Package: usbrply
usbrplyConvert a .pcap file (captured USB packets) to Python or C code that replays the captured USB commands.Supported packet sources are:Linux Wireshark (via usbmon)Windows Wireshark (via USBPcap)Supported output formats are:libusb Python (primary)(libusb C: fixme)(Linux Kernel C: fixme)JSONExample applications:Rapidly reverse engineer and re-implement USB protocolsRecord a proprietary Windows programming sequence and replay on an embedded Linux deviceSnoop USB-serial packetsQuestions? Please reach out on github or join #usbrply on Freenode IRCLinux installation# Do one of these
# Easier to setup, but slower
sudo pip install python-pcapng
# Much faster, but no longer maintained
sudo apt-get install -y python-libpcap
git clone https://github.com/JohnDMcMaster/usbrply.git
cd usbrply
sudo python setup.py installWindows installationThere is probably an easier way to do this but this is what I got to work. Tested on Windows 7 x64Setup python and pipGet the latest Python 3 release (https://www.python.org/downloads/)I used Python 3.7.8 (Windows x86-64 executable installer)Keep default setup options (in particular this will install pip)InstallOpen a command promptDefault should be your home dir (ex: C:\Users\mcmaster)python -m venv usbrplyusbrply/Scripts/activate.batpip install usbrplyTestIf not still in venv (prompt like "(usbrply)" ): usbrply/Scripts/activate.batpython usrply\Scripts\usbrply -hYou should get a help messageDownload and place in your home dir:https://github.com/JohnDMcMaster/usbrply-test/raw/master/win1.pcapngpython usrply\Scripts\usbrply win1.pcapngYou should see python code that will reproduce the .pcap file commandsSample workflowsSample workflow for capturing Windows traffic and replaying traffic in Python:Install Wireshark. Make sure you install the USBPcap libraryStart WiresharkConnect USB device to computerStart catpureStart your application, do your thing, etc to generate packetsClose applicationStop captureSave capture. Save in pcap-ng format (either should work)Close WiresharkRun: "usbrply --device-hi -p my.pcapng >replay.py"Linux: run "python replay.py"Verify expected device behavior. Did an LED blink? Did you get expected data back?Sample workflow for capturing Windows VM traffic from Linux host and replaying traffic in Python:Example: program a Xilinx dev board under Linux without knowing anything about the JTAG adapter USB protocolLinux: Install WiresharkLinux: Enable usbmon so Wireshark can capture USB (sudo modprobe usbmon, seehttp://wiki.wireshark.org/CaptureSetup/USB)Linux: Boot Windows VM (ie through VMWare)Linux: Start Wireshark. Make sure you have USB permissions (ie you may need to sudo)Connect USB device to computerLinux: use lsusb to determine which device bus is on. Try to choose a bus (port) with no other devicesLinux: start catpure on bus from aboveLinux: attach USB device to Windows guestWindows: start your application, do your thing, etc to generate packetsLinux: stop captureLinux: save capture. Save in pcap-ng format (either should work)Linux: run: "usbrply --device-hi -p my.pcapng >replay.py"Linux: detatch USB device from Windows guestLinux: run "python replay.py"Verify expected device behavior. Did an LED blink? Did you get expected data back?You may need to filter out USB devices. There are two ways to do this:--device-hi: use the last device enumerated. This works well in most cases, including FX2 renumeration--device DEVICE: manually specify the USB device used. Get this from lsusb output or Wireshark viewOther useful switches:--rel-pkt: intended to easier allow diffing two outputs. Ex: what changed in trace for LED on vs LED off?--no-packet-numbers: alternative to above--fx2: decode common FX2 commands (ex: CPU reset)--range RANGE: only decode a specific packet range. Use along with Wireshark GUI or refine a previous decodesee --help for moreVersion historyv0.0.0Crusty C++ programv0.0.1Crusty python programv1.0.0Seperate parsing from printingWindows data source officially supportedv2.0.0JSON: packn moved to new "submit" and "complete" entriesJSON now has raw urb structures (added to submit/complete)python3 supportlibpcapng supportv2.0.1Fix packaging issuesv2.1.0python2 support officially removedVID/PID filter fixedWindows pip install instructionsLinux: basic interrupt supportGeneral interrupt cleanup / fixesBetter logging for dropped packets--no-packet-numbers: line numbers line up vs --packet-numbersJSON outputuse -j switch to output a parsing intermediate representation that should resemble original USB requests
along with associated metadata.
This can be used in more advanced applications, such as if you need to decode a complicated protocol
or convert USB output to higher level API calls.
An example can be found here:https://github.com/ProgHQ/bpmicro/blob/master/scrape.pyThis example first aggregates USB packets into application specific packets, and then decodes these into API callsUSB serial decoderusbrply-serial supported adapters:FT2232C: data rx/txTODO: write doc