To reverse engineer protocols of proprietary (flashing) USB devices one needs to obtain traces of the communication between the vendor application and the device. Below is a list of possible methods to do so.
- 1 usbmon - The Linux way
- 2 Capturing virtualized applications
- 3 USBPcap - Windows
- 4 Hardware
- 5 Support Software
- 6 See also
usbmon - The Linux way
Capturing native Linux applications
Be sure to load the usbmon kernel module with
Then you should be able to select a USB bus (sic!) number in Wireshark (it it runs as root).
Capturing virtualized applications
Most probably the proprietary device comes with a proprietary application running on a proprietary OS like Windows or OSX. By using a virtual machine we can nevertheless do the capturing and dissecting in any host OS.
Using usbmon to capture the guest OS traffic
The only difference to native usbmon is that the virtual machine must support forwarding USB ports and traffic into the virtualized operating system in a way that usbmon can cope with. Alternatively one can try to use the Windows approach explained below with USBPcap to capture the traffic inside the guest OS.
A detailed Howto can be found at the tutorial page of vusb-analyzer. Essentially one has to edit the .vmx file while the VM is stopped and add the following options:
monitor = "debug" usb.analyzer.enable = TRUE usb.analyzer.maxLine = <number of 16-byte lines to capture per packet (default is 80)>
After powering on or resuming the VM, you should start to see USBIO log lines in vmware.log. There is a ruby script that converts this to Wireshark's pcap format.
USBPcap - Windows
On Windows hosts one can use USBPcap to capture USB traffic natively.
Wireshark supports dissecting USBPcap capture files since version 1.10.
bb_usb_sniffer - Using a BeagleBoard-xM as MITM
Another interesting way is to use an embedded Linux computer between the device and the host. This approach has been implemented using a BeagleBoard-xM .
In some situations it might be useful to capture the signals in a more direct way, for example if the USB signals are routed on a PCB only. If you manage to capture them successfully with a logic analyzer you can use sigrok to help analyzing the result.
Apart from the mighty Wireshark there is a number of other software packages that might help you analyzing:
- vusb-analyzer is able to visualize and decode usbmon, VMware and Ellisys logs.
- pyusb is a libusb wrapper which could be used for sophisticated replay attacks or live decoding.