模拟快捷键 fn+2 切换
📡 如果要确认“蓝牙切换”的核心指令
- 很多三模键盘（比如 Fn+1/Fn+2/Fn+3 切换蓝牙设备）不会往系统发普通键码，而是给蓝牙模块发 Vendor-specific HID report。
- 这些包通常只有在 hidraw (Linux) 或 Wireshark HCI log 里才能看到。
- 常见情况：
- 普通键（比如
A）：会发 HID Usage ID。 - Fn+1：可能发一个
0xFFxx的厂商自定义 HID 报告，触发固件切换配对通道，系统层面不会显示。
- 普通键（比如
捕获蓝牙键盘发送的原始 HID 报告后可以在已经链接的蓝牙键盘电脑上进行模拟发送hid报告吗
蓝牙配对保存的电脑切换的快捷键能不能修改
大部分蓝牙键盘固件不支持模拟fn切换 需要特定固件支持
通过模拟fn+数字切换设备配对 模拟发送fn+1
捕获键盘发送的原始 HID 报告
捕获蓝牙键盘发送的原始 HID 报告
四、后续：捕获指令后的模拟思路 一旦找到 fn+1 对应的 “蓝牙切换指令包”（如包含特定数据的 ATT Write Request），后续模拟的核心是：用代码向蓝牙适配器发送 “相同的指令包”，实现自动切换。
推荐工具 / 库（.NET WinForm 适用）：
32feet.NET：.NET 平台成熟的蓝牙开发库，支持 BLE / 传统蓝牙的 ATT/HID 协议操作，可直接发送自定义 ATT 指令； Wireshark 数据导出：将捕获到的 “fn+1 指令包” 导出为 “十六进制数据”（右键数据包 → Copy → Hex Stream），再用 32feet.NET 发送该十六进制数据，即可模拟 fn+1 操作。 总结 当前抓包数据仅记录了键盘的 “常规状态上报”，未包含 fn+1 的关键指令。必须重新抓包，并在抓包过程中主动按下 fn+1，才能找到切换蓝牙的核心指令。后续根据指令格式，用蓝牙开发库发送相同指令，即可实现 “自动切换蓝牙” 的需求。
按下fn+1 切换蓝牙键盘后，出来了Rcvd Disconnect Complete 按下fn+1 切换回来的时候，出现了下面的捕获，能模拟发送fn+1吗
1 0.000000 controller host HCI_EVT 7 Rcvd Disconnect Complete
2 18.718880 controller host HCI_EVT 15 Rcvd LE Meta (LE Advertising Report)
3 18.718919 controller host HCI_EVT 15 Rcvd LE Meta (LE Advertising Report)
4 18.718935 controller host HCI_EVT 15 Rcvd LE Meta (LE Advertising Report)
5 18.718948 controller host HCI_EVT 15 Rcvd LE Meta (LE Advertising Report)
6 18.718961 controller host HCI_EVT 15 Rcvd LE Meta (LE Advertising Report)
7 18.718977 controller host HCI_EVT 15 Rcvd LE Meta (LE Advertising Report)
8 18.719943 host controller HCI_CMD 29 Sent LE Create Connection
9 18.721458 controller host HCI_EVT 7 Rcvd Command Status (LE Create Connection)
10 18.724413 controller host HCI_EVT 15 Rcvd LE Meta (LE Advertising Report)
11 18.726424 controller host HCI_EVT 22 Rcvd LE Meta (LE Connection Complete)
12 18.726450 host controller HCI_CMD 6 Sent LE Read Channel Map
13 18.729441 controller host HCI_EVT 14 Rcvd Command Complete (LE Read Channel Map)
14 18.730265 host controller HCI_CMD 32 Sent LE Enable Encryption
15 18.733441 controller host HCI_EVT 7 Rcvd Command Status (LE Enable Encryption)
16 18.785371 controller host HCI_EVT 7 Rcvd Encryption Change
17 18.785409 localhost () db:7c:84:c8:f7:4b () ATT 12 Sent Exchange MTU Request, Client Rx MTU: 527
18 18.800367 controller host HCI_EVT 8 Rcvd Number of Completed Packets
19 18.807148 db:7c:84:c8:f7:4b () localhost () ATT 12 Rcvd Exchange MTU Response, Server Rx MTU: 23
20 18.807436 localhost () db:7c:84:c8:f7:4b () ATT 13 Sent Write Command, Handle: 0x0026 (Unknown)
21 18.807595 localhost () db:7c:84:c8:f7:4b () ATT 13 Sent Write Command, Handle: 0x0026 (Unknown)
22 18.814366 controller host HCI_EVT 8 Rcvd Number of Completed Packets
23 18.815349 controller host HCI_EVT 8 Rcvd Number of Completed Packets
24 18.934506 db:7c:84:c8:f7:4b () localhost () ATT 13 Rcvd Handle Value Notification, Handle: 0x0011 (Unknown)
25 18.935386 db:7c:84:c8:f7:4b () localhost () ATT 31 Rcvd Handle Value Notification, Handle: 0x001b (Unknown)
26 20.412437 db:7c:84:c8:f7:4b () localhost () ATT 20 Rcvd Handle Value Notification, Handle: 0x0017 (Unknown)
27 20.502369 db:7c:84:c8:f7:4b () localhost () ATT 20 Rcvd Handle Value Notification, Handle: 0x0017 (Unknown)
28 20.517293 db:7c:84:c8:f7:4b () localhost () ATT 20 Rcvd Handle Value Notification, Handle: 0x0017 (Unknown)
29 20.524699 db:7c:84:c8:f7:4b () localhost () ATT 20 Rcvd Handle Value Notification, Handle: 0x0017 (Unknown)
30 20.539690 db:7c:84:c8:f7:4b () localhost () ATT 20 Rcvd Handle Value Notification, Handle: 0x0017 (Unknown)
31 20.547201 db:7c:84:c8:f7:4b () localhost () ATT 20 Rcvd Handle Value Notification, Handle: 0x0017 (Unknown)
32 20.555044 db:7c:84:c8:f7:4b () localhost () ATT 20 Rcvd Handle Value Notification, Handle: 0x0017 (Unknown)
1 0.000000 host controller HCI_CMD 5 Sent Write Simple Pairing Debug Mode
2 0.001962 controller host HCI_EVT 7 Rcvd Command Complete (Write Simple Pairing Debug Mode)
3 2.720741 controller host HCI_EVT 7 Rcvd Disconnect Complete
Frame 1: 5 bytes on wire (40 bits), 5 bytes captured (40 bits) on interface TCP@127.0.0.1:24352, id 0
Bluetooth
Bluetooth HCI H4
Bluetooth HCI Command - Write Simple Pairing Debug Mode
Frame 1: 5 bytes on wire (40 bits), 5 bytes captured (40 bits) on interface TCP@127.0.0.1:24352, id 0
Bluetooth
Bluetooth HCI H4
Bluetooth HCI Command - Write Simple Pairing Debug Mode
18 301.419094 controller host HCI_EVT 15 Rcvd LE Meta (LE Advertising Report)
19 301.419128 controller host HCI_EVT 15 Rcvd LE Meta (LE Advertising Report)
20 301.419138 controller host HCI_EVT 15 Rcvd LE Meta (LE Advertising Report)
21 301.419146 controller host HCI_EVT 15 Rcvd LE Meta (LE Advertising Report)
22 301.419151 controller host HCI_EVT 15 Rcvd LE Meta (LE Advertising Report)
23 301.420466 host controller HCI_CMD 29 Sent LE Create Connection
24 301.434496 controller host HCI_EVT 15 Rcvd LE Meta (LE Advertising Report)
25 301.434548 controller host HCI_EVT 7 Rcvd Command Status (LE Create Connection)
26 301.434574 controller host HCI_EVT 15 Rcvd LE Meta (LE Advertising Report)
27 301.434639 controller host HCI_EVT 22 Rcvd LE Meta (LE Connection Complete)
28 301.434683 host controller HCI_CMD 6 Sent LE Read Channel Map
29 301.437091 controller host HCI_EVT 14 Rcvd Command Complete (LE Read Channel Map)
30 301.437753 host controller HCI_CMD 32 Sent LE Enable Encryption
31 301.441006 controller host HCI_EVT 7 Rcvd Command Status (LE Enable Encryption)
32 301.479145 controller host HCI_EVT 7 Rcvd Encryption Change
33 301.479201 localhost () db:7c:84:c8:f7:4b () ATT 12 Sent Exchange MTU Request, Client Rx MTU: 527
34 301.486017 controller host HCI_EVT 8 Rcvd Number of Completed Packets
35 301.493422 db:7c:84:c8:f7:4b () localhost () ATT 12 Rcvd Exchange MTU Response, Server Rx MTU: 23
36 301.496228 localhost () db:7c:84:c8:f7:4b () ATT 13 Sent Write Command, Handle: 0x0026 (Unknown)
37 301.501061 localhost () db:7c:84:c8:f7:4b () ATT 13 Sent Write Command, Handle: 0x0026 (Unknown)
38 301.501252 controller host HCI_EVT 8 Rcvd Number of Completed Packets
39 301.509011 controller host HCI_EVT 8 Rcvd Number of Completed Packets
40 301.628251 db:7c:84:c8:f7:4b () localhost () ATT 13 Rcvd Handle Value Notification, Handle: 0x0011 (Unknown)
41 301.629067 db:7c:84:c8:f7:4b () localhost () ATT 31 Rcvd Handle Value Notification, Handle: 0x001b (Unknown)
Frame 1: 20 bytes on wire (160 bits), 20 bytes captured (160 bits) on interface TCP@127.0.0.1:24352, id 0
Section number: 1
Interface id: 0 (TCP@127.0.0.1:24352)
Interface name: TCP@127.0.0.1:24352
Encapsulation type: Bluetooth H4 with linux header (99)
Arrival Time: Sep 15, 2025 14:46:32.673395000 中国标准时间
UTC Arrival Time: Sep 15, 2025 06:46:32.673395000 UTC
Epoch Arrival Time: 1757918792.673395000
[Time shift for this packet: 0.000000000 seconds]
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 20 bytes (160 bits)
Capture Length: 20 bytes (160 bits)
[Frame is marked: False]
[Frame is ignored: False]
Point-to-Point Direction: Received (1)
[Protocols in frame: bluetooth:hci_h4:bthci_acl:btl2cap:btatt]
Bluetooth
[Source: 00:00:00_00:00:00 (00:00:00:00:00:00)]
[Destination: 00:00:00_00:00:00 (00:00:00:00:00:00)]
Bluetooth HCI ACL Packet
.... 0000 0001 0000 = Connection Handle: 0x010
..10 .... .... .... = PB Flag: First Automatically Flushable Packet (2)
00.. .... .... .... = BC Flag: Point-To-Point (0)
Data Total Length: 15
Data
[Expert Info (Error/Protocol): Frame is out of any "connection handle" session]
[Frame is out of any "connection handle" session]
[Severity level: Error]
[Group: Protocol]
[Source BD_ADDR: 00:00:00_00:00:00 (00:00:00:00:00:00)]
[Source Device Name: ]
[Source Role: Unknown (0)]
[Destination BD_ADDR: 00:00:00_00:00:00 (00:00:00:00:00:00)]
[Destination Device Name: ]
[Destination Role: Unknown (0)]
[Current Mode: Unknown (-1)]
Bluetooth L2CAP Protocol
Length: 11
CID: Attribute Protocol (0x0004)
Bluetooth Attribute Protocol
Opcode: Handle Value Notification (0x1b)
0... .... = Authentication Signature: False
.0.. .... = Command: False
..01 1011 = Method: Handle Value Notification (0x1b)
Handle: 0x0017 (Unknown)
Value: 0800000000000000
