📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Target Specific - General  >>  Linux RCE USB

Topic created on: November 22, 2009 03:44 CST by RobinV .

Hello all,

I am working on a RCEing Project with servial USB Devices I've got.
However now I RCE the software to figure out how the software works. I'd love to see an USB-Sniffer for Linux.
I am known with USB Snoopy, but I want something like this in Linux. I googled a lot. And I figured there isnt one yet. So, I turned to libusb..

Is there somebody who tried/finished a libusb based sniffer? I did look in the API and I think it should be possible.

However then I realised.. USB is a serial connection.
So I tried to use "slsnif - Serial line sniffer" then I realised..  Whats the Baudrate of USB? =S

So, any advice how to sniff USB?
Serial Sniffer or should I spend time on trying to get something with libusb to work? If so a pseudo would be great as I might/will most certainly forget somethings.. ;)

  dimaky     November 22, 2009 11:37.50 CST
Does wireshark not work for you http://wiki.wireshark.org/CaptureSetup/USB?

  RobinV     November 22, 2009 23:52.58 CST
Nope however I do feel stupid now..
I'll fiddle around with Wireshark for a bit and I might be able to extract some data..

Thanks for pointing at my stupidity.. =)

  trufae   November 23, 2009 04:28.29 CST
There's also the libusbsniff LD_PRELOAD module in radare[1] I develop it to reverse engineer the Nokia Internet Tablets flasher.

It obviously depends on libusb and ld.so, so your binary should not be statically linked.

BTW, an USB is not a serial port so, slfoo will not work, in USB you basically have bulk and normal writes, normal ones are for commands and bulks are for huge data transfers (contents/data)

  RobinV     November 23, 2009 07:22.17 CST
I don't think radare will do the trick. As its PE's I am RCEing ;)

  trufae   November 23, 2009 11:25.43 CST
Are you running PE's on Linux? wtf? why are you looking for a linux usb sniffer if you are reversing a w32 binary? There are several usb sniffers for w32.

  RobinV     November 24, 2009 02:13.23 CST
I am indeed running the PE in Linux using WINE ;) I just don't want to reboot (a) and install Windows :)

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit