Can you suggest a better USB-sniffer for WindowsXP? - Page 1
Forum section: electronics / general

author: DiTBho
author_rank: Super Contributor
timestamp: June 05, 2022, 10:01:22 am
content: hiI am reverse engineering a USB device that only works on Windows XP; the idea is to understand the protocol for creating a Linux program (C-only).The USB talks via Endpoint, a number representing a source and sink for data, the device I am hacking talks to three differentEndpoints, and it's a USB2 device, which also uses {control,Bulk} types of transfer mechanisms, each with varying characteristics.TheIsochronous transfer mechanismis not used, I need the USB sniffer to show this information clearly.Code:Packet# EndPoint transfer_mechanisms data_len data (hex)I am currently using the programSniffbin-v1.8, which is good onWindows-XP, but not exactly handy to be used.I'm slowly making things work, the program is already able to correctly initialize the device - which hey? It's "first things first:wiggle your big toe, start small and work your way up!" (quote, "Kill Bill" movie) - but the current USB-Sniffer is making things uncomfortable -s there anything better, guys? a want a better and sharper sword

author: dave_k
author_rank: Frequent Contributor
timestamp: June 05, 2022, 10:04:36 am
content: Wireshark with USBpcap

author: DiTBho
author_rank: Super Contributor
timestamp: June 05, 2022, 11:28:04 am
content: Quote from: dave_k on June 05, 2022, 10:04:36 amIt's great on Linux, but it doesn't work properly on Windows

author: DiTBho
author_rank: Super Contributor
timestamp: June 05, 2022, 11:30:57 am
content: (I likeCarcharodon Photoshopiasharks, my favorite shark)

author: AndyBeez
author_rank: Frequent Contributor
timestamp: June 05, 2022, 12:11:23 pm
content: Wireshark XP is a bit ancientI do not recall exactly how this is done but I've seen a Linux PC used as an inline hardware USB packet sniffer by connecting one of it's USB ports to the target device and another USB port to the 'host' PC. There's some dev/usb voodoo which makes the Linux PC 'transparent' to traffic - it is seen as a hub to the upstream PC and as the host to the USB device's endpoints. USB traffic is a pipeline that is captured on the Linux machine and 'sharked' later. But this might be a waste of time if the upstream driver is expecting a specific VID-PID combination.

author: DiTBho
author_rank: Super Contributor
timestamp: June 05, 2022, 08:19:43 pm
content: Quote from: PeDre on June 05, 2022, 12:32:07 pmit looks nice, and it shows packets exactly as I need. It costs 150 euro, not too much. Is the license node-locked to the PC or can I move to a second computer?At the moment I need to use it on a Windows XP laptop only because the software I need to sniff only runs on Windows XP, and I would like to re-use the USBsniffer on my Windows10 laptop in the future.

author: SiliconWizard
author_rank: Super Contributor
timestamp: June 05, 2022, 08:24:18 pm
content: https://freeusbanalyzer.com/

author: oPossum
author_rank: Super Contributor
timestamp: June 05, 2022, 08:28:21 pm
content: https://github.com/SnoopWare/usbsnoophttps://www.darknet.org.uk/2015/02/snoopypro-windows-usb-sniffer-tool/

author: DiTBho
author_rank: Super Contributor
timestamp: June 05, 2022, 08:56:57 pm
content: Quote from: SiliconWizard on June 05, 2022, 08:24:18 pmDoesn't support Windows XP

author: DiTBho
author_rank: Super Contributor
timestamp: June 05, 2022, 08:59:24 pm
content: Quote from: oPossum on June 05, 2022, 08:28:21 pmBefore opening this topic I had already tried it and I didn't work

author: DiTBho
author_rank: Super Contributor
timestamp: June 05, 2022, 09:03:04 pm
content: I am currently usingthisone (usbsnoop, v1., which somehow works, but it doesn't show packets like I need.Too messy and too verbose logs

author: SiliconWizard
author_rank: Super Contributor
timestamp: June 06, 2022, 12:32:50 am
content: Quote from: DiTBho on June 05, 2022, 08:56:57 pmIt's listed.

author: Whales
author_rank: Super Contributor
timestamp: June 06, 2022, 01:43:53 am
content: Another possible option: Run Linux or Win10 as host, then Windows XP inside Virtualbox with USB redirection. Sniff USB packets using Wireshark on your host whilst operating the program on the WinXP guest.WinXP guests run really fast in VMs on modern devicesVery little hassle.

author: DiTBho
author_rank: Super Contributor
timestamp: June 06, 2022, 08:13:09 am
content: Quote from: SiliconWizard on June 06, 2022, 12:32:50 amI downloaded the package, it doesn't install saying the OS is not supported.It seems likeWindows XP SP3isn't good enough for its taste

author: DiTBho
author_rank: Super Contributor
timestamp: June 06, 2022, 08:20:47 am
content: Quote from: Whales on June 06, 2022, 01:43:53 amUmm, the USB device I have to smell is really bad.It initially presents itself as VID: PID1 to get a large bit stream on an FPGA, then re-configures itself and re-presents itself as VID: PID2 for operations.PID1 != PID2This is exactly what makesVirtualBoxcrazy about USB redirection and I don't want to have any more problems.

author: DiTBho
author_rank: Super Contributor
timestamp: June 06, 2022, 08:58:26 am
content: Ok, bought a license forSysNucleus USBTracev2-something from a dude.Paid only 20 euro for it. It's good enough for what I need to do.Let's go hacking.Thanks everyone

author: voltsandjolts
author_rank: Unknown
timestamp: June 06, 2022, 10:13:14 am
content: Quote from: DiTBho on June 06, 2022, 08:20:47 amSounds like a Cypress EZUSB device I rev eng'd. I seem to remember there was a setting in Virtualbox like 'always grab this usb device automatically' and once I had done that for both identities, it was usable. It also had a large FPGA bitstream download but that was after the Cypress device had enumerated on its second and final identity.

author: voltsandjolts
author_rank: Unknown
timestamp: June 06, 2022, 10:19:07 am
content: I've used Eltima USB Analyzer and it was good, nice UI.I see it lists XP as supported [Windows (32-bit and 64-bit): XP/2003/2008/], and has a 14 day free trial.https://www.eltima.com/products/usb-port-monitor/

author: SiliconWizard
author_rank: Super Contributor
timestamp: June 06, 2022, 07:41:32 pm
content: Quote from: DiTBho on June 06, 2022, 08:13:09 amOK, that's too bad. Maybe you could let them know.I've used a sniffer years ago on Windows (that was Win 2000 I think), but I can't remember the name...

author: DiTBho
author_rank: Super Contributor
timestamp: June 08, 2022, 09:28:34 am
content: A problem I have at the moment it that I need to export things in a way I can automatically build C filled structures.CVS? XML? Somehow they look better than exporting as HTML: o: o: oSeriously, USBtrace exported to "log.html", which is about 35 Mb and Firefox crashed trying to open it.USBtrace can be configured to export XML. This helps

author: DiTBho
author_rank: Super Contributor
timestamp: June 08, 2022, 09:29:42 am
content: I mean .XML + Python(XLM_parser) = C auto filled structures

author: Bassman59
author_rank: Super Contributor
timestamp: June 09, 2022, 07:24:47 pm
content: Quote from: voltsandjolts on June 06, 2022, 10:13:14 amEZ-USB was famous (haha) for its "re-enumeration" feature, which did just what you describe. Why they thought that was important or useful remains a mystery.

author: SiliconWizard
author_rank: Super Contributor
timestamp: June 09, 2022, 07:54:23 pm
content: Quote from: Bassman59 on June 09, 2022, 07:24:47 pmThey had some kind of USB bootloader allowing to download the firmware in internal RAM from the host, and then restart with the new firmware, which would typically reeunumerate as a different device.While sometimes a bit annoying for the user, it was an early form of DFU not requiring "flashing" the device (it ran entirely from RAM) and making firmware updates as easy as providing a new driver. Devices built with that scheme could never get "bricked".

author: DiTBho
author_rank: Super Contributor
timestamp: June 10, 2022, 07:19:47 am
content: Quote from: SiliconWizard on June 09, 2022, 07:54:23 pmYup, you love it when you develop something, you hate it when you have to use a VM to hack something.

author: SiliconWizard
author_rank: Super Contributor
timestamp: June 10, 2022, 05:42:15 pm
content: Quote from: DiTBho on June 10, 2022, 07:19:47 amYes.Note that if using some MCU with enough RAM and capable of executing code from RAM (many would fit these days), that's something you can still do (and more elegantly), while I've seen it done relatively rarely, if the device you design is a USB device which isn't supposed to function when not connected to a host.You can just implement a set of well tested base routines and put them in Flash, and then have most of the firmware downloaded from the host to the device in RAM through USB. Can be a very flexible scheme.

author: cgroen
author_rank: Unknown
timestamp: June 10, 2022, 05:50:11 pm
content: I use the "Beagle 480" from totalphase:https://www.totalphase.com/products/beagle-usb480/worth every penny!