How does an emulated keyboard work?

Question

I have read that some USB devices emulate a keyboard and the information these devices send will be as if the information was typed on a keyboard. For example: a magnetic card reader can use an emulated keyboard to give information about the card.

This is a question I had asked about keyboard, BT keyboard and stdin which explains how they work.

So where does an application have to listen to the input generated by an emulated keyboard?

Answer 1

If you hook up two USB keyboards to your system, or a USB keyboard to a laptop with built-in keyboard, you can alternately type characters¹ on each one (or use the left on one keyboard and the right on the other. The emulating devices have nothing more to do than tell the system they are a keyboard, just like a keyboard would do and characters coming from the device will be inserted in the right queue. The application just listens like it would for normal keyboard input.

There are other ways to get the same result, I used to have a barcode scanner from before the USB era, that had to be physically inserted between the keyboard and the mainboard (using female and male PS/2 connectors), one scan would act as if you pressed the number sequence of the barcode in quick succession.

¹ _{Special keys like Fn modify the keycode of other keys sent by the keyboard, so you cannot press Fn on one keyboard and expect the key on the other keyboard to be modified.}

Answer 2

If the USB device itself presents a HID keyboard interface, then from the point of view of the computer, it is (or "contains") a keyboard. The corresponding HID driver is loaded. The device communicate through that interface using the corresponding HID protocol.

USB devices can have many interfaces. The device itself sends information to the operating system describing what it is, in USB descriptors. You can see that information in the verbose output of lsusb (lsusb -v). The relevant values are bDeviceClass, bDeviceSubClass bDeviceProtocol.

Here is one of the interfaces of my mouse for instance, presenting itself as a keyboard. When buttons assigned keys or macros are clicked the mouse "type" here :

Interface Descriptor:
  bLength                 9
  bDescriptorType         4
  bInterfaceNumber        0
  bAlternateSetting       0
  bNumEndpoints           1
  bInterfaceClass         3 Human Interface Device
  bInterfaceSubClass      1 Boot Interface Subclass
  bInterfaceProtocol      1 Keyboard
  iInterface              0 

And it is listed by xinput just like an actual second keyboard.

This also has the potential to be used maliciously, as something doesn't have to look like a keyboard at all to type things for you (or presents itself as any other device).