USB Reverse Engineering: Down the Rabbit Hole

The platform of the device is used for both a prosumer audio device, a professional device, as well as other consumer devices. On top of that, the prosumer device appears to have different functionality enabled based on the part of the world you buy the device, but my hypothesis is that the hardware is the same, regardless of region, and the firmware just implements a dark pattern to limit functionality (perhaps to avoid additional FCC certifications, support incidents, etc.).

Anyway, I've spent a few nights extracting the firmware from other regions, found a great presentation where the company details the hardware and platform, and discovered that the audio capabilities of the hardware for the prosumer device approach that of the professional device (higher sampling frequencies and resolution during recording).

My hope was to be able to flash the device with a modified file system that enabled the features, but ran into the firmware appearing to be encrypted, but potentially decrypted on the host before being pushed to the device. I've been decompiling the drivers to see if I could dump keys or the decrypted payloads, but also thought about sniffing the USB I/O and dumping that way. It looks like this is a nice intro to help me on my way.

unfortunately, it seems that the pre-req article is down, so here's the cached copy: http://webcache.googleusercontent.com/search?q=cache:https:/...

Patching out the signing check itself may not be too difficult... and if the file the signing check is in is also signed and verified by something else, then patch that... it's patches all the way down. I remember doing this with Vista a long time ago. When the signing check fails it fails with a very distinctive error code/message, so I searched for that in all system files and went "down the rabbit hole" of patching out a few checks. I don't remember the details but there was less than a dozen bytes that needed to be changed. Previous cracking experience certainly helps. ;-)

I recall reading about a oscilloscope or something that had two models, one monochrome and slightly worse performance, one color and slightly better better.

Turns out that if you flashed the firmware of the latter onto the former, the performance improved to match the latter's.

Basic thing is that by doing this, the marketing people has calculated that they may reach a larger total customer pool than by only offering the more expensive variant.