20

Where am I able to find a list of the hex keyboard scan codes for different keyboard layouts?

I'm sending the key codes over a (fake) USB HID keyboard with the bash command echo -ne followed by the escaped hex key scan code and the HID device:

echo -ne "\x00\x00\x00\x38\x00\x00\x00\x00" > /dev/hidg0
echo -ne "\x00\x00\x00\x00\x00\x00\x00\x00"  > /dev/hidg0

for a slash (/) on the US keyboard layout.

On my keyboard layout (CH) it is

echo -ne "\x00\x00\x00\x24\x00\x00\x00\x00" > /dev/hidg0
echo -ne "\x00\x00\x00\x00\x00\x00\x00\x00"  > /dev/hidg0

for a slash. So I guess there has to exist a list for all of these. Yet I was able to find a list for the US layout but not for any other keyboard layout.

I know the second line stops the typing of the key but I don't quite understand the syntax of these escape sequences. I know that if I change the first \x00 to a x02 it will "shift" the entered key. But why are there 6 more modifiers? Do they stand for ctrl, alt, ... ? And which stands for which?

A documentation of this syntax would be really cool. I wasn't able to find one yet.

(I'm using Kali Nethunter on a Nexus 7 2012)

Henry Ecker
  • 34,399
  • 18
  • 41
  • 57
Nico Hauser
  • 644
  • 2
  • 8
  • 17
  • 1
    Based on your scancode for forward slash, I'd say your keyboard is a German T2, rather than a Czech qwertz. The code `x24` corresponds to the mechanical position of a 7& on a US equivalent, which is forward slash on a T2, but on a Czech version "/" would be `x2F` I think (equivalent of US `[`). – jiggunjer Jan 04 '17 at 09:05
  • 1
    Quite OT, but CH is the ISO-code for Switzerland (Confoederatio Helvetica), Czech would be CZ. – Erik Jan 05 '17 at 09:48

1 Answers1

47

The "scan codes" (they are really indexes to usage codes) are published on usb.org in the USB HID Usage Tables specification in Chapter 10 "Keyboard/Keypad Page (0x07)". A typical keyboard report layout can be found in the USB Device Class Specification for HID in Appendix B "Boot Interface Descriptors", section "B.1 Protocol 1 (Keyboard)".

That describes the keyboard report format as:

Byte 0: Keyboard modifier bits (SHIFT, ALT, CTRL etc)
Byte 1: reserved
Byte 2-7: Up to six keyboard usage indexes representing the keys that are 
          currently "pressed". 
          Order is not important, a key is either pressed (present in the 
          buffer) or not pressed.

Note that the USB spec doesn't define keyboard layouts. It simply lists the usage codes assigned to particular key functions. The letter "a" is usage code 0x04 for example. If you want an uppercase "A", then you would also need to set the Byte 0 modifier bits to select "Left Shift" (or "Right Shift").

The exact format of the report buffer depends on the Report Descriptor sent to the host computer when the keyboard was plugged in to a USB port, so the above is just a (pretty typical) example.

aja
  • 1,525
  • 17
  • 20
  • 1
    Thanks. The chapter 10 is useful for HID keyboards to send specific key strokes from hardware (for example, a Microchip HID keyboard demo sends a 4 that matches an 'a' key). – Santiago Villafuerte Sep 04 '16 at 17:22
  • 2
    Warning: this is only true for a QWERTY keyboard. On a AZERTY keyboard the 4 is associated with 'q' key and not the 'a' key. In other words the codes depend on the regional keyboard layout – Pierre Poliakoff Jan 02 '17 at 21:43
  • 5
    @PierrePoliakoff I think you meant to say the codes are *fixed* (or should be), based on a *mechanical* layout corresponding to an English keyboard. E.g. the same key produces the same usage ID, regardless of the character printed on it. – jiggunjer Jan 04 '17 at 08:51