Hot answers tagged

7

Expensive commercial solutions: Beagle (400€), Ellisys (800 - 3200€), MQP, International Test Instruments (600€), Teledyne Lecroy (1000€), USBeee (1000 - 2000€). Cheapest commercial solution I found : Keelog Morphstick, 125€, which is within your budget. DIY solutions: https://github.com/matlo/serialusb USB device -> USB cable -> Sniffing PC -> USB cable -...


6

I will answer not what you asked in the title but what you actually need. There's around 99% probability it's a 8051 derivative. I don't know a single Chinese USB controller which does not use one. Although I haven't seen them all, of course. I downloaded a random MPTOOL for this controller from flashboot.ru and it had some binaries. They do look like 8051 ...


6

It doesn't quite meet your price limitation, but since nobody else had jumped in, it is probably worth mentioning: I've used various versions of the Teledyne LeCroy USB Protocol Analyzers, and they would meet your needs from a capture and download/analyze perspective. I've seen used versions of the older "CATC USB Chief" but they are still about 2x of your ...


4

my understanding of USB is very low at best (even if I do develop some simple USB devices for a living) so read this with major prejudice... Your driver class and configuration must match the USB (mouse) device I do not know how your USB mouse is programmed but interface must be the same (CDC class can have more interfaces) and if not match then the USB ...


4

Another Hardware Packet Sniffer for USB is the ezSniffer ($79) 1. It works with Full Speed and High Speed devices and there's a Python example for analysis.


3

Standard USB protocol for firmware upgrade is DFU. Linux has 2 tools to work with DFU devices: dfutool dfu-util dfu-util is more advanced and for example allows to list connected DFU-capable devices, e.g. when run on my laptop: # dfu-util -l dfu-util 0.5 [...] Found Runtime: [0a5c:21e6] devnum=0, cfg=1, intf=3, alt=0, name="UNDEFINED" Both of the tools ...


3

Since it uses HID class, you should probably check the USB HID Spec from USB.org. The relevant part seems to be the section 8, "Report Protocol": 8.1 Report Types Reports contain data from one or more items. Data transfers are sent from the device to the host through the Interrupt In pipe in the form of reports. Reports may also be requested (polled) ...


3

This appears to be a fixed-point (rather than a floating-point) format. If you treat the 64-bit values as signed integers and divide by 4398046511104.0, you will get the decimal values you show. e.g. the following will print -9999 #include <iostream> #include <cstdint> int main() { int64_t x = 0xFF63C40000000000LL; double y = x / ...


2

I don't think that there is a "one size fits all" kind of firmware extraction from the drive which will work with any drive. Otherwise firmware updating could have a standard interface across all makers. I am not even sure that many drives will support this feature, since customers do not REALLY need it and developers should have access to the binaries/...


2

Page 4 of https://www.nccgroup.com/media/190706/usb_driver_vulnerabilities_whitepaper_january_2013.pdf gives a good introduction to setting up a USB-fuzzing test platform. Testing USB drivers on host machines is not a straightforward process, because you either need to emulate a USB device or proxy the traffic between a device and the host. As a ...


2

Apart from the FaceDancer from Goodspeed, I have never been able to find anything similar. I personally use the FaceDancer[11 & 21] and now I built my own emulator (not that easy if your electronics skills are rusty). But depending on the kind of analysis you want to perform you could find different other types of hardware, or software for that matter. ...


2

It is unlikely that you will be able to get any information about the device via the USB port. Most likely, that would just provide access to either a memory card or read/write flash memory. What you probably want to do is open up the device and look for any ROM of flash memory soldered directly to the board. You may have some luck with something like an ...


2

The only way to know whether you can or cannot use the USB port to have access to the device is by probing the Data pins and trying to sniff any traffic. A USB connector is composed of 4 pins : USB Vcc (+5V), USB Data-, USB Data+, and GND. If the device is using the Data+ & Data- pins, then you're in business, something must be going on which should ...


2

Older Nokia phones use a serial (db-9) cable so if this cable supports flashing it likely includes a usb to serial converter (eg ftdi chip)


2

If it's really a NAND flash chip conforming to ONFI standard and if you have an universal programmer, it should be possible to read its ID. www.onfi.org/~/media/onfi/specs/onfi_2_1_gold.pdf — refer to section 5.5 "Read ID Definition" Also, your programmer may prompt you to specify what kind of NAND chip you're trying to read in order to determine its ...


2

Well, your question is a bit broad as it stands, but let's take it one by one. Typically (but not always) drivers for printers these days are user mode drivers (UMDF), which means you're looking for a DLL. If that were not the case you'd be looking for a .sys file of some kind. Microsoft has come up with a number of "simplified" driver models over the years....


2

Reverse Engineering has always been about finding the right place to start. There are two common options here: Prevent activation checks For activation purposes, its most likely the best way to search for references to a string related to activation. In this particular case, I would use a decent decompiler like BinaryNinja, IDA or radare2 to find references ...


2

It is a bit unclear what do you mean by "library being called". If you want to know when the library is loaded, you may look for references to System.loadLibrary(string) or System.load(string) java functions. You might for example hook it using Frida. If you want to see when particular functions exported by the libusbhost.so are called, you also ...


1

Almost any Arduino is capable of USB communication (at least low speed). There is difference if you need software (for example V-USB) or it has hardware support. Unless your board has dedicated USB output (which usually also mean hardware support) you also need to make required connector to USB cable (watch for appropriate signal voltage level (3.3 V)). And ...


1

I was looking for the same thing and I recently found www.rockbox.org, an open source firmware for audio players. Their idea is the owners would capable to customize that firmware and make it more functional in some cases. Always is good enough to learn something and in the way have some fun too...


1

You should read about USB HID devices. Also you need a USB sniffer to capture the traffic and see how the fight stick encodes key press events. After you understand how the USB data exchange is done, you'll need to reverse engineer the driver code. But I would start from learning how to implement USB HID driver from WDK examples first, so that you know what ...


1

Sorry that I do not have enough reps to comment. So writing this as an answer instead. The answers to these two questions seem to be be relevant to what you are asking as well. Have a look at them : How do I extract a copy of an unknown firmware from a hardware device? How to dump flash memory with SPI? (I know its SPI but some of the answers still could ...


1

Answers to this question deal with generic reversing of USB devices, but if you want to start from the driver files, find the printer in Device Manager, go to properties, then Driver tab-Driver details... to see the driver files. MSDN topics on printer driver development or WDK samples may be useful too.


1

I am more familiar with linux but some steps are similar. To find where is your driver, I believe that if you plug your device and go in the Device Manager, click right on the device then properties, you can find the path to the driver. To reverse engineer the protocol, you can use a combination of driver disassembly (using radare, IDA or other tools) and ...


1

Reversing a USB protocol can be a daunting task but some tools can provide a lot of help. Wireshark understands the USB protocol and can help you make sense of some capture. I have only used on it Linux but the wiki provides instructions for Windows too. I suggest you always run Windows XP in the VM and capture on the host, it usually makes thing easier. You ...


1

You should check this talk at BlackHat 2014 and this one from Bunnie & Xobs at 30CCC. I could go about some details but it's so vast, it is meaningless to try to explain the details of reversing a chip here. Decapping can be helpful if you're willing to probe the IC using needles and an oscilloscope and reverse engineer a protocol or extract data; or ...


1

Igor certainly knows six or seven orders of magnitude more on this subject than me, but it seems to me that if you're trying to get at the flash chip, not the USB controller, you probably won't get that from the VID/PID. I am probably wrong, bc Igor, and bc I'm unfamiliar with USB Flash Drive designs. But if I'm right, and if it is an SPI chip, you can ...


1

The site flashboot.ru collects various utilities for working with USB flash drives, including identification tools which can detect the vendor and device ID of the device, and in some cases even the exact flash chip: http://flashboot.ru/files/vidpid/


1

The way I see it, you have three options : Debug & Disassemble the application in order to figure out which function does what, then locate the exchange protocol and packets format. Hopefully, you'll be able to find something that looks like a payload/command. This will take a lot of time and efforts, especially if the application has been through ...


1

If there is any chip inside the cable, it will use the 5v line as power supply. So, you have to measure resistance from gnd to 5v and compare it with another cable. Usually, the resistance is so high it's undetectable by a normal tester, and this also means there's nothing more than wire and plastic inside (for sure in any normal device). Also, make sure to ...


Only top voted, non community-wiki answers of a minimum length are eligible