hidreport

Overview ¶

Package hidreport decodes a USB HID Report Descriptor — the item-based structure (USB HID 1.11 §6.2.2) a HID device returns to declare *what it is*: its usage (keyboard / mouse / gamepad / vendor-defined), its collections, and the size/shape of its input, output and feature reports. It is the deepest layer of USB device identity and the definitive BadUSB tell: a device whose report descriptor declares a **Generic Desktop / Keyboard** usage with a standard input report is a keyboard — so a flash drive or "charging cable" whose HID report descriptor declares a keyboard is a keystroke injector (Rubber Ducky / Bash Bunny / O.MG cable). It completes the project's USB analysis stack: usb_descriptor (the device / interface / endpoint identity), this (the HID usage the device claims), and usbhid (the 8-byte report data the device then sends).

Wrap-vs-native judgement ¶

Native. A HID report descriptor is a flat sequence of items; each short
item is a prefix byte (bTag<<4 | bType<<2 | bSize) plus 0/1/2/4
little-endian data bytes, and a long item is 0xFE + size + tag + data. A
byte walk + bit-field reads + tag-name tables; stdlib only, no new go.mod
dep.

Verifiable / no confidently-wrong output ¶

The item encoding, the Main / Global / Local tag tables, the Collection
types and the Input/Output/Feature data-flag bits follow the USB HID 1.11
specification — deterministic and byte-checkable against the canonical
boot-keyboard report descriptor. Usage-page and usage VALUES are a vast,
largely vendor-extensible registry, so only the well-known usage pages and
the Generic-Desktop usages are named; any other usage page / usage is
surfaced by value (never guessed), and a truncated item stops the walk.