Decrypted But Cannot View Input Data

Question

Decrypted But Cannot View Input Data

Closed this issue 6 years ago · 1 comments

I have captured the entire pairing process and decrypted the capture successfully but I can't view the data entered on the device by the user?

decrypted_logitech - full pairing.pcapng.txt

Answer 1 · 2018-05-25T03:18:05.000Z

Load your file in Wireshark and filter using "btatt". The final four displayed packets are "Human Interface Device: Report". These are HID reports that contain whatever keystrokes the user typed. You will need to build some kind of HID decoder to parse these.