Flag: Tornado! Hurricane!

 Forums >>  Target Specific - General  >>  Linux RCE USB

Topic created on: November 22, 2009 03:44 CST by RobinV .

Hello all,

I am working on a RCEing Project with servial USB Devices I've got.
However now I RCE the software to figure out how the software works. I'd love to see an USB-Sniffer for Linux.
I am known with USB Snoopy, but I want something like this in Linux. I googled a lot. And I figured there isnt one yet. So, I turned to libusb..

Is there somebody who tried/finished a libusb based sniffer? I did look in the API and I think it should be possible.

However then I realised.. USB is a serial connection.
So I tried to use "slsnif - Serial line sniffer" then I realised..  Whats the Baudrate of USB? =S

So, any advice how to sniff USB?
Serial Sniffer or should I spend time on trying to get something with libusb to work? If so a pseudo would be great as I might/will most certainly forget somethings.. ;)

  dimaky     November 22, 2009 11:37.50 CST
Does wireshark not work for you http://wiki.wireshark.org/CaptureSetup/USB?

  RobinV     November 22, 2009 23:52.58 CST
Nope however I do feel stupid now..
I'll fiddle around with Wireshark for a bit and I might be able to extract some data..

Thanks for pointing at my stupidity.. =)

  trufae   November 23, 2009 04:28.29 CST
There's also the libusbsniff LD_PRELOAD module in radare[1] I develop it to reverse engineer the Nokia Internet Tablets flasher.

It obviously depends on libusb and ld.so, so your binary should not be statically linked.

BTW, an USB is not a serial port so, slfoo will not work, in USB you basically have bulk and normal writes, normal ones are for commands and bulks are for huge data transfers (contents/data)

  RobinV     November 23, 2009 07:22.17 CST
I don't think radare will do the trick. As its PE's I am RCEing ;)

  trufae   November 23, 2009 11:25.43 CST
Are you running PE's on Linux? wtf? why are you looking for a linux usb sniffer if you are reversing a w32 binary? There are several usb sniffers for w32.

  RobinV     November 24, 2009 02:13.23 CST
I am indeed running the PE in Linux using WINE ;) I just don't want to reboot (a) and install Windows :)

Note: Registration is required to post to the forums.

Active in Last 5 Minutes
NirIzr
Invisible

There are 28,225 total registered users.


Recently Created Topics
Reverse Engineering ...
Jan/23
Career: DoD Agency I...
Jan/22
"Disappearing&q...
Jan/17
Career: Software Sec...
Jan/11
Where is the call st...
Jan/07
IDA Pro 6.1 Breakpoi...
Jan/01
How to create data s...
Dec/30
can i search all mod...
Dec/23
IDA symbol table exp...
Dec/20
An anti-attach trick
Dec/17


Recent Forum Posts
Reverse Engineering ...
NirIzr
"Disappearing&q...
NirIzr
Reverse Engineering ...
charlie
"Disappearing&q...
charlie
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
Looking for value in...
NirIzr


Recent Blog Entries
cmathieu
Feb/07
Hacker Carnival

waleedassar
Feb/06
OllyDbg v1.10 And Hardware ...

waleedassar
Jan/31
Yet Another Anti-Debug Trick

RolfRolles
Jan/22
Finding Bugs in VMs with a ...

waleedassar
Jan/13
An OllyDbg Bug Disables Sof...

More ...


Recent Blog Comments
waleedassar on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/05
Yet Another Anti-Debug Trick

trolotou on:
Feb/05
Doudoune Moncler -Pennies F...

waleedassar on:
Feb/01
Yet Another Anti-Debug Trick

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit