Setting an USB Emulation and Fuzzing Platform?

Question

I would like to analyze (and fuzz) a USB device and I need a bit of guidance to setup a full platform to discuss with the device.

First, I would like to know what are the most used hardware cards to emulate and perform fuzzing on USB devices. I've heard about the FaceDancer11 card with a Python API (see a few blog posts [1,2] from Travis Goodspeed). But, are they others ?

Also, if someone could come with a list of the needed hardware devices and, maybe, some existing Python libraries that are useful to have and, what development effort is needed to setup such a platform, it would be helpful.

Answer 1

Apart from the FaceDancer from Goodspeed, I have never been able to find anything similar. I personally use the FaceDancer[11 & 21] and now I built my own emulator (not that easy if your electronics skills are rusty). But depending on the kind of analysis you want to perform you could find different other types of hardware, or software for that matter.

For sniffing I suppose OpenVizsla is a great tool (Free & Open). Thought it is not available for sale yet, you can implement it yourself on an FPGA & try it. You also have the Beagle from Total Phase which is quite expensive thought.

Answer 2

Page 4 of https://www.nccgroup.com/media/190706/usb_driver_vulnerabilities_whitepaper_january_2013.pdf gives a good introduction to setting up a USB-fuzzing test platform.

Testing USB drivers on host machines is not a straightforward process, because you either need to emulate a USB device or proxy the traffic between a device and the host. As a result of how the protocol works it would be extremely difficult to convert a USB host e.g. a PC into a USB device and therefore, if you are not modifying the traffic en-route via some kind of hooking or proxy solution, you need to use a hardware-based approach. This section details the various different approaches to testing USB hosts and compares the relative merits of each...