How one engineer reverse engineered the Attack Shark keyboard protocol
An engineer reverse engineered the closed Attack Shark keyboard protocol via WebHID, producing an open-source configurator for 523 board models.
Setting out to port an Attack Shark X86 keyboard to QMK, an engineer discovered the vendor's "QMK configurator" was actually a Windows-only third-party tool squatting on the name, and the board itself ran closed proprietary firmware. With QMK off the table on Linux, the goal shifted to simply configuring the board from a Linux machine.
By patching the vendor's Electron app to force its WebHID code path and logging every report, the full wire protocol was reconstructed: plain 64-byte HID feature reports with a simple checksum. The "driver" turned out to be a single ROYUAN-built app reskinned for dozens of brands (Epomaker, Akko, Hator, ikbc, NOPPOO, MEETION), but two incompatible command families reuse the same opcode numbers for different registers — sending the wrong family's write can silently lock the keyboard. For hall-effect boards, a rescued firmware image was decompressed and disassembled with radare2 on ARM Cortex-M to confirm the command dispatch table directly from handler code.
The recurring lesson: a reply from the keyboard is not proof of anything. Boards return plausible, fabricated status for hardware they were never fitted with, so every command's meaning had to be verified by writing, reading back, and diffing. The work became a published protocol specification on GitHub and a cross-platform configurator, sharkfin, supporting 523 boards on Linux, Windows, macOS, and via WebHID in the browser.