366.             fprintf(stderr, "Cannot allocate memory\n", dev_path);
  367.             ok = FALSE;
  368.         }
  369.     }
  370.    
  371.     if (ok)
  372.     {
  373.         transfer->handle_dev = handle;
  374.         transfer->read_count = 0;
  375.         transfer->buffer = buffer;
  376.         transfer->buffer_size = MAX_TRANSFER_BUFFER_LENGTH;    
  377.     }
  378.     else
  379.     {
  380.         if (buffer)
  381.             free(buffer);
  382.         close_device_handle(handle);
  383.     }
  384.     return ok;
  385. }
  386.  
  387.  
  388.  
  389.  
  390.  
  391.  
  392. void main()
  393. {
  394.     USB_HOST_TO_HOST_TRANSFER t;
  395.  
  396.     openDevice(&t, "/dev/sg2");
  397.    
  398.  
  399.     char *data_write = getDeviceMemory(&t);
  400.     memset(data_write,0, 65536);
  401.    
  402.     data_write[0] = 'H';
  403.     data_write[1] = 'a';    
  404.     data_write[2] = 'l';
  405.     data_write[3] = 'l';
  406.     data_write[4] = 'o';
  407.     data_write[5] = ' ';
  408.     data_write[6] = 'W';
  409.     data_write[7] = 'o';
  410.     data_write[8] = 'r';
  411.     data_write[9] = 'l';
  412.     data_write[10] = 'd';
  413.     data_write[11] = '1';
  414.     data_write[12] = '2';
  415.                                                
  416.  
  417.     while(1)
  418.     {
  419.        
  420.         sendDevice(&t);
  421.        
  422.     }
  423.         /*
  424.     getSGHDR(&io_hdr_write, SG_DXFER_TO_DEV, 500, cdb_send, 16, data_write, data_size_write);
  425.     status = ioctl(fd_write, SG_IO, &io_hdr_write);
  426.    
  427.         printf("driver: %i\n",io_hdr_write.driver_status);
  428.             printf("driver w: %i\n",io_hdr_write.host_status);
  429.         //  printf("driver w: %s\n",io_hdr_write->sbp+2);
  430.    
  431.             if (status < 0) {
  432.             // failure
  433.             printf("write fail\n");
  434.  
  435.         }
  436.         else {
  437.             // success
  438.             printf("write success\n");
  439.         }
  440.     //free(io_hdr_write);
  441.    
  442.     SG_DXFER_TO_DEV SG_DXFER_FROM_DEV
  443.     getSGHDR(&io_hdr_read, SG_DXFER_FROM_DEV, 500, cdb_read, 16, data_read, data_size_read);
  444.     status = ioctl(fd_read, SG_IO, &io_hdr_read);  
  445.    
  446.     cdb_read[8]++;
  447.     //  printf("driver read: %i\n",io_hdr_read->driver_status);
  448.     //      printf("driver: %s\n",io_hdr_read->sbp);
  449.     //  printf("driver read: %s\n",io_hdr_read->sbp+2);
  450.        
  451.        
  452.         if (status < 0) {
  453.             // failure
  454.             printf("read fail\n");
  455.  
  456.         }
  457.         else {
  458.             // success
  459.             printf("read %s\n",data_read);
  460.             //printf("read %i\n",*((int*)data_read));
  461.             //printf("read %i\n",*((int*)data_read+4));
  462.         }  
  463.    
  464.     */
  465.    
  466.    
  467. return;
  468. }
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Top