Hardware Keylogger

[kirtcathey]

While I am not looking to log keystrokes, I do want to position the USB PIC between a keyboard and host and 'listen' for a certain keyboard input before sending a remote command to a motor controller. How can a USB device be created to listen for input? Should it be a Keyboard HID, some generic HID?

[Kamikaze47]

While I am not looking to log keystrokes, I do want to position the USB PIC between a keyboard and host and 'listen' for a certain keyboard input before sending a remote command to a motor controller. How can a USB device be created to listen for input? Should it be a Keyboard HID, some generic HID?

I have made such a device with an 18F4550, however since the PIC is a USB slave device only, it cannot accept input from a USB keyboard. The one I made accepted input from a PS2 keyboard, logged the data, and passed it on to the PC via USB. I configured the USB as a Keyboard HID.

[kirtcathey]

Thanks to Kamikaze and Les for the great info.... now let's take this puppy to USB keyboards. More than a keylogger, I just want to trigger something across a factory floor when a certain string of characters are entered into a database, but the task is the same.

I have done the necessary research and have all the nitty gritty voltage signal requirements for USB communication that has led me to the onboard comparators in many PICs. How do I setup a comparator to take the differential signaling from D-/D+ on the USB data lines and convert that into 0 and 1 in the PIC for further processing? Here is an excerpt that provides most of the details that I need to setup the comparator.
----------------------------------
USB signals are transmitted on a twisted pair data cable with 90Ω ±15% impedance,[9] labeled D+ and D−. These collectively use half-duplex differential signaling to combat the effects of electromagnetic noise on longer lines. Transmitted signal levels are 0.0–0.3 volts for low and 2.8–3.6 volts for high in Full Speed (FS) and Low Speed (LS) modes, and -10–10 mV for low and 360–440 mV for high in High Speed (HS) mode.
---------------------------------
Most of the comparator examples that I have seen only handle one input. I have determined, given the details above, that the reference voltage should probably be about 1.25 volts, so do I use two comparators against the same reference voltage? Or,..... I'm kinda lost on this one, but really want to figure it out.

[magestik]

I do want to position the USB PIC between a keyboard and host and 'listen' for a certain keyboard input

Cheers, i'm just trying to do the exact same thing with a PIC18F4550 and a USB keyboard. Just starting, no clue yet how to do that. I'll keep an eye on this post

[kirtcathey]

Don't jump into this too far without purchasing a USB node controller chip such as the USBN9604, or even better, the Viniculum chip. Putting the code together to interface an 18F2550 and a USBN9604, and will post later.

I've found this schematic that helped with the wire-up between an 18F2550 and a USBN9604.
<a href="http://www.massmind.org/images/www/hobby_elec/e_pic6_f1.htm">http://www.massmind.org/images/www/hobby_elec/e_pic6_f1.htm</a>

The way all is hooked up, I had assumed that communication would be via SPI, but now do not think so. I have read the USBN9604 data sheet (a couple times) and it appears that I need to send commands in order to receive data via microwire... versus just wait for SSPBUF to fill.

Does anybody have sample code for a PIC and USBN9604? Any language will be fine, but PBP would be even nicer.

Or, even a pointer as to what to use. Such as, would SPI work fine? Or, should I do a byte level shiftin and shiftout, with commands on the first two bits as described in the microwire section of the USBN9604 data sheet?

Any help is appreciated. The finalized USB key logger code with schematic will be posted back into this forum.

[magestik]

I can already tell you that any FTDI chip (Viniculum uses FTDI chips) are designed so that they are recognized as a USB device, it is their non reprogrammable firmware, so you won't be able to put this between a keyboard and a host, it will interfere and thus make the keyboard not working. I just bought a couple to try and use it, and contacted their tech support, which confirmed this

As for the other chip, USBN9604, i didn't look at it yet, but there is a good chance it works the same, therefore unusable for such applications.

[kirtcathey]

Well... the USBN9604 is working as expected - hosting a keyboard and passing on the signals. More details with a drawing within the next couple days. I am fairly certain that this (http://www.vinculum.com/prd_vnc1l.html) Vinculum chip will work as a host as well, since that is what we are using for hot-pluggable components that plug into a 16F877A.

Doh! I just re-read magestik's post above.... you mean that vinculum chip, while hosting USB, will also be recognized as a USB device by Windows? I just realized that the rig with the 877A mentioned above does not plug directly into a PC.

[magestik]

you mean that vinculum chip, while hosting USB, will also be recognized as a USB device by Windows?

That's right. All FTDI chips contains enumeration functions, so the chip, associated with a controller, will be recognized by windows, i tried it myself, therefore, if you plug it on the USB line of the keyboard, you will disconnect your keyboard, because of the presence of two devices for one line.

You can plug the chip + pic into a computer, as a USB device of its own, but you can't "monitor" an existing USB line with it.

I wonder if with the 18F4550, you can't just take off the enumeration function, and just use functions such as get_usb_packet().

[kirtcathey]

This is great timing. When this came across the forum, I was ready to purchase a couple of those Vinculum chips, thinking they would be easier to deal with than the USBN9604. One more question....

Even if you put the 18F2550/184550 between the vinculum and the PC this happens?

What I am doing with the 9604 is exactly that....
The keyboard plugs in and enumerates with the USBN9604, then as the user inputs keystrokes, this input is sent via microwire signal to the 18f2550, which is then sent to the PC that has enumerated the PIC as a keyboard and handles the PIC as a keyboard. Can you confirm that this is the way that the Vinculum is setup? Don't understand why the PC would be visible to the vinculum at all. Unless, it was in the circuit so that it connected directly to the host.

This is a big help. Thank you for sharing the experience.
--Kirt

Vinculum.... sounds like medicine. Doctor says, "Take two vinculum and call me later today."