Skip to main content

Replay captured USB packets from .pcap file.

Project description

# usbrply

Convert a .pcap file (captured USB packets) to Python or C code that replays the captured USB commands.

Supported packet sources are: * Linux Wireshark (via usbmon) * Windows Wireshark (via USBPcap)

Supported output formats are: * libusb Python (primary) * (libusb C: fixme) * (Linux Kernel C: fixme) * JSON

Example applications: * Rapidly reverse engineer and re-implement USB protocols * Record a proprietary Windows programming sequence and replay on an embedded Linux device * Snoop USB-serial packets

Questions? Please reach out on github or join #usbrply on Freenode IRC

# Installation Its currenlty only tested under Ubuntu Linux, but probably works under Windows. If someone sends instructions I’ll add them here

` # Do one of these # Easier to setup, but slower sudo pip install python-pcapng # Much faster, but no longer maintained sudo apt-get install -y python-libpcap git clone https://github.com/JohnDMcMaster/usbrply.git cd usbrply sudo python setup.py install `

# Sample workflows

Sample workflow for capturing Windows traffic and replaying traffic in Python: * Install Wireshark. Make sure you install the USBPcap library * Start Wireshark * Connect USB device to computer * Start catpure * Start your application, do your thing, etc to generate packets * Close application * Stop capture * Save capture. Save in pcap-ng format (either should work) * Close Wireshark * Run: “usbrply –device-hi -p my.pcapng >replay.py” * Linux: run “python replay.py” * Verify expected device behavior. Did an LED blink? Did you get expected data back?

Sample workflow for capturing Windows VM traffic from Linux host and replaying traffic in Python: * Example: program a Xilinx dev board under Linux without knowing anything about the JTAG adapter USB protocol * Linux: Install Wireshark * Linux: Enable usbmon so Wireshark can capture USB (sudo modprobe usbmon, see http://wiki.wireshark.org/CaptureSetup/USB) * Linux: Boot Windows VM (ie through VMWare) * Linux: Start Wireshark. Make sure you have USB permissions (ie you may need to sudo) * Connect USB device to computer * Linux: use lsusb to determine which device bus is on. Try to choose a bus (port) with no other devices * Linux: start catpure on bus from above * Linux: attach USB device to Windows guest * Windows: start your application, do your thing, etc to generate packets * Linux: stop capture * Linux: save capture. Save in pcap-ng format (either should work) * Linux: run: “usbrply –device-hi -p my.pcapng >replay.py” * Linux: detatch USB device from Windows guest * Linux: run “python replay.py” * Verify expected device behavior. Did an LED blink? Did you get expected data back?

You may need to filter out USB devices. There are two ways to do this: * –device-hi: use the last device enumerated. This works well in most cases, including FX2 renumeration * –device DEVICE: manually specify the USB device used. Get this from lsusb output or Wireshark view

Other useful switches: * –rel-pkt: intended to easier allow diffing two outputs. Ex: what changed in trace for LED on vs LED off? * –no-packet-numbers: alternative to above * –fx2: decode common FX2 commands (ex: CPU reset) * –range RANGE: only decode a specific packet range. Use along with Wireshark GUI or refine a previous decode * see –help for more

# JSON output

use -j switch to output a parsing intermediate representation that should resemble original USB requests along with associated metadata. This can be used in more advanced applications, such as if you need to decode a complicated protocol or convert USB output to higher level API calls. An example can be found here: https://github.com/ProgHQ/bpmicro/blob/master/scrape.py This example first aggregates USB packets into application specific packets, and then decodes these into API calls

# USB serial decoder

usbrply-serial supported adapters:
  • FT2232C: data rx/tx

TODO: write doc

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for usbrply, version 2.0.0
Filename, size File type Python version Upload date Hashes
Filename, size usbrply-2.0.0-py3.8.egg (68.1 kB) File type Egg Python version 3.8 Upload date Hashes View
Filename, size usbrply-2.0.0-py3-none-any.whl (33.6 kB) File type Wheel Python version py3 Upload date Hashes View
Filename, size usbrply-2.0.0.tar.gz (27.4 kB) File type Source Python version None Upload date Hashes View

Supported by

AWS AWS Cloud computing Datadog Datadog Monitoring DigiCert DigiCert EV certificate Facebook / Instagram Facebook / Instagram PSF Sponsor Fastly Fastly CDN Google Google Object Storage and Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Salesforce Salesforce PSF Sponsor Sentry Sentry Error logging StatusPage StatusPage Status page