ape.py

#!/usr/bin/env python3
"""Script to extract keys out of data.pcap """

from scapy.all import *

mapping = {
	0x00: "(no event indicated)",0x01: "ErrorRollOver",0x02: "POSTFail",0x03: "ErrorUndefined",0x04: "a and A",0x05: "b and B",0x06: "c and C",0x07: "d and D",0x08: "e and E",0x09: "f and F",0x0A: "g and G",0x0B: "h and H",0x0C: "i and I",0x0D: "j and J",0x0E: "k and K",0x0F: "l and L",0x10: "m and M",0x11: "n and N",0x12: "o and O",0x13: "p and P",0x14: "q and Q",0x15: "r and R",0x16: "s and S",0x17: "t and T",0x18: "u and U",0x19: "v and V",0x1A: "w and W",0x1B: "x and X",0x1C: "y and Y",0x1D: "z and Z",0x1E: "1 and !",0x1F: "2 and @",0x20: "3 and #",0x21: "4 and $",0x22: "5 and %",0x23: "6 and ^",0x24: "7 and &",0x25: "8 and *",0x26: "9 and (",0x27: "0 and )",0x28: "Return (ENTER)",0x29: "ESCAPE",0x2A: "DELETE (Backspace)",0x2B: "Tab",0x2C: "Spacebar",0x2D: "- and (underscore)",0x2E: "= and +",0x2F: "[ and {",0x30: "] and }",0x31: "\ and |",0x32: "Non-US # and ~",0x33: "; and :",0x34: "' and \"",0x35: "Grave Accent and Tilde",0x36: ", and <",0x37: ". and >",0x38: "/ and ?",0x39: "Caps Lock",0x3A: "F1",0x3B: "F2",0x3C: "F3",0x3D: "F4",0x3E: "F5",0x3F: "F6",0x40: "F7",0x41: "F8",0x42: "F9",0x43: "F10",0x44: "F11",0x45: "F12",0x46: "PrintScreen",0x47: "Scroll Lock",0x48: "Pause",0x49: "Insert",0x4A: "Home",0x4B: "PageUp",0x4C: "Delete Forward",0x4D: "End",0x4E: "PageDown",0x4F: "RightArrow",0x50: "LeftArrow",0x51: "DownArrow",0x52: "UpArrow",0x53: "Keypad Num Lock and Clear",0x54: "Keypad /",0x55: "Keypad *",0x56: "Keypad -",0x57: "Keypad +",0x58: "Keypad ENTER",0x59: "Keypad 1 and End",0x5A: "Keypad 2 and Down Arrow",0x5B: "Keypad 3 and PageDn",0x5C: "Keypad 4 and Left Arrow",0x5D: "Keypad 5",0x5E: "Keypad 6 and Right Arrow",0x5F: "Keypad 7 and Home",0x60: "Keypad 8 and Up Arrow",0x61: "Keypad 9 and PageUp",0x62: "Keypad 0 and Insert",0x63: "Keypad . and Delete",0x64: "Non-US \ and |",0x65: "Application",0x66: "Power",0x67: "Keypad =",0x68: "F13",0x69: "F14",0x6A: "F15",0x6B: "F16",0x6C: "F17",0x6D: "F18",0x6E: "F19",0x6F: "F20",0x70: "F21",0x71: "F22",0x72: "F23",0x73: "F24",0x74: "Execute",0x75: "Help",0x76: "Menu",0x77: "Select",0x78: "Stop",0x79: "Again",0x7A: "Undo",0x7B: "Cut",0x7C: "Copy",0x7D: "Paste",0x7E: "Find",0x7F: "Mute",0x80: "Volume Up",0x81: "Volume Down",0x82: "Locking Caps Lock",0x83: "Locking Num Lock",0x84: "Locking Scroll Lock",0x85: "Keypad Comma",0x86: "Keypad Equal Sign",0x87: "International1",0x88: "International2",0x89: "International3",0x8A: "International4",0x8B: "International5",0x8C: "International6",0x8D: "International7",0x8E: "International8",0x8F: "International9",0x90: "LANG1",0x91: "LANG2",0x92: "LANG3",0x93: "LANG4",0x94: "LANG5",0x95: "LANG6",0x96: "LANG7",0x97: "LANG8",0x98: "LANG9",0x99: "Alternate Erase",0x9A: "SysReq/Attention",0x9B: "Cancel",0x9C: "Clear",0x9D: "Prior",0x9E: "Return",0x9F: "Separator",0xA0: "Out",0xA1: "Oper",0xA2: "Clear/Again",0xA3: "CrSel/Props",0xA4: "ExSel",0xE0: "LeftControl",0xE1: "LeftShift",0xE2: "LeftAlt",0xE3: "Left GUI",0xE4: "RightControl",0xE5: "RightShift",0xE6: "RightAlt",0xE7: "Right GUI",
}

packets = rdpcap('deadly_arthropod.pcap')
for each_packet in packets:
	special_byte = each_packet[0].load[-6]
	print(mapping[special_byte])