9 comments
  Email this

Posted on Monday, October 16th, 2006 21:19:45 GMT by: quietearth
Posted under: linux usb snoop

This is intended to be a howto to debug usb transactions under linux, or simply to reverse engineer propietary usb stuff.

If you need to reverse engineer a windows only usb driver, you can do it easily using vmware. We can snoop the usb traffic from windows using usbmon which is part of the linux kernel since version 2.6.11 (I think). Previous to that you had to use patches.

1. Compile and install the kernel
First off we need to compile the "Debug filesystem" and the usbmon module into the kernel. Under your source directory, run:
# make menuconfig

Enable the debug filesystem which is located under Kernel hacking -> Kernel Debugging. Unfortunately this cannot be compiled as a module.

Then enable usb monitoring under Device Drivers -> USB support. It should be around the USB Multimedia adapters or before port drivers.

You will then need to compile the newly configured kernel and install it. This will be distribution dependent, so consult your documentation. If you are looking for instructions for ubuntu, you can read my post about it here.

2. Setup
Once you're booted into your new kernel, we need to mount the debug filesystem and load usbmon (which should be a module):
# mount -t debugfs none_debugs /sys/kernel/debug
# modprobe usbmon
# ls -l /sys/kernel/debug
total 0
-rw------- 1 root root 0 2006-10-16 12:53 1s
-rw------- 1 root root 0 2006-10-16 12:53 1t
-rw------- 1 root root 0 2006-10-16 12:53 2s
-rw------- 1 root root 0 2006-10-16 12:53 2t

You should already have vmware setup with your necessary version of windows installed. At this point we can use the usbmon package (note the package name is the same as the kernel module, but not the same thing) which makes reading the debug output much easier, or you could read the usbmon documentation located in Docuemtation/usb/usbmon.txt in the linux kernel source.

I'm going to use the usbmon package (0.4) so let's grab it from http://people.redhat.com/zaitcev/linux/. This is a java program, and I couldn't use the pre-installed blackdown java on ubuntu, I had to grab the Sun jre and jdk from the repositories. To compile you will probably need to modify the USBMon Makefile to change the JAVAC (java compiler) location. Run make and you should be able to start it up with "java USBMon". Let's leave this for later as it will need to be loaded after we've inserted our device.

3. Execution
Startup vmware and boot your windows virtual machine, once loaded make sure you have loaded the device driver and software for the usb thing you wish to watch. Insert the usb device, both windows and linux should recognize the device, and it should function fine without any special modifications required. Now we can load up the java USBMon program and find our usb device, it will be listed under whatever usb bus # you plugged it into. It might be listed as "generic" or something else which is non-intuitive, so you can take a look at /proc/bus/usb/devices to help out.

Once you've found the device in USBMon, set the primary control pipe and all the interfaces under the Configuration tab to "Full Data Monitoring", then go ahead and run a transaction to it under windows. To see the data, go to the Endpoints tab and under whatever Endpoint Data section, just click on "Data not shown" and it will open a new window with a text/hex/binary dump of the data.

At this point I would reccomend doing one transaction to your device at a time, then looking at the debug output to figure out how it works. The USBMon interface leaves a lot to be desired, so if anyone knows of any better program, please post a comment here.

Then again it might just be easier to do it by hand as described in the kernel documentation.

UPDATE: 10/17/06
I got linked off Make, woohoo! Make rules, it's one of the few sites I read. Thanks to all who visited, and special thanks to Pete for the update on the impending binary api goodness..

Related articles

Hacking linux binaries

Posted on Wednesday, June 6th, 2007 18:54:05 GMT by: quietearth |   0 comments

Printing labels in linux

Posted on Wednesday, August 23rd, 2006 20:29:52 GMT by: quietearth |   0 comments

Zelda Classic on linux

Posted on Friday, August 25th, 2006 22:46:31 GMT by: quietearth |   1 comment

Nokia 770: How to upgrade in Linux

Posted on Sunday, August 27th, 2006 5:01:18 GMT by: quietearth |   0 comments

D-LINK DI-524 Firmware upgrade in linux

Posted on Wednesday, September 6th, 2006 22:25:34 GMT by: quietearth |   0 comments