linuxreverse engineeringusb

Determining the Device ID. Razer devices use a USB VID (Vendor ID) of 1532. You can identify the USB PID (Product ID) by typing: lsusb grep '1532:' This will output something similar to this: Bus 003 Device 005: ID 1532:0203 Razer USA, Ltd.

This article explains the creation process of a Linux kernel device driver foran undocumented USB device. After having reverse-engineered the USBcommunication protocol, I present the architecture of the USB device driver. Inaddition to the kernel driver I introduce a simple user-space tool that can beused to control the device. Although I have to delve into the specifics of aparticular device, the process can be applied to other USB devices as well.

A USB device driver must be installed the first time a Microsoft Windows-based PC is connected to the USB console port on the switch. Installing the Cisco Microsoft Windows XP USB Driver; Installing the Cisco Microsoft Windows 2000 USB Driver; Installing the Cisco Microsoft Windows Vista and Windows 7 USB Driver. AMD Rolls Out Its First 2021 Graphics Driver - Get Radeon 21.1.1 Intel Adds Support for Iris Xe Max Graphics (DG1) - Get Version 27.20.100.9168 The New RTX 461.09 Graphics Driver Adds Support for NVIDIA’s A40 GPU.

Introduction

Recently, I found a fancy device while searching eBay: the DreamCheeky USBmissile launcher. The manufacturer neitherprovides a Linux driver nor publishes the USB protocol specification. Only abinary Windows driver is available, turning the missile launcher into complete“black-box” for Linux users. What a challenge! Let’s get the damn gadgetworking under Linux.

To facilitate USB programming, the USB interface is accessible from user-spacewith libusb, a programming API concealinglow-level kernel interaction. The proper way to write a device driver for themissile launcher would hence be to leverage this API and ignore any kernelspecifics. Nevertheless, I wanted to get involved with kernel programming anddecided thus to write a kernel module despite the increased complexity andhigher effort.

The remainder of this article is structured as follows. After pointing to somerelated work, I give a quick USB overview. Thereafter, I present thereverse-engineering process to gather the unknown USB commands steering themissile launcher. To come up with a full-featured kernel device driver, Idescribe the kernel module architecture which incorporates the derived controlcommands. Finally, I demonstrate a simple tool in user-space that makes use ofthe driver.

Related Work

Apparently I have not been the only one who played with this gadget. However,none of the existing approaches I have encountered pursue the creation of aLinux device driver for the kernel. The LauncherLibrary provides a user-spacelibrary based on libusb. AHmissile is aGTK+ control tool; a ncurses application isavailable, too.Apple users get happy with the USB missile launcherNZ project. Moreover, the python implementationpymissile supports a missilelauncher of a different manufacturer. The author combined the missilelauncher with a webcam in order to to create an automated sentry guard reactingon motion. I will return to these funky ideas later.

USB Primer

The universal serial bus (USB) connects a host computer with numerousperipheral devices. It was designed to unify a wide range of slow and old buses(parallel, serial, and keyboard connections) into a single bus type. It istopologically not constructed as a bus, but rather as a tree of severalpoint-to-point links. The USB host controller periodically polls each device ifit has data to send. With this design, no device can send before it has not beenasked to do so, resulting in a plug-and-play-friendly architecture.

Linux supports two main types of drivers: host and device drivers. Let’s ignorethe host component and have a deeper look at the USB device. As shown on theright side, a USB device consists of one or more configurationswhich in turn have one ore more interfaces. These interfaces contain zero ormore endpoints which make up the basic form of USB communication. An endpointis always uni-directional, either from the host to the device (OUT endpoint)or from the device to the host (IN endpoint). There are four types ofendpoints and each transmits data in a different way:

Control
Interrupt
Bulk
Isochronous

Lb Engineering Usb Devices Drivers

Control endpoints are generally used to control the USB deviceasynchronously, i.e. sending commands to it or retrieving status informationabout it. Every device possesses a control “endpoint 0” which is used by the USBcore to initialize the device. Interrupt endpoints occur periodicallyand transfer small fixed-size data portions every time when the USB host asksthe device. They are commonly used by mice and keyboards as primary transportmethod. As bulk and isochronous endpoints are not relevant forour missile launcher, I skip their discussion. An excellent introduction from aprogramming perspective gives the Linux DeviceDrivers book. Below issome output from lsusb -v providing detailed information about the missilelauncher.

The output is structured and indented like a typical USB device. First, vendorand product ID uniquely identify this USB gadget. These IDs are used by the USBcore to decide which driver to give a device to. Moreover, hotplug scripts candecide which driver to load when a particular device is plugged in. Next, wecan read off the maximum power usage (100 mA) in the configuration section. Thesubordinate interface contains apparently one interrupt IN endpoint (besidesthe control endpoint 0) that can be accessed at address 0x81. Because it isan IN endpoint, it returns status information from the device. To handle theincoming data we first need to understand the missile launcher controlprotocol.

Reverse-Engineering the USB Protocol

Lb Engineering USB Devices Driver

The first step involves reverse-engineering (or “snooping”) the USBcommunication protocol spoken by the binary Windows driver. One approach wouldbe to consign the device in a VMware and capture the exchanged data on the hostsystem. But since several tools to analyze USB traffic already exist, the easiersolution is to rely on one of those. The most popular free application appearsto be SnoopyPro. Surprisingly I donot have Windows box at hand, so I had to install the binary driver togetherwith SnoopyPro in a VMware.

In order to capture all relevant USB data and intercept all device controlcommands, the missile launcher has to perform every possible action while beingmonitored: moving the two axes alone and together, shooting, and moving to thelimiting axes boundaries (which will trigger a notification that the axescannot be moved further in one direction). While analyzing the SnoopyProdump, one can easily discover the control commands sentto the missile launcher. As an example, the Figure below shows an 8 bytetransfer buffer. When moving the missile launcher to the right, the bufferholds 0x00000008. Moving the launcher up changes the buffer contents to0x00000001. It is apparently very easy to deduce the control bytes used tocontrol the missile launcher. Unless a “stop” command (0x00000000) is sent tothe device, it keeps the state of the last command. This means if the “down”command is issued, the device continues to turn until it receives a newcommand. If it is not possible to move further, the motor keeps up running andthe gears crack with a unbearable painful sound. Upon closer examination, theinterrupt IN endpoint buffer varies depending on the current device position.Whensoever an axis reaches its boundary (and creates the maddening sound), thedevice detects it and changes the interrupt buffer contents accordingly. Thismeans of notification can be leveraged by the kernel developer to implement aboundary checking mechanism sending a stop command as soon as the missilelauncher runs against a wall.

Here is an excerpt of the driver source showing the complete list of controlcommands that can be sent to the device.

The following bytes appear in the buffer of the interrupt IN endpoint (shown ascomment) and indicate that a boundary has been reached.

With all required control information in place, let’s now adopt the programmer’sperspective and delve into the land of kernel programming.

The Device Driver

Lb engineering usb devices driver updater

Writing code for th