16

How can I monitor a usb dongle's traffic? I would like to see how a program and its usb dongle talk to each other, if it is possible replay this traffic?

Since I am new to this type of thing, any tutorial or tool suggestion is welcome.

  • 1
    Are you asking for a specific operating system (Windows, Linux, etc)? If so, you should add that platform as a tag. – amccormack Apr 15 '13 at 18:42
  • I don't think this merits a full-on answer, but Wireshark also supports snooping USB on the linux side, just for reference. – RobotHumans Apr 15 '13 at 20:54
17

It depends on what your budget is like. The best USB analyzers are hardware devices with good protocol dissectors. If you have a huge budget you can go with the various solutions from LeCroy such as the LeCroy Voyager M3i. If you have a decent size budget and you only need USB 2.0, I would go for the Ellisys USB Explorer 200. If you want to replay and change packets you can take a look at the Ellisys USB Explorer 260 as I don't think the 200 is capable of replay. If you need USB 3.0 I would go with the Ellisys USB Explorer 280. On the budget hardware side you have the Beagle 480 and even more budget the Beagle 12.

If you're on a budget you can go with a software solution such as USBSpy, USBLyzer, BusTrace or USBSnoop.

There's also the more DIY solution which involves running the process you want to monitor in a virtual machine such as VirtualBox and then routing the traffic which goes through the USB ports to your own dissector. You can use Wireshark as a dissector for VM USB traffic.

Personally I would go with the Ellisys Explorer 200 or 260. Either one presents a good compromise between price and quality depending on your needs.

  • What are the downsides of the software solutions? – Cybergibbons Apr 15 '13 at 21:49
  • 2
    IMO the main weakness of a software solution is the inability of it to tap a connection where you don't control one party, perhaps both the host and the client are embedded systems. If you run a pure driver without a VM what you see is not guaranteed to be the data actually being sent, for instance invalid transactions can get dropped. With a VM this is not an issue. With hardware you know that what you're looking at is what's actually being sent. This can also be bad since you may want your data to be sequential and proper the way the software sent it, not how it was actually transmitted. – Peter Andersson Apr 16 '13 at 15:57
9

In addition to Peter Andersson's list of tools, you may also want to consider USBTrace and Bus Hound.

7

Tho maybe not directly what you are looking for I'd just like to add one item to Peter Andersson's thorough answer. Travis Goodspeed's facedancer (some more recent info ). Its design is also open source.

Facedancer Board, a tool for implementing USB devices in host-side Python using the GoodFET framework. Access to the USB chip is extremely low-level, so protocols may be mis-implemented in all sorts of creative ways. This allows a clever neighbor to quickly find and exploit USB driver vulnerabilities from the comfort of a modern workstation, only later porting such exploits to run standalone.

It can be used for sniffing too. I couldn't immediately find a link to buy one Pre assembled boards are not yet available, but you can buy the circuit boards here, also Travis is, as he likes to say, a good neighbor and gives them away at conferences. Anyway, it should be pretty cheap option if you can assemble it yourself.

  • > "It can be used for sniffing too." This is wrong. The FaceDancer can NOT sniff USB packets sent between a host and a device. What the FaceDancer can sniff is only firmware that is uploaded from a host to a USB device. Listen that MP3 here: risky.biz/facedancer – Elmue May 25 '16 at 21:49
7

If you aren't afraid to get your hands dirty, on Windows you could always write a filter driver on top of or below the device object for the dongle. The IoAttachDevice() function and the three other functions starting with that name are your friend. The advantage of that is to have a complete in-software solution for the problem without the expenses involved with hardware sniffers. You'll notice that this is actually what the USBpcap project does in USBPcapFilterManager.c. So if you are merely writing this for research, this would be a good starting point, unless the GPL is too restrictive for you.

There is a potential downside with in-software solutions. A filter driver will only see what the other drivers want it to see. Keep in mind that in Windows kernel mode all drivers have the same privileges. Even attaching to the root hub may not always yield meaningful results. So if one driver decides to do funny things such as stealing entry points (IRP major function codes) to proactively counter filtering or debugging of any kind, it becomes an arms race. Otherwise it will be the cheapest solution you can get, given you only need this to work on a particular OS.

However, if I was you I'd first sniff the user mode traffic between the library (hook DeviceIoControl, ReadFile, WriteFile et al, or their native counterparts) and the driver or the library and the application that requires the dongle. Of course if the dongle poses as a HID device you'd have to look for the respective IOCTLs and decode them or hook the HID functions directly. This is the method I was using to investigate the traffic sent between a sports watch with USB connectivity and my box. I based it on PaiMai and pydbg, because the application wasn't guarding against being debugged. If yours does, you may have to cheat a little to "convince" the application to play nicely IDAStealth provided a few good pointers (link is dead as of May 2016) how to go about.

  • > "Write a filter driver." Supposed you have experience in writing drivers an much spare time! – Elmue May 25 '16 at 21:52
  • @Elmue writing a filter driver isn't quite as difficult anymore as it used to be. Windows 10 even abolished legacy file system filters, for example; in favor of the simpler mini-FSFD. Similar things can be said about other filter driver types. But yeah, kernel mode development on Windows is quite different, even though managers typically don't understand or care about the distinction and why it matters. Stability issues typically ensue as a consequence. – 0xC0000022L Nov 22 '18 at 20:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.