28C3: Reverse engineering USB devices

Posted on Thursday, February 2nd, 2012 in reversed, talks, USB by the machinegeek

In this talk from the recent 28C3 conference in Berlin, Drew Fisher discusses the process of reverse engineering the Kinect audio protocol. He shows how the USB standard can help a reverse engineer out and proceeds to analyze a set of USB logs, finding patterns, building understanding, developing hypotheses of message structure, and eventually implementing a userspace driver.

You can download the PDF of the presentation slides from the 28C3 conference site.

This entry was posted on Thursday, February 2nd, 2012 at 4:00 pm and is filed under reversed, talks, USB. You can follow any responses to this entry through the RSS 2.0 feed. You can skip to the end and leave a response. Pinging is currently not allowed.

3 Responses to “28C3: Reverse engineering USB devices”

  1. Filip says:

    this is pure awesomeness, I am wondering whats the purpose of the HW USB sniffer, if software does the job?

    • shuckc says:

      Hardware sniffers would be invaluable if you are working on the bus transceivers or link-level code and therefore might be sending malformed packets that would be dropped by the error checking in a standards compliant receiver.

    • Drew Fisher says:

      Hardware sniffers are also necessary if you can’t reasonably run both sniffing software and the working driver on the USB host, as was the case when the Kinect first came out – the only host that would speak the Kinect protocol was the Xbox360, so we pretty much had to have a hardware sniffer.

      The Kinect remains impossible to log on Windows with a USB filter driver, since Win7 appears to treat it as a separate class of device entirely – it doesn’t appear in the list of USB devices available to trace with BusDog.

      So some devices will require the hardware approach, and as shuckc noted, if you’re debugging a USB implementation on a device, it’s really helpful to see whatever was on the line, valid or no.

Leave a Reply

Notify me of followup comments via e-mail. You can also subscribe without commenting.

Recent Comments

  • mike: 1oz is 35um 2 oz is 70um 3 oz is 105um 4oz is 140um Obviously, the thicker the copper, the more current you can carry...
  • Manoj: U mean to use 105um ?
  • mike: have you considered thicker copper. 1oz copper is the norm, but I have often used 2 oz for higher currents. Theres probably 3oz as well
  • Derek: Perhaps I am too late. Perhaps I am not.
  • King5E: me