[FL-2159] BadUSB alt codes (#935)

* badusb: alt code commands
* badusb: demo script update
* usb hid: consumer control descriptor
* BadUsb: remove dangerous type casting, rename variable to match codding style guide

Co-authored-by: あく <alleteam@gmail.com>

applications/bad_usb/bad_usb_script.c

@@ -97,13 +97,30 @@ static const DuckyKey ducky_keys[] = {
 };
 
 static const char ducky_cmd_comment[] = {"REM"};
-static const char ducky_cmd_delay[] = {"DELAY"};
-static const char ducky_cmd_string[] = {"STRING"};
-static const char ducky_cmd_defdelay_1[] = {"DEFAULT_DELAY"};
-static const char ducky_cmd_defdelay_2[] = {"DEFAULTDELAY"};
-static const char ducky_cmd_repeat[] = {"REPEAT"};
+static const char ducky_cmd_delay[] = {"DELAY "};
+static const char ducky_cmd_string[] = {"STRING "};
+static const char ducky_cmd_defdelay_1[] = {"DEFAULT_DELAY "};
+static const char ducky_cmd_defdelay_2[] = {"DEFAULTDELAY "};
+static const char ducky_cmd_repeat[] = {"REPEAT "};
+
+static const char ducky_cmd_altchar[] = {"ALTCHAR "};
+static const char ducky_cmd_altstr_1[] = {"ALTSTRING "};
+static const char ducky_cmd_altstr_2[] = {"ALTCODE "};
+
+static const uint8_t numpad_keys[10] = {
+    KEYPAD_0,
+    KEYPAD_1,
+    KEYPAD_2,
+    KEYPAD_3,
+    KEYPAD_4,
+    KEYPAD_5,
+    KEYPAD_6,
+    KEYPAD_7,
+    KEYPAD_8,
+    KEYPAD_9,
+};
 
-static bool ducky_get_number(char* param, uint32_t* val) {
+static bool ducky_get_number(const char* param, uint32_t* val) {
     uint32_t value = 0;
     if(sscanf(param, "%lu", &value) == 1) {
         *val = value;
@@ -112,7 +129,7 @@ static bool ducky_get_number(char* param, uint32_t* val) {
     return false;
 }
 
-static uint32_t ducky_get_command_len(char* line) {
+static uint32_t ducky_get_command_len(const char* line) {
     uint32_t len = strlen(line);
     for(uint32_t i = 0; i < len; i++) {
         if(line[i] == ' ') return i;
@@ -120,7 +137,64 @@ static uint32_t ducky_get_command_len(char* line) {
     return 0;
 }
 
-static bool ducky_string(char* param) {
+static void ducky_numlock_on() {
+    if((furi_hal_hid_get_led_state() & HID_KB_LED_NUM) == 0) {
+        furi_hal_hid_kb_press(KEY_NUM_LOCK);
+        furi_hal_hid_kb_release(KEY_NUM_LOCK);
+    }
+}
+
+static bool ducky_numpad_press(const char num) {
+    if((num < '0') || (num > '9')) return false;
+
+    uint16_t key = numpad_keys[num - '0'];
+    furi_hal_hid_kb_press(key);
+    furi_hal_hid_kb_release(key);
+
+    return true;
+}
+
+static bool ducky_altchar(const char* charcode) {
+    uint8_t i = 0;
+    bool state = false;
+
+    //TODO: numlock
+
+    FURI_LOG_I(WORKER_TAG, "char %s", charcode);
+
+    furi_hal_hid_kb_press(KEY_MOD_LEFT_ALT);
+
+    while((charcode[i] != ' ') && (charcode[i] != '\n') && (charcode[i] != '\0')) {
+        state = ducky_numpad_press(charcode[i]);
+        if(state == false) break;
+        i++;
+    }
+
+    furi_hal_hid_kb_release(KEY_MOD_LEFT_ALT);
+    return state;
+}
+
+static bool ducky_altstring(const char* param) {
+    uint32_t i = 0;
+    bool state = false;
+
+    while(param[i] != '\0') {
+        if((param[i] < ' ') || (param[i] > '~')) {
+            i++;
+            continue; // Skip non-printable chars
+        }
+
+        char temp_str[4];
+        snprintf(temp_str, 4, "%u", param[i]);
+
+        state = ducky_altchar(temp_str);
+        if(state == false) break;
+        i++;
+    }
+    return state;
+}
+
+static bool ducky_string(const char* param) {
     uint32_t i = 0;
     while(param[i] != '\0') {
         furi_hal_hid_kb_press(HID_ASCII_TO_KEY(param[i]));
@@ -130,10 +204,14 @@ static bool ducky_string(char* param) {
     return true;
 }
 
-static uint16_t ducky_get_keycode(char* param, bool accept_chars) {
+static uint16_t ducky_get_keycode(const char* param, bool accept_chars) {
     for(uint8_t i = 0; i < (sizeof(ducky_keys) / sizeof(ducky_keys[0])); i++) {
-        if(strncmp(param, ducky_keys[i].name, strlen(ducky_keys[i].name)) == 0)
+        uint8_t key_cmd_len = strlen(ducky_keys[i].name);
+        if((strncmp(param, ducky_keys[i].name, key_cmd_len) == 0) &&
+           ((param[key_cmd_len] == ' ') || (param[key_cmd_len] == '\n') ||
+            (param[key_cmd_len] == '\0'))) {
             return ducky_keys[i].keycode;
+        }
     }
     if((accept_chars) && (strlen(param) > 0)) {
         return (HID_ASCII_TO_KEY(param[0]) & 0xFF);
@@ -143,57 +221,71 @@ static uint16_t ducky_get_keycode(char* param, bool accept_chars) {
 
 static int32_t ducky_parse_line(BadUsbScript* bad_usb, string_t line) {
     uint32_t line_len = string_size(line);
-    char* line_t = (char*)string_get_cstr(line);
+    const char* line_tmp = string_get_cstr(line);
     bool state = false;
 
     for(uint32_t i = 0; i < line_len; i++) {
-        if((line_t[i] != ' ') && (line_t[i] != '\t') && (line_t[i] != '\n')) {
-            line_t = &line_t[i];
+        if((line_tmp[i] != ' ') && (line_tmp[i] != '\t') && (line_tmp[i] != '\n')) {
+            line_tmp = &line_tmp[i];
             break; // Skip spaces and tabs
         }
         if(i == line_len - 1) return 0; // Skip empty lines
     }
 
-    FURI_LOG_I(WORKER_TAG, "line:%s", line_t);
+    FURI_LOG_I(WORKER_TAG, "line:%s", line_tmp);
 
     // General commands
-    if(strncmp(line_t, ducky_cmd_comment, strlen(ducky_cmd_comment)) == 0) {
+    if(strncmp(line_tmp, ducky_cmd_comment, strlen(ducky_cmd_comment)) == 0) {
         // REM - comment line
         return (0);
-    } else if(strncmp(line_t, ducky_cmd_delay, strlen(ducky_cmd_delay)) == 0) {
+    } else if(strncmp(line_tmp, ducky_cmd_delay, strlen(ducky_cmd_delay)) == 0) {
         // DELAY
-        line_t = &line_t[ducky_get_command_len(line_t) + 1];
+        line_tmp = &line_tmp[ducky_get_command_len(line_tmp) + 1];
         uint32_t delay_val = 0;
-        state = ducky_get_number(line_t, &delay_val);
+        state = ducky_get_number(line_tmp, &delay_val);
         if((state) && (delay_val > 0)) {
             return (int32_t)delay_val;
         }
         return (-1);
     } else if(
-        (strncmp(line_t, ducky_cmd_defdelay_1, strlen(ducky_cmd_defdelay_1)) == 0) ||
-        (strncmp(line_t, ducky_cmd_defdelay_2, strlen(ducky_cmd_defdelay_2)) == 0)) {
+        (strncmp(line_tmp, ducky_cmd_defdelay_1, strlen(ducky_cmd_defdelay_1)) == 0) ||
+        (strncmp(line_tmp, ducky_cmd_defdelay_2, strlen(ducky_cmd_defdelay_2)) == 0)) {
         // DEFAULT_DELAY
-        line_t = &line_t[ducky_get_command_len(line_t) + 1];
-        state = ducky_get_number(line_t, &bad_usb->defdelay);
+        line_tmp = &line_tmp[ducky_get_command_len(line_tmp) + 1];
+        state = ducky_get_number(line_tmp, &bad_usb->defdelay);
         return (state) ? (0) : (-1);
-    } else if(strncmp(line_t, ducky_cmd_string, strlen(ducky_cmd_string)) == 0) {
+    } else if(strncmp(line_tmp, ducky_cmd_string, strlen(ducky_cmd_string)) == 0) {
         // STRING
-        line_t = &line_t[ducky_get_command_len(line_t) + 1];
-        state = ducky_string(line_t);
+        line_tmp = &line_tmp[ducky_get_command_len(line_tmp) + 1];
+        state = ducky_string(line_tmp);
+        return (state) ? (0) : (-1);
+    } else if(strncmp(line_tmp, ducky_cmd_altchar, strlen(ducky_cmd_altchar)) == 0) {
+        // ALTCHAR
+        line_tmp = &line_tmp[ducky_get_command_len(line_tmp) + 1];
+        ducky_numlock_on();
+        state = ducky_altchar(line_tmp);
+        return (state) ? (0) : (-1);
+    } else if(
+        (strncmp(line_tmp, ducky_cmd_altstr_1, strlen(ducky_cmd_altstr_1)) == 0) ||
+        (strncmp(line_tmp, ducky_cmd_altstr_2, strlen(ducky_cmd_altstr_2)) == 0)) {
+        // ALTSTRING
+        line_tmp = &line_tmp[ducky_get_command_len(line_tmp) + 1];
+        ducky_numlock_on();
+        state = ducky_altstring(line_tmp);
         return (state) ? (0) : (-1);
-    } else if(strncmp(line_t, ducky_cmd_repeat, strlen(ducky_cmd_repeat)) == 0) {
+    } else if(strncmp(line_tmp, ducky_cmd_repeat, strlen(ducky_cmd_repeat)) == 0) {
         // REPEAT
-        line_t = &line_t[ducky_get_command_len(line_t) + 1];
-        state = ducky_get_number(line_t, &bad_usb->repeat_cnt);
+        line_tmp = &line_tmp[ducky_get_command_len(line_tmp) + 1];
+        state = ducky_get_number(line_tmp, &bad_usb->repeat_cnt);
         return (state) ? (0) : (-1);
     } else {
         // Special keys + modifiers
-        uint16_t key = ducky_get_keycode(line_t, false);
+        uint16_t key = ducky_get_keycode(line_tmp, false);
         if(key == KEY_NONE) return (-1);
         if((key & 0xFF00) != 0) {
             // It's a modifier key
-            line_t = &line_t[ducky_get_command_len(line_t) + 1];
-            key |= ducky_get_keycode(line_t, true);
+            line_tmp = &line_tmp[ducky_get_command_len(line_tmp) + 1];
+            key |= ducky_get_keycode(line_tmp, true);
         }
         furi_hal_hid_kb_press(key);
         furi_hal_hid_kb_release(key);

assets/resources/badusb/demo_windows.txt

@@ -22,6 +22,11 @@ RIGHT
 CTRL v
 CTRL v
 
+REM Alt code input demo
+ALTCHAR 7
+ALTSTRING This line was print using Alt+Numpad input method. It works even if non-US keyboard layout is selected
+ENTER
+
 STRING =
 REPEAT 59
 ENTER

firmware/targets/f6/furi-hal/furi-hal-usb-cdc.c

@@ -539,11 +539,6 @@ static usbd_respond cdc_ep_config (usbd_device *dev, uint8_t cfg) {
     switch (cfg) {
     case 0:
         /* deconfiguring device */
-        usbd_ep_deconfig(dev, CDC0_NTF_EP);
-        usbd_ep_deconfig(dev, CDC0_TXD_EP);
-        usbd_ep_deconfig(dev, CDC0_RXD_EP);
-        usbd_reg_endpoint(dev, CDC0_RXD_EP, 0);
-        usbd_reg_endpoint(dev, CDC0_TXD_EP, 0);
         if (if_cnt == 4) {
             usbd_ep_deconfig(dev, CDC1_NTF_EP);
             usbd_ep_deconfig(dev, CDC1_TXD_EP);
@@ -551,6 +546,11 @@ static usbd_respond cdc_ep_config (usbd_device *dev, uint8_t cfg) {
             usbd_reg_endpoint(dev, CDC1_RXD_EP, 0);
             usbd_reg_endpoint(dev, CDC1_TXD_EP, 0);
         }
+        usbd_ep_deconfig(dev, CDC0_NTF_EP);
+        usbd_ep_deconfig(dev, CDC0_TXD_EP);
+        usbd_ep_deconfig(dev, CDC0_RXD_EP);
+        usbd_reg_endpoint(dev, CDC0_RXD_EP, 0);
+        usbd_reg_endpoint(dev, CDC0_TXD_EP, 0);
         return usbd_ack;
     case 1:
         /* configuring device */

firmware/targets/f6/furi-hal/furi-hal-usb-hid.c

@@ -9,17 +9,24 @@
 #include "hid_usage_desktop.h"
 #include "hid_usage_button.h"
 #include "hid_usage_keyboard.h"
+#include "hid_usage_led.h"
 
-#define HID_RIN_EP      0x81
-#define HID_RIN_SZ      0x10
+#define HID_EP_IN      0x81
+#define HID_EP_OUT     0x01
+#define HID_EP_SZ      0x10
 
 #define HID_KB_MAX_KEYS 6
+#define HID_CONSUMER_MAX_KEYS 2
+
+#define HID_PAGE_CONSUMER 0x0C
+#define HID_CONSUMER_CONTROL 0x01
 
 struct HidIadDescriptor {
     struct usb_iad_descriptor           hid_iad;
     struct usb_interface_descriptor     hid;
     struct usb_hid_descriptor           hid_desc;
-    struct usb_endpoint_descriptor      hid_ep;    
+    struct usb_endpoint_descriptor      hid_ep_in;
+    struct usb_endpoint_descriptor      hid_ep_out;
 };
 
 struct HidConfigDescriptor {
@@ -30,6 +37,7 @@ struct HidConfigDescriptor {
 enum HidReportId {
     ReportIdKeyboard = 1,
     ReportIdMouse = 2,
+    ReportIdConsumer = 3,
 };
 
 /* HID report: keyboard+mouse */
@@ -49,7 +57,13 @@ static const uint8_t hid_report_desc[] = {
             HID_REPORT_COUNT(1),
             HID_REPORT_SIZE(8),
         HID_INPUT(HID_IOF_CONSTANT | HID_IOF_VARIABLE | HID_IOF_ABSOLUTE),
-            HID_REPORT_COUNT(6),
+            HID_USAGE_PAGE(HID_PAGE_LED),
+            HID_REPORT_COUNT(8),
+            HID_REPORT_SIZE(1),
+            HID_USAGE_MINIMUM(1),
+            HID_USAGE_MAXIMUM(8),
+        HID_OUTPUT(HID_IOF_DATA | HID_IOF_VARIABLE | HID_IOF_ABSOLUTE),
+            HID_REPORT_COUNT(HID_KB_MAX_KEYS),
             HID_REPORT_SIZE(8),
             HID_LOGICAL_MINIMUM(0),
             HID_LOGICAL_MAXIMUM(101),
@@ -86,6 +100,18 @@ static const uint8_t hid_report_desc[] = {
             HID_INPUT(HID_IOF_DATA | HID_IOF_VARIABLE | HID_IOF_RELATIVE),
         HID_END_COLLECTION,
     HID_END_COLLECTION,
+    HID_USAGE_PAGE(HID_PAGE_CONSUMER),
+    HID_USAGE(HID_CONSUMER_CONTROL),
+    HID_COLLECTION(HID_APPLICATION_COLLECTION),
+        HID_REPORT_ID(ReportIdConsumer),
+            HID_LOGICAL_MINIMUM(0),
+            HID_RI_LOGICAL_MAXIMUM(16, 0x3FF),
+            HID_USAGE_MINIMUM(0),
+            HID_RI_USAGE_MAXIMUM(16, 0x3FF),
+            HID_REPORT_COUNT(HID_CONSUMER_MAX_KEYS),
+            HID_REPORT_SIZE(16),
+        HID_INPUT(HID_IOF_DATA | HID_IOF_ARRAY | HID_IOF_ABSOLUTE),
+    HID_END_COLLECTION,
 };
 
 static const struct usb_string_descriptor dev_manuf_desc = USB_STRING_DESC("Logitech");
@@ -138,7 +164,7 @@ static const struct HidConfigDescriptor hid_cfg_desc = {
             .bDescriptorType        = USB_DTYPE_INTERFACE,
             .bInterfaceNumber       = 0,
             .bAlternateSetting      = 0,
-            .bNumEndpoints          = 1,
+            .bNumEndpoints          = 2,
             .bInterfaceClass        = USB_CLASS_HID,
             .bInterfaceSubClass     = USB_HID_SUBCLASS_NONBOOT,
             .bInterfaceProtocol     = USB_HID_PROTO_NONBOOT,
@@ -153,12 +179,20 @@ static const struct HidConfigDescriptor hid_cfg_desc = {
             .bDescriptorType0       = USB_DTYPE_HID_REPORT,
             .wDescriptorLength0     = sizeof(hid_report_desc),
         },
-        .hid_ep = {
+        .hid_ep_in = {
             .bLength                = sizeof(struct usb_endpoint_descriptor),
             .bDescriptorType        = USB_DTYPE_ENDPOINT,
-            .bEndpointAddress       = HID_RIN_EP,
+            .bEndpointAddress       = HID_EP_IN,
             .bmAttributes           = USB_EPTYPE_INTERRUPT,
-            .wMaxPacketSize         = HID_RIN_SZ,
+            .wMaxPacketSize         = HID_EP_SZ,
+            .bInterval              = 10,
+        },
+        .hid_ep_out = {
+            .bLength                = sizeof(struct usb_endpoint_descriptor),
+            .bDescriptorType        = USB_DTYPE_ENDPOINT,
+            .bEndpointAddress       = HID_EP_OUT,
+            .bmAttributes           = USB_EPTYPE_INTERRUPT,
+            .wMaxPacketSize         = HID_EP_SZ,
             .bInterval              = 10,
         },
     },
@@ -179,9 +213,20 @@ struct HidReportKB {
     uint8_t btn[HID_KB_MAX_KEYS];
 } __attribute__((packed));
 
+struct HidReportConsumer {
+    uint8_t report_id;
+    uint16_t btn[HID_CONSUMER_MAX_KEYS];
+} __attribute__((packed));
+
+struct HidReportLED {
+    uint8_t report_id;
+    uint8_t led_state;
+} __attribute__((packed));
+
 static struct HidReport {
     struct HidReportKB keyboard;
     struct HidReportMouse mouse;
+    struct HidReportConsumer consumer;
 } __attribute__((packed)) hid_report;
 
 static void hid_init(usbd_device* dev, UsbInterface* intf);
@@ -197,11 +242,16 @@ static osSemaphoreId_t hid_semaphore = NULL;
 static bool hid_connected = false;
 static HidStateCallback callback;
 static void* cb_ctx;
+static uint8_t led_state;
 
 bool furi_hal_hid_is_connected() {
     return hid_connected;
 }
 
+uint8_t furi_hal_hid_get_led_state() {
+    return led_state;
+}
+
 void furi_hal_hid_set_state_callback(HidStateCallback cb, void* ctx) {
     if (callback != NULL) {
         if (hid_connected == true)
@@ -273,6 +323,26 @@ bool furi_hal_hid_mouse_scroll(int8_t delta) {
     return state;
 }
 
+bool furi_hal_hid_consumer_key_press(uint16_t button) {
+    for (uint8_t key_nb = 0; key_nb < HID_CONSUMER_MAX_KEYS; key_nb++) {
+        if (hid_report.consumer.btn[key_nb] == 0) {
+            hid_report.consumer.btn[key_nb] = button;
+            break;
+        }
+    }
+    return hid_send_report(ReportIdConsumer);
+}
+
+bool furi_hal_hid_consumer_key_release(uint16_t button) {
+    for (uint8_t key_nb = 0; key_nb < HID_CONSUMER_MAX_KEYS; key_nb++) {
+        if (hid_report.consumer.btn[key_nb] == button) {
+            hid_report.consumer.btn[key_nb] = 0;
+            break;
+        }
+    }
+    return hid_send_report(ReportIdConsumer);
+}
+
 UsbInterface usb_hid = {
     .init = hid_init,
     .deinit = hid_deinit,
@@ -294,6 +364,7 @@ static void hid_init(usbd_device* dev, UsbInterface* intf) {
     usb_dev = dev;
     hid_report.keyboard.report_id = ReportIdKeyboard;
     hid_report.mouse.report_id = ReportIdMouse;
+    hid_report.consumer.report_id = ReportIdConsumer;
 
     usbd_reg_config(dev, hid_ep_config);
     usbd_reg_control(dev, hid_control);    
@@ -331,16 +402,24 @@ static bool hid_send_report(uint8_t report_id)
     furi_check(osSemaphoreAcquire(hid_semaphore, osWaitForever) == osOK);
     if (hid_connected == true) {
         if (report_id == ReportIdKeyboard)
-            usbd_ep_write(usb_dev, HID_RIN_EP, &hid_report.keyboard, sizeof(hid_report.keyboard));
-        else
-            usbd_ep_write(usb_dev, HID_RIN_EP, &hid_report.mouse, sizeof(hid_report.mouse));
+            usbd_ep_write(usb_dev, HID_EP_IN, &hid_report.keyboard, sizeof(hid_report.keyboard));
+        else if (report_id == ReportIdMouse)
+            usbd_ep_write(usb_dev, HID_EP_IN, &hid_report.mouse, sizeof(hid_report.mouse));
+        else if (report_id == ReportIdConsumer)
+            usbd_ep_write(usb_dev, HID_EP_IN, &hid_report.consumer, sizeof(hid_report.consumer));
         return true;
     }
     return false;
 }
 
-static void hid_ep_callback(usbd_device *dev, uint8_t event, uint8_t ep) {
-    osSemaphoreRelease(hid_semaphore);
+static void hid_txrx_ep_callback(usbd_device *dev, uint8_t event, uint8_t ep) {
+    if (event == usbd_evt_eptx) {
+        osSemaphoreRelease(hid_semaphore);
+    } else {
+        struct HidReportLED leds;
+        usbd_ep_read(usb_dev, ep, &leds, 2);
+        led_state = leds.led_state;
+    }
 }
 
 /* Configure endpoints */
@@ -348,14 +427,18 @@ static usbd_respond hid_ep_config (usbd_device *dev, uint8_t cfg) {
     switch (cfg) {
     case 0:
         /* deconfiguring device */
-        usbd_ep_deconfig(dev, HID_RIN_EP);
-        usbd_reg_endpoint(dev, HID_RIN_EP, 0);
+        usbd_ep_deconfig(dev, HID_EP_OUT);
+        usbd_ep_deconfig(dev, HID_EP_IN);
+        usbd_reg_endpoint(dev, HID_EP_OUT, 0);
+        usbd_reg_endpoint(dev, HID_EP_IN, 0);
         return usbd_ack;
     case 1:
         /* configuring device */
-        usbd_ep_config(dev, HID_RIN_EP, USB_EPTYPE_INTERRUPT, HID_RIN_SZ);
-        usbd_reg_endpoint(dev, HID_RIN_EP, hid_ep_callback);
-        usbd_ep_write(dev, HID_RIN_EP, 0, 0);
+        usbd_ep_config(dev, HID_EP_IN, USB_EPTYPE_INTERRUPT, HID_EP_SZ);
+        usbd_ep_config(dev, HID_EP_OUT, USB_EPTYPE_INTERRUPT, HID_EP_SZ);
+        usbd_reg_endpoint(dev, HID_EP_IN, hid_txrx_ep_callback);
+        usbd_reg_endpoint(dev, HID_EP_OUT, hid_txrx_ep_callback);
+        usbd_ep_write(dev, HID_EP_IN, 0, 0);
         return usbd_ack;
     default:
         return usbd_fail;

firmware/targets/f6/furi-hal/furi-hal-usb-u2f.c

@@ -71,71 +71,65 @@ static const struct usb_device_descriptor hid_u2f_device_desc = {
 
 /* Device configuration descriptor */
 static const struct HidConfigDescriptor hid_u2f_cfg_desc = {
-    .config =
+    .config = {
+        .bLength = sizeof(struct usb_config_descriptor),
+        .bDescriptorType = USB_DTYPE_CONFIGURATION,
+        .wTotalLength = sizeof(struct HidConfigDescriptor),
+        .bNumInterfaces = 1,
+        .bConfigurationValue = 1,
+        .iConfiguration = NO_DESCRIPTOR,
+        .bmAttributes = USB_CFG_ATTR_RESERVED | USB_CFG_ATTR_SELFPOWERED,
+        .bMaxPower = USB_CFG_POWER_MA(100),
+    },
+    .iad_0 = {
+        .hid_iad =
         {
-            .bLength = sizeof(struct usb_config_descriptor),
-            .bDescriptorType = USB_DTYPE_CONFIGURATION,
-            .wTotalLength = sizeof(struct HidConfigDescriptor),
-            .bNumInterfaces = 1,
-            .bConfigurationValue = 1,
-            .iConfiguration = NO_DESCRIPTOR,
-            .bmAttributes = USB_CFG_ATTR_RESERVED | USB_CFG_ATTR_SELFPOWERED,
-            .bMaxPower = USB_CFG_POWER_MA(100),
+            .bLength = sizeof(struct usb_iad_descriptor),
+            .bDescriptorType = USB_DTYPE_INTERFASEASSOC,
+            .bFirstInterface = 0,
+            .bInterfaceCount = 1,
+            .bFunctionClass = USB_CLASS_PER_INTERFACE,
+            .bFunctionSubClass = USB_SUBCLASS_NONE,
+            .bFunctionProtocol = USB_PROTO_NONE,
+            .iFunction = NO_DESCRIPTOR,
         },
-    .iad_0 =
-        {
-            .hid_iad =
-                {
-                    .bLength = sizeof(struct usb_iad_descriptor),
-                    .bDescriptorType = USB_DTYPE_INTERFASEASSOC,
-                    .bFirstInterface = 0,
-                    .bInterfaceCount = 1,
-                    .bFunctionClass = USB_CLASS_PER_INTERFACE,
-                    .bFunctionSubClass = USB_SUBCLASS_NONE,
-                    .bFunctionProtocol = USB_PROTO_NONE,
-                    .iFunction = NO_DESCRIPTOR,
-                },
-            .hid =
-                {
-                    .bLength = sizeof(struct usb_interface_descriptor),
-                    .bDescriptorType = USB_DTYPE_INTERFACE,
-                    .bInterfaceNumber = 0,
-                    .bAlternateSetting = 0,
-                    .bNumEndpoints = 2,
-                    .bInterfaceClass = USB_CLASS_HID,
-                    .bInterfaceSubClass = USB_HID_SUBCLASS_NONBOOT,
-                    .bInterfaceProtocol = USB_HID_PROTO_NONBOOT,
-                    .iInterface = NO_DESCRIPTOR,
-                },
-            .hid_desc =
-                {
-                    .bLength = sizeof(struct usb_hid_descriptor),
-                    .bDescriptorType = USB_DTYPE_HID,
-                    .bcdHID = VERSION_BCD(1, 0, 0),
-                    .bCountryCode = USB_HID_COUNTRY_NONE,
-                    .bNumDescriptors = 1,
-                    .bDescriptorType0 = USB_DTYPE_HID_REPORT,
-                    .wDescriptorLength0 = sizeof(hid_u2f_report_desc),
-                },
-            .hid_ep_in =
-                {
-                    .bLength = sizeof(struct usb_endpoint_descriptor),
-                    .bDescriptorType = USB_DTYPE_ENDPOINT,
-                    .bEndpointAddress = HID_EP_IN,
-                    .bmAttributes = USB_EPTYPE_INTERRUPT,
-                    .wMaxPacketSize = HID_U2F_PACKET_LEN,
-                    .bInterval = 5,
-                },
-            .hid_ep_out =
-                {
-                    .bLength = sizeof(struct usb_endpoint_descriptor),
-                    .bDescriptorType = USB_DTYPE_ENDPOINT,
-                    .bEndpointAddress = HID_EP_OUT,
-                    .bmAttributes = USB_EPTYPE_INTERRUPT,
-                    .wMaxPacketSize = HID_U2F_PACKET_LEN,
-                    .bInterval = 5,
-                },
+        .hid = {
+            .bLength = sizeof(struct usb_interface_descriptor),
+            .bDescriptorType = USB_DTYPE_INTERFACE,
+            .bInterfaceNumber = 0,
+            .bAlternateSetting = 0,
+            .bNumEndpoints = 2,
+            .bInterfaceClass = USB_CLASS_HID,
+            .bInterfaceSubClass = USB_HID_SUBCLASS_NONBOOT,
+            .bInterfaceProtocol = USB_HID_PROTO_NONBOOT,
+            .iInterface = NO_DESCRIPTOR,
+        },
+        .hid_desc = {
+            .bLength = sizeof(struct usb_hid_descriptor),
+            .bDescriptorType = USB_DTYPE_HID,
+            .bcdHID = VERSION_BCD(1, 0, 0),
+            .bCountryCode = USB_HID_COUNTRY_NONE,
+            .bNumDescriptors = 1,
+            .bDescriptorType0 = USB_DTYPE_HID_REPORT,
+            .wDescriptorLength0 = sizeof(hid_u2f_report_desc),
+        },
+        .hid_ep_in = {
+            .bLength = sizeof(struct usb_endpoint_descriptor),
+            .bDescriptorType = USB_DTYPE_ENDPOINT,
+            .bEndpointAddress = HID_EP_IN,
+            .bmAttributes = USB_EPTYPE_INTERRUPT,
+            .wMaxPacketSize = HID_U2F_PACKET_LEN,
+            .bInterval = 5,
         },
+        .hid_ep_out = {
+            .bLength = sizeof(struct usb_endpoint_descriptor),
+            .bDescriptorType = USB_DTYPE_ENDPOINT,
+            .bEndpointAddress = HID_EP_OUT,
+            .bmAttributes = USB_EPTYPE_INTERRUPT,
+            .wMaxPacketSize = HID_U2F_PACKET_LEN,
+            .bInterval = 5,
+        },
+    },
 };
 
 static void hid_u2f_init(usbd_device* dev, UsbInterface* intf);
@@ -254,10 +248,10 @@ static usbd_respond hid_u2f_ep_config(usbd_device* dev, uint8_t cfg) {
     switch(cfg) {
     case 0:
         /* deconfiguring device */
-        usbd_ep_deconfig(dev, HID_EP_IN);
         usbd_ep_deconfig(dev, HID_EP_OUT);
-        usbd_reg_endpoint(dev, HID_EP_IN, 0);
+        usbd_ep_deconfig(dev, HID_EP_IN);
         usbd_reg_endpoint(dev, HID_EP_OUT, 0);
+        usbd_reg_endpoint(dev, HID_EP_IN, 0);
         return usbd_ack;
     case 1:
         /* configuring device */
@@ -281,10 +275,6 @@ static usbd_respond hid_u2f_control(usbd_device* dev, usbd_ctlreq* req, usbd_rqc
         switch(req->bRequest) {
         case USB_HID_SETIDLE:
             return usbd_ack;
-        case USB_HID_GETREPORT:
-            // dev->status.data_ptr = &hid_u2f_report;
-            // dev->status.data_count = sizeof(hid_u2f_report);
-            return usbd_ack;
         default:
             return usbd_fail;
         }

firmware/targets/f7/furi-hal/furi-hal-usb-cdc.c

@@ -539,11 +539,6 @@ static usbd_respond cdc_ep_config (usbd_device *dev, uint8_t cfg) {
     switch (cfg) {
     case 0:
         /* deconfiguring device */
-        usbd_ep_deconfig(dev, CDC0_NTF_EP);
-        usbd_ep_deconfig(dev, CDC0_TXD_EP);
-        usbd_ep_deconfig(dev, CDC0_RXD_EP);
-        usbd_reg_endpoint(dev, CDC0_RXD_EP, 0);
-        usbd_reg_endpoint(dev, CDC0_TXD_EP, 0);
         if (if_cnt == 4) {
             usbd_ep_deconfig(dev, CDC1_NTF_EP);
             usbd_ep_deconfig(dev, CDC1_TXD_EP);
@@ -551,6 +546,11 @@ static usbd_respond cdc_ep_config (usbd_device *dev, uint8_t cfg) {
             usbd_reg_endpoint(dev, CDC1_RXD_EP, 0);
             usbd_reg_endpoint(dev, CDC1_TXD_EP, 0);
         }
+        usbd_ep_deconfig(dev, CDC0_NTF_EP);
+        usbd_ep_deconfig(dev, CDC0_TXD_EP);
+        usbd_ep_deconfig(dev, CDC0_RXD_EP);
+        usbd_reg_endpoint(dev, CDC0_RXD_EP, 0);
+        usbd_reg_endpoint(dev, CDC0_TXD_EP, 0);
         return usbd_ack;
     case 1:
         /* configuring device */

firmware/targets/f7/furi-hal/furi-hal-usb-hid.c

@@ -9,17 +9,24 @@
 #include "hid_usage_desktop.h"
 #include "hid_usage_button.h"
 #include "hid_usage_keyboard.h"
+#include "hid_usage_led.h"
 
-#define HID_RIN_EP      0x81
-#define HID_RIN_SZ      0x10
+#define HID_EP_IN      0x81
+#define HID_EP_OUT     0x01
+#define HID_EP_SZ      0x10
 
 #define HID_KB_MAX_KEYS 6
+#define HID_CONSUMER_MAX_KEYS 2
+
+#define HID_PAGE_CONSUMER 0x0C
+#define HID_CONSUMER_CONTROL 0x01
 
 struct HidIadDescriptor {
     struct usb_iad_descriptor           hid_iad;
     struct usb_interface_descriptor     hid;
     struct usb_hid_descriptor           hid_desc;
-    struct usb_endpoint_descriptor      hid_ep;    
+    struct usb_endpoint_descriptor      hid_ep_in;
+    struct usb_endpoint_descriptor      hid_ep_out;
 };
 
 struct HidConfigDescriptor {
@@ -30,6 +37,7 @@ struct HidConfigDescriptor {
 enum HidReportId {
     ReportIdKeyboard = 1,
     ReportIdMouse = 2,
+    ReportIdConsumer = 3,
 };
 
 /* HID report: keyboard+mouse */
@@ -49,7 +57,13 @@ static const uint8_t hid_report_desc[] = {
             HID_REPORT_COUNT(1),
             HID_REPORT_SIZE(8),
         HID_INPUT(HID_IOF_CONSTANT | HID_IOF_VARIABLE | HID_IOF_ABSOLUTE),
-            HID_REPORT_COUNT(6),
+            HID_USAGE_PAGE(HID_PAGE_LED),
+            HID_REPORT_COUNT(8),
+            HID_REPORT_SIZE(1),
+            HID_USAGE_MINIMUM(1),
+            HID_USAGE_MAXIMUM(8),
+        HID_OUTPUT(HID_IOF_DATA | HID_IOF_VARIABLE | HID_IOF_ABSOLUTE),
+            HID_REPORT_COUNT(HID_KB_MAX_KEYS),
             HID_REPORT_SIZE(8),
             HID_LOGICAL_MINIMUM(0),
             HID_LOGICAL_MAXIMUM(101),
@@ -86,6 +100,18 @@ static const uint8_t hid_report_desc[] = {
             HID_INPUT(HID_IOF_DATA | HID_IOF_VARIABLE | HID_IOF_RELATIVE),
         HID_END_COLLECTION,
     HID_END_COLLECTION,
+    HID_USAGE_PAGE(HID_PAGE_CONSUMER),
+    HID_USAGE(HID_CONSUMER_CONTROL),
+    HID_COLLECTION(HID_APPLICATION_COLLECTION),
+        HID_REPORT_ID(ReportIdConsumer),
+            HID_LOGICAL_MINIMUM(0),
+            HID_RI_LOGICAL_MAXIMUM(16, 0x3FF),
+            HID_USAGE_MINIMUM(0),
+            HID_RI_USAGE_MAXIMUM(16, 0x3FF),
+            HID_REPORT_COUNT(HID_CONSUMER_MAX_KEYS),
+            HID_REPORT_SIZE(16),
+        HID_INPUT(HID_IOF_DATA | HID_IOF_ARRAY | HID_IOF_ABSOLUTE),
+    HID_END_COLLECTION,
 };
 
 static const struct usb_string_descriptor dev_manuf_desc = USB_STRING_DESC("Logitech");
@@ -138,7 +164,7 @@ static const struct HidConfigDescriptor hid_cfg_desc = {
             .bDescriptorType        = USB_DTYPE_INTERFACE,
             .bInterfaceNumber       = 0,
             .bAlternateSetting      = 0,
-            .bNumEndpoints          = 1,
+            .bNumEndpoints          = 2,
             .bInterfaceClass        = USB_CLASS_HID,
             .bInterfaceSubClass     = USB_HID_SUBCLASS_NONBOOT,
             .bInterfaceProtocol     = USB_HID_PROTO_NONBOOT,
@@ -153,12 +179,20 @@ static const struct HidConfigDescriptor hid_cfg_desc = {
             .bDescriptorType0       = USB_DTYPE_HID_REPORT,
             .wDescriptorLength0     = sizeof(hid_report_desc),
         },
-        .hid_ep = {
+        .hid_ep_in = {
             .bLength                = sizeof(struct usb_endpoint_descriptor),
             .bDescriptorType        = USB_DTYPE_ENDPOINT,
-            .bEndpointAddress       = HID_RIN_EP,
+            .bEndpointAddress       = HID_EP_IN,
             .bmAttributes           = USB_EPTYPE_INTERRUPT,
-            .wMaxPacketSize         = HID_RIN_SZ,
+            .wMaxPacketSize         = HID_EP_SZ,
+            .bInterval              = 10,
+        },
+        .hid_ep_out = {
+            .bLength                = sizeof(struct usb_endpoint_descriptor),
+            .bDescriptorType        = USB_DTYPE_ENDPOINT,
+            .bEndpointAddress       = HID_EP_OUT,
+            .bmAttributes           = USB_EPTYPE_INTERRUPT,
+            .wMaxPacketSize         = HID_EP_SZ,
             .bInterval              = 10,
         },
     },
@@ -179,9 +213,20 @@ struct HidReportKB {
     uint8_t btn[HID_KB_MAX_KEYS];
 } __attribute__((packed));
 
+struct HidReportConsumer {
+    uint8_t report_id;
+    uint16_t btn[HID_CONSUMER_MAX_KEYS];
+} __attribute__((packed));
+
+struct HidReportLED {
+    uint8_t report_id;
+    uint8_t led_state;
+} __attribute__((packed));
+
 static struct HidReport {
     struct HidReportKB keyboard;
     struct HidReportMouse mouse;
+    struct HidReportConsumer consumer;
 } __attribute__((packed)) hid_report;
 
 static void hid_init(usbd_device* dev, UsbInterface* intf);
@@ -197,11 +242,16 @@ static osSemaphoreId_t hid_semaphore = NULL;
 static bool hid_connected = false;
 static HidStateCallback callback;
 static void* cb_ctx;
+static uint8_t led_state;
 
 bool furi_hal_hid_is_connected() {
     return hid_connected;
 }
 
+uint8_t furi_hal_hid_get_led_state() {
+    return led_state;
+}
+
 void furi_hal_hid_set_state_callback(HidStateCallback cb, void* ctx) {
     if (callback != NULL) {
         if (hid_connected == true)
@@ -273,6 +323,26 @@ bool furi_hal_hid_mouse_scroll(int8_t delta) {
     return state;
 }
 
+bool furi_hal_hid_consumer_key_press(uint16_t button) {
+    for (uint8_t key_nb = 0; key_nb < HID_CONSUMER_MAX_KEYS; key_nb++) {
+        if (hid_report.consumer.btn[key_nb] == 0) {
+            hid_report.consumer.btn[key_nb] = button;
+            break;
+        }
+    }
+    return hid_send_report(ReportIdConsumer);
+}
+
+bool furi_hal_hid_consumer_key_release(uint16_t button) {
+    for (uint8_t key_nb = 0; key_nb < HID_CONSUMER_MAX_KEYS; key_nb++) {
+        if (hid_report.consumer.btn[key_nb] == button) {
+            hid_report.consumer.btn[key_nb] = 0;
+            break;
+        }
+    }
+    return hid_send_report(ReportIdConsumer);
+}
+
 UsbInterface usb_hid = {
     .init = hid_init,
     .deinit = hid_deinit,
@@ -294,6 +364,7 @@ static void hid_init(usbd_device* dev, UsbInterface* intf) {
     usb_dev = dev;
     hid_report.keyboard.report_id = ReportIdKeyboard;
     hid_report.mouse.report_id = ReportIdMouse;
+    hid_report.consumer.report_id = ReportIdConsumer;
 
     usbd_reg_config(dev, hid_ep_config);
     usbd_reg_control(dev, hid_control);    
@@ -331,16 +402,24 @@ static bool hid_send_report(uint8_t report_id)
     furi_check(osSemaphoreAcquire(hid_semaphore, osWaitForever) == osOK);
     if (hid_connected == true) {
         if (report_id == ReportIdKeyboard)
-            usbd_ep_write(usb_dev, HID_RIN_EP, &hid_report.keyboard, sizeof(hid_report.keyboard));
-        else
-            usbd_ep_write(usb_dev, HID_RIN_EP, &hid_report.mouse, sizeof(hid_report.mouse));
+            usbd_ep_write(usb_dev, HID_EP_IN, &hid_report.keyboard, sizeof(hid_report.keyboard));
+        else if (report_id == ReportIdMouse)
+            usbd_ep_write(usb_dev, HID_EP_IN, &hid_report.mouse, sizeof(hid_report.mouse));
+        else if (report_id == ReportIdConsumer)
+            usbd_ep_write(usb_dev, HID_EP_IN, &hid_report.consumer, sizeof(hid_report.consumer));
         return true;
     }
     return false;
 }
 
-static void hid_ep_callback(usbd_device *dev, uint8_t event, uint8_t ep) {
-    osSemaphoreRelease(hid_semaphore);
+static void hid_txrx_ep_callback(usbd_device *dev, uint8_t event, uint8_t ep) {
+    if (event == usbd_evt_eptx) {
+        osSemaphoreRelease(hid_semaphore);
+    } else {
+        struct HidReportLED leds;
+        usbd_ep_read(usb_dev, ep, &leds, 2);
+        led_state = leds.led_state;
+    }
 }
 
 /* Configure endpoints */
@@ -348,14 +427,18 @@ static usbd_respond hid_ep_config (usbd_device *dev, uint8_t cfg) {
     switch (cfg) {
     case 0:
         /* deconfiguring device */
-        usbd_ep_deconfig(dev, HID_RIN_EP);
-        usbd_reg_endpoint(dev, HID_RIN_EP, 0);
+        usbd_ep_deconfig(dev, HID_EP_OUT);
+        usbd_ep_deconfig(dev, HID_EP_IN);
+        usbd_reg_endpoint(dev, HID_EP_OUT, 0);
+        usbd_reg_endpoint(dev, HID_EP_IN, 0);
         return usbd_ack;
     case 1:
         /* configuring device */
-        usbd_ep_config(dev, HID_RIN_EP, USB_EPTYPE_INTERRUPT, HID_RIN_SZ);
-        usbd_reg_endpoint(dev, HID_RIN_EP, hid_ep_callback);
-        usbd_ep_write(dev, HID_RIN_EP, 0, 0);
+        usbd_ep_config(dev, HID_EP_IN, USB_EPTYPE_INTERRUPT, HID_EP_SZ);
+        usbd_ep_config(dev, HID_EP_OUT, USB_EPTYPE_INTERRUPT, HID_EP_SZ);
+        usbd_reg_endpoint(dev, HID_EP_IN, hid_txrx_ep_callback);
+        usbd_reg_endpoint(dev, HID_EP_OUT, hid_txrx_ep_callback);
+        usbd_ep_write(dev, HID_EP_IN, 0, 0);
         return usbd_ack;
     default:
         return usbd_fail;

firmware/targets/f7/furi-hal/furi-hal-usb-u2f.c

@@ -71,71 +71,65 @@ static const struct usb_device_descriptor hid_u2f_device_desc = {
 
 /* Device configuration descriptor */
 static const struct HidConfigDescriptor hid_u2f_cfg_desc = {
-    .config =
+    .config = {
+        .bLength = sizeof(struct usb_config_descriptor),
+        .bDescriptorType = USB_DTYPE_CONFIGURATION,
+        .wTotalLength = sizeof(struct HidConfigDescriptor),
+        .bNumInterfaces = 1,
+        .bConfigurationValue = 1,
+        .iConfiguration = NO_DESCRIPTOR,
+        .bmAttributes = USB_CFG_ATTR_RESERVED | USB_CFG_ATTR_SELFPOWERED,
+        .bMaxPower = USB_CFG_POWER_MA(100),
+    },
+    .iad_0 = {
+        .hid_iad =
         {
-            .bLength = sizeof(struct usb_config_descriptor),
-            .bDescriptorType = USB_DTYPE_CONFIGURATION,
-            .wTotalLength = sizeof(struct HidConfigDescriptor),
-            .bNumInterfaces = 1,
-            .bConfigurationValue = 1,
-            .iConfiguration = NO_DESCRIPTOR,
-            .bmAttributes = USB_CFG_ATTR_RESERVED | USB_CFG_ATTR_SELFPOWERED,
-            .bMaxPower = USB_CFG_POWER_MA(100),
+            .bLength = sizeof(struct usb_iad_descriptor),
+            .bDescriptorType = USB_DTYPE_INTERFASEASSOC,
+            .bFirstInterface = 0,
+            .bInterfaceCount = 1,
+            .bFunctionClass = USB_CLASS_PER_INTERFACE,
+            .bFunctionSubClass = USB_SUBCLASS_NONE,
+            .bFunctionProtocol = USB_PROTO_NONE,
+            .iFunction = NO_DESCRIPTOR,
         },
-    .iad_0 =
-        {
-            .hid_iad =
-                {
-                    .bLength = sizeof(struct usb_iad_descriptor),
-                    .bDescriptorType = USB_DTYPE_INTERFASEASSOC,
-                    .bFirstInterface = 0,
-                    .bInterfaceCount = 1,
-                    .bFunctionClass = USB_CLASS_PER_INTERFACE,
-                    .bFunctionSubClass = USB_SUBCLASS_NONE,
-                    .bFunctionProtocol = USB_PROTO_NONE,
-                    .iFunction = NO_DESCRIPTOR,
-                },
-            .hid =
-                {
-                    .bLength = sizeof(struct usb_interface_descriptor),
-                    .bDescriptorType = USB_DTYPE_INTERFACE,
-                    .bInterfaceNumber = 0,
-                    .bAlternateSetting = 0,
-                    .bNumEndpoints = 2,
-                    .bInterfaceClass = USB_CLASS_HID,
-                    .bInterfaceSubClass = USB_HID_SUBCLASS_NONBOOT,
-                    .bInterfaceProtocol = USB_HID_PROTO_NONBOOT,
-                    .iInterface = NO_DESCRIPTOR,
-                },
-            .hid_desc =
-                {
-                    .bLength = sizeof(struct usb_hid_descriptor),
-                    .bDescriptorType = USB_DTYPE_HID,
-                    .bcdHID = VERSION_BCD(1, 0, 0),
-                    .bCountryCode = USB_HID_COUNTRY_NONE,
-                    .bNumDescriptors = 1,
-                    .bDescriptorType0 = USB_DTYPE_HID_REPORT,
-                    .wDescriptorLength0 = sizeof(hid_u2f_report_desc),
-                },
-            .hid_ep_in =
-                {
-                    .bLength = sizeof(struct usb_endpoint_descriptor),
-                    .bDescriptorType = USB_DTYPE_ENDPOINT,
-                    .bEndpointAddress = HID_EP_IN,
-                    .bmAttributes = USB_EPTYPE_INTERRUPT,
-                    .wMaxPacketSize = HID_U2F_PACKET_LEN,
-                    .bInterval = 5,
-                },
-            .hid_ep_out =
-                {
-                    .bLength = sizeof(struct usb_endpoint_descriptor),
-                    .bDescriptorType = USB_DTYPE_ENDPOINT,
-                    .bEndpointAddress = HID_EP_OUT,
-                    .bmAttributes = USB_EPTYPE_INTERRUPT,
-                    .wMaxPacketSize = HID_U2F_PACKET_LEN,
-                    .bInterval = 5,
-                },
+        .hid = {
+            .bLength = sizeof(struct usb_interface_descriptor),
+            .bDescriptorType = USB_DTYPE_INTERFACE,
+            .bInterfaceNumber = 0,
+            .bAlternateSetting = 0,
+            .bNumEndpoints = 2,
+            .bInterfaceClass = USB_CLASS_HID,
+            .bInterfaceSubClass = USB_HID_SUBCLASS_NONBOOT,
+            .bInterfaceProtocol = USB_HID_PROTO_NONBOOT,
+            .iInterface = NO_DESCRIPTOR,
+        },
+        .hid_desc = {
+            .bLength = sizeof(struct usb_hid_descriptor),
+            .bDescriptorType = USB_DTYPE_HID,
+            .bcdHID = VERSION_BCD(1, 0, 0),
+            .bCountryCode = USB_HID_COUNTRY_NONE,
+            .bNumDescriptors = 1,
+            .bDescriptorType0 = USB_DTYPE_HID_REPORT,
+            .wDescriptorLength0 = sizeof(hid_u2f_report_desc),
+        },
+        .hid_ep_in = {
+            .bLength = sizeof(struct usb_endpoint_descriptor),
+            .bDescriptorType = USB_DTYPE_ENDPOINT,
+            .bEndpointAddress = HID_EP_IN,
+            .bmAttributes = USB_EPTYPE_INTERRUPT,
+            .wMaxPacketSize = HID_U2F_PACKET_LEN,
+            .bInterval = 5,
         },
+        .hid_ep_out = {
+            .bLength = sizeof(struct usb_endpoint_descriptor),
+            .bDescriptorType = USB_DTYPE_ENDPOINT,
+            .bEndpointAddress = HID_EP_OUT,
+            .bmAttributes = USB_EPTYPE_INTERRUPT,
+            .wMaxPacketSize = HID_U2F_PACKET_LEN,
+            .bInterval = 5,
+        },
+    },
 };
 
 static void hid_u2f_init(usbd_device* dev, UsbInterface* intf);
@@ -254,10 +248,10 @@ static usbd_respond hid_u2f_ep_config(usbd_device* dev, uint8_t cfg) {
     switch(cfg) {
     case 0:
         /* deconfiguring device */
-        usbd_ep_deconfig(dev, HID_EP_IN);
         usbd_ep_deconfig(dev, HID_EP_OUT);
-        usbd_reg_endpoint(dev, HID_EP_IN, 0);
+        usbd_ep_deconfig(dev, HID_EP_IN);
         usbd_reg_endpoint(dev, HID_EP_OUT, 0);
+        usbd_reg_endpoint(dev, HID_EP_IN, 0);
         return usbd_ack;
     case 1:
         /* configuring device */
@@ -281,10 +275,6 @@ static usbd_respond hid_u2f_control(usbd_device* dev, usbd_ctlreq* req, usbd_rqc
         switch(req->bRequest) {
         case USB_HID_SETIDLE:
             return usbd_ack;
-        case USB_HID_GETREPORT:
-            // dev->status.data_ptr = &hid_u2f_report;
-            // dev->status.data_count = sizeof(hid_u2f_report);
-            return usbd_ack;
         default:
             return usbd_fail;
         }

firmware/targets/f7/target.mk

@@ -71,7 +71,8 @@ C_SOURCES += \
 	$(CUBE_DIR)/Drivers/STM32WBxx_HAL_Driver/Src/stm32wbxx_ll_tim.c \
 	$(CUBE_DIR)/Drivers/STM32WBxx_HAL_Driver/Src/stm32wbxx_ll_usart.c \
 	$(CUBE_DIR)/Drivers/STM32WBxx_HAL_Driver/Src/stm32wbxx_ll_lpuart.c \
-	$(CUBE_DIR)/Drivers/STM32WBxx_HAL_Driver/Src/stm32wbxx_ll_utils.c
+	$(CUBE_DIR)/Drivers/STM32WBxx_HAL_Driver/Src/stm32wbxx_ll_utils.c \
+	$(CUBE_DIR)/Drivers/STM32WBxx_HAL_Driver/Src/stm32wbxx_ll_rng.c
 
 # FreeRTOS
 CFLAGS += \

firmware/targets/furi-hal-include/furi-hal-usb-hid.h

@@ -255,6 +255,13 @@ typedef void (*HidStateCallback)(bool state, void* context);
 /** ASCII to keycode conversion macro */
 #define HID_ASCII_TO_KEY(x) (((uint8_t)x < 128) ? (hid_asciimap[(uint8_t)x]) : KEY_NONE)
 
+/** HID keyboard leds */
+enum HidKeyboardLeds {
+    HID_KB_LED_NUM          = (1 << 0),
+    HID_KB_LED_CAPS         = (1 << 1),
+    HID_KB_LED_SCROLL       = (1 << 2),
+};
+
 /** HID mouse buttons */
 enum HidMouseButtons {
     HID_MOUSE_BTN_LEFT      = (1 << 0),
@@ -268,6 +275,12 @@ enum HidMouseButtons {
  */
 bool furi_hal_hid_is_connected();
 
+/** Get USB HID keyboard leds state
+ *
+ * @return      leds state
+ */
+uint8_t furi_hal_hid_get_led_state();
+
 /** Set USB HID connect/disconnect callback
  *
  * @param      cb  callback
@@ -316,3 +329,15 @@ bool furi_hal_hid_mouse_release(uint8_t button);
  * @param      delta  number of scroll steps
  */
 bool furi_hal_hid_mouse_scroll(int8_t delta);
+
+/** Set the following consumer key to pressed state and send HID report
+ *
+ * @param      button  key code
+ */
+bool furi_hal_hid_consumer_key_press(uint16_t button);
+
+/** Set the following consumer key to released state and send HID report
+ *
+ * @param      button  key code
+ */
+bool furi_hal_hid_consumer_key_release(uint16_t button);