Live data from Hacker News

USB Reverse Engineering: Down the Rabbit Hole

devalias.net

41–48 of 48 posts

Re: USB Reverse Engineering: Down the Rabbit Hole

#41
post #35
post #32

I see so much custom hardware. Can somebody tell me why running the drivers of interest in a virtualbox/qemu image, and logging interaction on the host OS, doesn't do a better job than custom hardware?

Is that possible? I thought vbox et al enabled USB communication by allowing the guest OS drivers to hit the hardware directly.

Maybe you need Linux for the host OS, that not everybody already has. It might be like KVM switches, that nobody using Linux would ever feel like they needed.

Re: USB Reverse Engineering: Down the Rabbit Hole

#42
post #28

Earlier quoted context omitted.

Reminds me of some popular headphones (I forget the name) that had two models. One was the standard model and one was the pro model. Someone went to repair their headphones and found that the only difference between the two models was some extra foam that was installed to distort the sound bit in the standard model... I wish I could remember who that was.

It was Sennheiser headphones: https://news.ycombinator.com/item?id=2214158

Thank you!

Re: USB Reverse Engineering: Down the Rabbit Hole

#43

Earlier quoted context omitted.

This is an option I hadn't thought of, but the typical end user won't want to do this or know how as it's a gaming peripheral. I can't be more specific as there are some legal barriers I'm sorting out right now.

If it's an input device for Windows games, without revealing the device, why does it have to go through the USB stack? Basically all games on Windows use DirectX, specifically its DirectInput libraries. (It's been a while, so they've probably been renamed, but the point remains that USB isn't necessary for all input devices, though it is up the application as to what it'll take.) Many emulators are more flexible; mig…

Because the software controller uses Windows system calls (SetupAPI & DeviceIoControl()) and not DirectInput. Can't do it in hardware for the reasons I mentioned in the op.

Re: USB Reverse Engineering: Down the Rabbit Hole

#44
post #26

> I won't get deep on describing all of the facts, since that's what Wikipedia is good at Sigh. So many links, so much reading, and not one to the USB spec (that I found by skimming and searching). It's not just this article, but seemingly every 'deep dive does it'. Why do people read everything on the Internet, no matter the source and quality, but skip (what is usually) the best, most important source?

To be fair, specs and standards generally aren't written as introductions, so they're kind of hard to make sense of when starting from zero. USB, with its infernal descriptors and endpoints, benefits mightily from third-party explanations.

Definitely agree here. I tend to like to get the gist of things/cliffnotes from people that have already broken it down, and then deep dive into the spec if I need to know some explicit detail.

Most of the time when I want to hack on something, a super high level abstraction is more than sufficient for my needs (eg. don't need to understand the inner workings of a CPU if all I need is an API). But then there are those times when the spec, in all it's verbose rawness, is the perfect tool for the job.

Re: USB Reverse Engineering: Down the Rabbit Hole

#45
post #32

I see so much custom hardware. Can somebody tell me why running the drivers of interest in a virtualbox/qemu image, and logging interaction on the host OS, doesn't do a better job than custom hardware?

Depending on your needs, you absolutely can do it in software. The first few steps are about software, and in particular, probably just using Wireshark + USBPcap or usbmon is sufficient for basic cases.

The hardware side of things is the area that interests me more though, if you want to get into higher speeds than can be handled in software only, or if you want to start doing weird/interesting things in the 'emulate' side of it (not just capturing (eg. facedancer). Coming from a security perspective, those sorts of tools are invaluable for getting to some of the depths that I may want to reach.

Re: USB Reverse Engineering: Down the Rabbit Hole

#46

Earlier quoted context omitted.

You might be thinking of the Rigol DS1054Z digital oscilloscope. It's pretty popular with hobbyists because it's an inexpensive entry-level scope that can easily be "unlocked" to act like a much more expensive model, including better-than-advertised bandwidth.

I heard the difference might be because testing determines lesser quality builds which then are limited in software to meet the respective specs within a broad error margin. The unlocked ones might work and display but you loose all guarantees on precision. This process is called binning, and is done with many electronic parts, most famously cpus that are binned according to energy efficiency, clock frequency, or cac…

Quite a few people have tested the bandwidth of their hacked DS1054Z oscilloscopes and found they exceed the specs of even the better model.

Not saying this isn't happening, but it seems not to be.

Re: USB Reverse Engineering: Down the Rabbit Hole

#47
post #27

Earlier quoted context omitted.

Putting "#ifdef PROSUMER" or something to this effect into the source code shouldn't be too costly. Disabling existing functionality is easy and it feels like cheating even if it's called "market segmentation".

This is what developers like us tend to think. But consider this: the development cost of the sodtware does not change much in order to create feature reduced versions of most products. But if you are in a small market where the volume of expected sales for the full version of the product can barely lead to proftability, creating a cheaper version for a higher volume market is a sound business strategy. This would no…

I think of it as people paying the higher price subsidizing people paying the lower price

Re: USB Reverse Engineering: Down the Rabbit Hole

#48

Earlier quoted context omitted.

Then there's a patched version that does not cause the bluescreen. Great! Except that you can no longer install unsigned drivers on Windows 10 by putting your machine into test mode. Patching out the signing check itself may not be too difficult... and if the file the signing check is in is also signed and verified by something else, then patch that ... it's patches all the way down. I remember doing this with Vista…

Yeah but I want to distribute the result to users and patching driver signing checks out of their Windows installs is not an option. You are right though.

Instead of patching out one approach could be to add your own certificate to Microsoft's to allow yourself to sign your own drivers. but not nefarious actors.
Post reply on HN