title: How to reverse engineering USB/HID/BlueTooth dongle. What tools to use?
body: <blockquote>
    <p>Need to reverse engineering bluetooth usb mouse dongle, and use mouse board to measure distance, and plot them with <a href="http://matplotlib.org" rel="noreferrer">matplotlib</a></p>
  </blockquote>
  
  <p><img src="https://i.stack.imgur.com/NQcJ0.png" alt="enter image description here"></p>
  
  <p>I've found these tools that can help with this task:</p>
  
  <blockquote>
    <p><strong>Linux</strong></p>
  </blockquote>
  
  <ul>
  <li>lsusb</li>
  <li>usbmon</li>
  <li>usbhid-dump</li>
  <li>rfcomm</li>
  <li>hidrd-convert</li>
  <li>xxd</li>
  <li>hcitool</li>
  <li>evdev-dump</li>
  </ul>
  
  <blockquote>
    <p><strong>Windows</strong></p>
  </blockquote>
  
  <ul>
  <li><a href="http://goo.gl/hG7lRk" rel="noreferrer">usblyser</a></li>
  </ul>
  
  <hr>
  
  <blockquote>
    <p>Bibliography:  </p>
  </blockquote>
  
  <ol>
  <li><a href="http://goo.gl/DAgukY" rel="noreferrer">https://www.silabs.com/Support
  Documents/TechnicalDocs/AN249.pdf</a></li>
  <li><a href="http://goo.gl/KAX9c" rel="noreferrer">www.usb.org/developers/devclass_docs/HID1_11.pdf</a></li>
  <li><a href="http://goo.gl/rBl3Gf" rel="noreferrer">Usbhid-dump - digimend</a></li>
  <li><a href="http://goo.gl/4XVPAO" rel="noreferrer">Linux, HID and PyUSB</a></li>
  <li><a href="http://goo.gl/X18QOi" rel="noreferrer">MagTek Credit Card Reader in Linux</a></li>
  <li><a href="http://goo.gl/4xgf3S" rel="noreferrer">Evdev-dump - digimend</a></li>
  </ol>
  
  <hr>
  
  <blockquote>
    <p>Examples:</p>
  </blockquote>
  
  <pre><code>lnx#&gt; lsusb -s 2
  
  Bus 005 Device 002: ID 0a12:0001 Cambridge Silicon Radio, Ltd Bluetooth Dongle (HCI mode)
  Bus 003 Device 002: ID 192f:0716 Avago Technologies, Pte. 
  Bus 002 Device 002: ID 1bcf:053a Sunplus Innovation Technology Inc. Targa Silvercrest OMC807-C optische Funkmaus
  </code></pre>
  
  <hr>
  
  <pre><code>lnx#&gt; sudo lsusb -s 2:4 -v
  
  Bus 002 Device 004: ID 1bcf:053a Sunplus Innovation Technology Inc. Targa Silvercrest OMC807-C optische Funkmaus
  Device Descriptor:
    bLength                18
    bDescriptorType         1
    bcdUSB               2.00
    bDeviceClass            0 (Defined at Interface level)
    bDeviceSubClass         0 
    bDeviceProtocol         0 
    bMaxPacketSize0         8
    idVendor           0x1bcf Sunplus Innovation Technology Inc.
    idProduct          0x053a Targa Silvercrest OMC807-C optische Funkmaus
    bcdDevice           a0.31
    iManufacturer           0 
    iProduct                2 2.4GHz 2way RF Receiver
    iSerial                 0 
    bNumConfigurations      1
    Configuration Descriptor:
      bLength                 9
      bDescriptorType         2
      wTotalLength           34
      bNumInterfaces          1
      bConfigurationValue     1
      iConfiguration          0 
      bmAttributes         0xa0
        (Bus Powered)
        Remote Wakeup
      MaxPower               46mA
      Interface Descriptor:
        bLength                 9
        bDescriptorType         4
        bInterfaceNumber        1
        bAlternateSetting       0
        bNumEndpoints           1
        bInterfaceClass         3 Human Interface Device
        bInterfaceSubClass      1 Boot Interface Subclass
        bInterfaceProtocol      2 Mouse
        iInterface              0 
          HID Device Descriptor:
            bLength                 9
            bDescriptorType        33
            bcdHID               1.00
            bCountryCode            0 Not supported
            bNumDescriptors         1
            bDescriptorType        34 Report
            wDescriptorLength     179
           Report Descriptors: 
             ** UNAVAILABLE **
        Endpoint Descriptor:
          bLength                 7
          bDescriptorType         5
          bEndpointAddress     0x81  EP 1 IN
          bmAttributes            3
            Transfer Type            Interrupt
            Synch Type               None
            Usage Type               Data
          wMaxPacketSize     0x0008  1x 8 bytes
          bInterval              10
  Device Status:     0x0000
    (Bus Powered)
  </code></pre>
  
  <hr>
  
  <pre><code>lnx#&gt; lsusb -t     
  /:  Bus 05.Port 1: Dev 1, Class=root_hub, Driver=uhci_hcd/2p, 12M
      |__ Port 2: Dev 2, If 0, Class=Wireless, Driver=btusb, 12M
      |__ Port 2: Dev 2, If 1, Class=Wireless, Driver=btusb, 12M
  /:  Bus 04.Port 1: Dev 1, Class=root_hub, Driver=uhci_hcd/2p, 12M
  /:  Bus 03.Port 1: Dev 1, Class=root_hub, Driver=uhci_hcd/2p, 12M
      |__ Port 2: Dev 2, If 0, Class=Human Interface Device, Driver=usbhid, 1.5M
  /:  Bus 02.Port 1: Dev 1, Class=root_hub, Driver=uhci_hcd/2p, 12M
      |__ Port 1: Dev 4, If 1, Class=Human Interface Device, Driver=usbhid, 1.5M
      |__ Port 2: Dev 3, If 0, Class=Human Interface Device, Driver=usbhid, 12M
      |__ Port 2: Dev 3, If 1, Class=Human Interface Device, Driver=usbhid, 12M
      |__ Port 2: Dev 3, If 2, Class=Human Interface Device, Driver=usbhid, 12M
  /:  Bus 01.Port 1: Dev 1, Class=root_hub, Driver=ehci-pci/8p, 480M
      |__ Port 3: Dev 4, If 0, Class=Video, Driver=uvcvideo, 480M
      |__ Port 3: Dev 4, If 1, Class=Video, Driver=uvcvideo, 480M
      |__ Port 3: Dev 4, If 2, Class=Audio, Driver=snd-usb-audio, 480M
      |__ Port 3: Dev 4, If 3, Class=Audio, Driver=snd-usb-audio, 480M
  </code></pre>
  
  <hr>
  
  <pre><code>lnx#&gt; sudo usbmon -f0
  ffff8800764640c0 4022916298 C Ii:003:01 0 8 = 00000000 00000000
  ffff8800764640c0 4022916321 S Ii:003:01 -115 8 &lt;
  ffff880076464a80 4025994204 C Ii:004:01 0 6 = 0100ff00 0000
  ffff880076464a80 4025994229 S Ii:004:01 -115 7 &lt;
  ffff880076464a80 4026010207 C Ii:004:01 0 6 = 0100ff00 0000
  ffff880076464a80 4026010238 S Ii:004:01 -115 7 &lt;
  ffff880076464a80 4026018204 C Ii:004:01 0 6 = 0100ff00 0000
  ffff880076464a80 4026018225 S Ii:004:01 -115 7 &lt;
  ffff880076464a80 4026026199 C Ii:004:01 0 6 = 0100ff00 0000
  </code></pre>
  
  <hr>
  
  <pre><code>lnx#&gt; sudo usbhid-dump -s 2:4                                                 
  002:004:001:DESCRIPTOR         1393614919.941888
   05 01 09 02 A1 01 85 01 05 09 19 01 29 08 15 00
   25 01 95 08 75 01 81 02 05 01 09 01 A1 00 09 30
   09 31 09 38 15 81 25 7F 75 08 95 03 81 06 05 0C
   0A 38 02 95 01 81 06 C0 06 00 FF 09 01 15 00 26
   FF 00 75 08 95 07 B1 02 C0 06 F3 F1 0A F3 F1 A1
   01 85 02 09 00 95 01 75 08 15 00 26 FF 00 81 02
   C0 05 0C 09 01 A1 01 85 03 15 00 26 FF 03 19 00
   2A FF 03 75 10 95 03 81 00 C0 05 01 09 80 A1 01
   85 04 05 01 19 81 29 83 15 00 25 01 95 03 75 01
   81 06 95 01 75 05 81 01 C0 06 BC FF 09 88 A1 01
   85 05 19 00 2A FF 00 15 00 26 FF 00 75 08 95 01
   81 00 C0
  </code></pre>
  
  <hr>
  
  <pre><code>lnx#&gt; sudo usbhid-dump -s 2:4 | tail -n +2 | xxd -r -p | hidrd-convert -o spec            
  Usage Page (Desktop),               ; Generic desktop controls (01h)
  Usage (Mouse),                      ; Mouse (02h, application collection)
  Collection (Application),
      Report ID (1),
      Usage Page (Button),            ; Button (09h)
      Usage Minimum (01h),
      Usage Maximum (08h),
      Logical Minimum (0),
      Logical Maximum (1),
      Report Count (8),
      Report Size (1),
      Input (Variable),
      Usage Page (Desktop),           ; Generic desktop controls (01h)
      Usage (Pointer),                ; Pointer (01h, physical collection)
      Collection (Physical),
          Usage (X),                  ; X (30h, dynamic value)
          Usage (Y),                  ; Y (31h, dynamic value)
          Usage (Wheel),              ; Wheel (38h, dynamic value)
          Logical Minimum (-127),
          Logical Maximum (127),
          Report Size (8),
          Report Count (3),
          Input (Variable, Relative),
          Usage Page (Consumer),      ; Consumer (0Ch)
          Usage (AC Pan),             ; AC pan (0238h, linear control)
          Report Count (1),
          Input (Variable, Relative),
      End Collection,
      Usage Page (FF00h),             ; FF00h, vendor-defined
      Usage (01h),
      Logical Minimum (0),
      Logical Maximum (255),
      Report Size (8),
      Report Count (7),
      Feature (Variable),
  End Collection,
  Usage Page (F1F3h),                 ; F1F3h, reserved
  Usage (F1F3h),
  Collection (Application),
      Report ID (2),
      Usage (00h),
      Report Count (1),
      Report Size (8),
      Logical Minimum (0),
      Logical Maximum (255),
      Input (Variable),
  End Collection,
  Usage Page (Consumer),              ; Consumer (0Ch)
  Usage (Consumer Control),           ; Consumer control (01h, application collection)
  Collection (Application),
      Report ID (3),
      Logical Minimum (0),
      Logical Maximum (1023),
      Usage Minimum (00h),
      Usage Maximum (03FFh),
      Report Size (16),
      Report Count (3),
      Input,
  End Collection,
  Usage Page (Desktop),               ; Generic desktop controls (01h)
  Usage (Sys Control),                ; System control (80h, application collection)
  Collection (Application),
      Report ID (4),
      Usage Page (Desktop),           ; Generic desktop controls (01h)
      Usage Minimum (Sys Power Down), ; System power down (81h, one-shot control)
      Usage Maximum (Sys Wake Up),    ; System wake up (83h, one-shot control)
      Logical Minimum (0),
      Logical Maximum (1),
      Report Count (3),
      Report Size (1),
      Input (Variable, Relative),
      Report Count (1),
      Report Size (5),
      Input (Constant),
  End Collection,
  Usage Page (FFBCh),                 ; FFBCh, vendor-defined
  Usage (88h),
  Collection (Application),
      Report ID (5),
      Usage Minimum (00h),
      Usage Maximum (FFh),
      Logical Minimum (0),
      Logical Maximum (255),
      Report Size (8),
      Report Count (1),
      Input,
  End Collection
  </code></pre>
  
  <hr>
  
  <pre><code>lnx#&gt; sudo usbhid-dump -s 2:4 -es
  Starting dumping interrupt transfer stream
  with 1 minute timeout.
  
  002:004:001:STREAM             1393615361.032412
   01 00 01 FF 00 00
  
  002:004:001:STREAM             1393615361.392401
   01 00 FF 00 00 00
  
  002:004:001:STREAM             1393615361.400380
   01 00 FC 02 00 00
  
  002:004:001:STREAM             1393615361.424382
   01 00 FF 01 00 00
  
  002:004:001:STREAM             1393615361.432377
   01 00 FE 00 00 00
  
  002:004:001:STREAM             1393615361.440378
   01 00 FF 01 00 00
  
  002:004:001:STREAM             1393615361.592374
   01 00 FF 00 00 00
  
  002:004:001:STREAM             1393615361.608392
   01 00 FF 00 00 00
  
  002:004:001:STREAM             1393615361.616373
   01 00 FF 00 00 00
  </code></pre>