usbrply

Convert a .pcap file (captured USB packets) to Python or C code that replays the captured USB commands.

Supported packet sources are:

• Linux Wireshark (via usbmon)
• Windows Wireshark (via USBPcap)

Supported output formats are:

• libusb Python (primary)
• (libusb C: fixme)
• (Linux Kernel C: fixme)
• JSON

Example applications:

• Rapidly reverse engineer and re-implement USB protocols
• Record a proprietary Windows programming sequence and replay on an embedded Linux device
• Snoop USB-serial packets

Questions? Please reach out on github or join #usbrply on Freenode IRC

Linux installation

# Do one of these
# Easier to setup, but slower
sudo pip install python-pcapng
# Much faster, but no longer maintained
sudo apt-get install -y python-libpcap
git clone https://github.com/JohnDMcMaster/usbrply.git
cd usbrply
sudo python setup.py install

Windows installation

There is probably an easier way to do this but this is what I got to work. Tested on Windows 7 x64

Setup python and pip

• Get the latest Python 3 release (https://www.python.org/downloads/)
• I used Python 3.7.8 (Windows x86-64 executable installer)
• Keep default setup options (in particular this will install pip)

Install libusb1

• pip install libusb1

Install usb drivers

• Some USB drivers won't replay. You need to switch their USB drivers to WinUSB. You can use Zadig to switch between USB libraries for a single device.
• https://zadig.akeo.ie/
• Run Zadig
• Click on Options then List all devices then select the USB device that doesn't replay properly and Replace Driver with WinUSB

Install

• Open a command prompt
  • Default should be your home dir (ex: C:\Users\mcmaster)
• python -m venv usbrply
• usbrply\Scripts\activate.bat
• pip install usbrply

Test

• If not still in venv (prompt like "(usbrply)" ): usbrply/Scripts/activate.bat
• python usbrply\Scripts\usbrply -h
  • You should get a help message
• Download and place in your home dir: https://github.com/JohnDMcMaster/usbrply-test/raw/master/win1.pcapng
• python usbply\Scripts\usbrply win1.pcapng
  • You should see python code that will reproduce the .pcap file commands

Sample workflows

Capturing Windows traffic and replaying traffic in Python:

• Install Wireshark. Make sure you install the USBPcap library
• Start Wireshark
• Connect USB device to computer
• Select which USB device you want to capture by clicking on the tiny blue cogwheel and checking the box next to the USB device you want to capture
• Double click on the USBPcap to start the capture
• Start your application, do your thing, etc to generate packets
• Close application
• Stop capture
• Save capture. Save in pcap-ng format (either should work)
• Close Wireshark
• Run: usbrply --wrapper --device-hi -p my.pcapng >replay.py
• Assuming your usb device is connected to the computer, go to "Device manager", find your device, right click on it, select "Properties", go to "Details" tab, select "Hardware IDs" from the drop-down, and you will find an entry of a form: HID\VID_046D&PID_C05A For this example the vid is 0x046D and the pid is 0xC05A
• Scroll down to the bottom of replay.py and edit the following line:

        if (vid, pid) == (**0x0000**, **0x0000**):

• Example edited line:

        if (vid, pid) == (**0x046D**, **0xC05A**):

• Linux: run python replay.py
• Verify expected device behavior. Did an LED blink? Did you get expected data back?

Capturing Windows VM traffic from Linux host and replaying traffic in Python:

Example: program a Xilinx dev board under Linux without knowing anything about the JTAG adapter USB protocol

• On Linux host:
  • Install Wireshark
  • Enable usbmon so Wireshark can capture USB (e.g. sudo modprobe usbmon, see http://wiki.wireshark.org/CaptureSetup/USB)
  • Boot Windows VM (ie through VMWare)
  • Start Wireshark. Make sure you have USB permissions (ie you may need to sudo)
  • Connect USB device to computer
  • Use lsusb to determine which device bus is on. Try to choose a bus (port) with no other devices
  • Start catpure on bus from above
  • Attach USB device to Windows guest
• On Windows guest:
  • Start your application, do your thing, etc to generate packets
• Back on Linux host:
  • Stop capture in Wireshark.
  • Save capture. Save in pcap-ng format (either should work)
  • Run: usbrply --device-hi -p my.pcapng >replay.py
  • Detatch USB device from Windows guest
  • Run python replay.py
• Verify expected device behavior. Did an LED blink? Did you get expected data back?

Capturing from Linux Terminal

• Install tshark
• Enable usbmon so tshark can capture USB (e.g. sudo modprobe usbmon, see http://wiki.wireshark.org/CaptureSetup/USB)
• Connect USB device to computer
• Use lsusb to determine which device bus is on. Try to choose a bus (port) with no other devices
• Start capturing using tshark like: tshark -i usbmon1 -w capture.pcapng
  • The usbmon device matches the bus number output from lsusb e.g. a device entry starting with Bus 001 Device 002 would be captured from usbmon1.
• Use the device as desired.
• Stop capturing by hitting Ctrl-C.
• Run: usbrply --device-hi -p capture.pcapng > replay.py

Command Line Options

You may need to filter out USB devices. There are two ways to do this:

• --device-hi: use the last device enumerated. This works well in most cases, including FX2 renumeration
• --device DEVICE: manually specify the USB device used. Get this from lsusb output or Wireshark view

Other useful switches:

• --rel-pkt: intended to easier allow diffing two outputs. Ex: what changed in trace for LED on vs LED off?
• --no-packet-numbers: alternative to above
• --fx2: decode common FX2 commands (ex: CPU reset)
• --range RANGE: only decode a specific packet range. Use along with Wireshark GUI or refine a previous decode
• see --help for more

Version history

v0.0.0

• Crusty C++ program

v0.0.1

• Crusty python program

v1.0.0

• Separate parsing from printing
• Windows data source officially supported

v2.0.0

• JSON: packn moved to new "submit" and "complete" entries
• JSON now has raw urb structures (added to submit/complete)
• python3 support
• libpcapng support

v2.0.1

• Fix packaging issues

v2.1.0

• python2 support officially removed
• VID/PID filter fixed
• Windows pip install instructions
• Linux: basic interrupt support
• General interrupt cleanup / fixes
• Better logging for dropped packets
• --no-packet-numbers: line numbers line up vs --packet-numbers

v2.1.1

• Fix pip README

JSON output

use -j switch to output a parsing intermediate representation that should resemble original USB requests along with associated metadata. This can be used in more advanced applications, such as if you need to decode a complicated protocol or convert USB output to higher level API calls. An example can be found here: https://github.com/ProgHQ/bpmicro/blob/master/scrape.py This example first aggregates USB packets into application specific packets, and then decodes these into API calls

USB serial decoder

usbrply-serial supported adapters:

• FT2232C: data rx/tx

TODO: write doc