1

I have a black box device with three LED's that can be turned on and off, and an also black box application that has six buttons that turn each individual LED on and off. I don't know the source code for the application, not what input does the "traffic light" expect.

I really want to find out that inputs are sent to the device so that I can control it on my own, preferably without disassembling the device in question :)

I tried to install Wireshark with USBPcap, and managed to capture what happens when buttons are pressed, but the logs are confusing and overwhelming. Can someone please recommend a direction of attack?

Improve this question
1
  • Learn about the USB protocol to separate control bytes from the payload; possibly write a wireshark dissector to dump/analyze the payload. Not an easy or fast route to go. Probably more rewarding: use a disassembler like IDA on the application, and check what happens between the button presses and sending stuff to USB. However, if you want to write a program to control the device yourself, you'll probably have to do some of the status stuff as well, so you really need to learn more about how USB works.
    – Guntram Blohm
    Dec 14, 2016 at 17:10

1 Answer 1

Reset to default
1

The way I see it, you have three options :

  1. Debug & Disassemble the application in order to figure out which function does what, then locate the exchange protocol and packets format. Hopefully, you'll be able to find something that looks like a payload/command. This will take a lot of time and efforts, especially if the application has been through compiler optimizations or obfuscation.
  2. Sniff out the USB traffic - which you already did - and reverse the payload format after identifying what data fields belong to the USB transfer protocol and which don't. This link provides everything you need to know about USB protocols.
  3. Invest in a logic analyzer. It's a miracle machine that can help reverse almost any protocol. If you look at the price range it's quite high for very efficient and professional machines (example), but you can build your own using an Arduino or even get a software based one. You also have OpenVizsla which is an open source FPGA based USB logic analyzer/sniffer. Or, you can buy a Beagle USB, quite pricey but worth it.

If you go for solution 2, you'll have to separate the signal in time. By that I mean :

  • At t0 : Reset the device
  • At t1 : Set the light to RED and sniff
  • At t2 : Reset the device
  • At t3 : Set the light to GREEN and sniff So on a so forth ...

This way you can have time-stamped data which can help you remove the redundant data and only keep the core values (the payload).

Hope this helps.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.