Carsoft Engineering USB Devices Driver
Carsoft Engineering Usb Devices Drivers

AMD Rolls Out Its First 2021 Graphics Driver - Get Radeon 21.1.1 Intel Adds Support for Iris Xe Max Graphics (DG1) - Get Version 27.20.100.9168 The New RTX 461.09 Graphics Driver Adds Support for NVIDIA’s A40 GPU. But when i looked little bit more, I found out that there is already a USB video class assigned for this specific task. Driver for UVC device are already standard and present in many well used OS. Driver is present in Windows and Linux both.

I recieved two emails in response to my last post, both from people owning slightly obscure hardware wondering how they might be able to reverse engineer it and possibly get Linux driver production underway.

The first step is to spy on the device during normal usage. In the case of the Alauda, this means monitoring all USB port traffic while using the device under Windows using the vendor-supplied driver.

Fortunately this is relatively easy to do with USB, you can use software such as USBSnoop on windows which will log all the traffic to a file. Other hardware is not so easy, sometimes you have to resort to expensive “middle-man” hardware devices which monitor and record the traffic for you.

Carsoft Engineering USB Devices Driver

After logging a few sessions, you then have the daunting task of analysing the logs. They are cryptic and hard to understand at first. Here is a small part of a USBSnoop log right after plugging in the MAUSB-10:

This starts to make more sense after reading the USB specs – the host computer is sending a command to the device and gets 2 bytes of data back (0×80 0×01) in return. I think that this particular command is querying the device status, and 80 01 means not ready yet. After 10 or so of these commands have been sent, the final one returns a new value of “0×14 0×01″, and after that, all kinds of crazy stuff starts happening, so 14 01 somehow indicates that the device is ready for action.

Once you have an idea about which command does what, and how to interpret the responses, you can then start writing code to mimick what the windows driver does. I’ve archived a good HOWTO (slightly out of date) which provides an introduction to this: Reverse engineering Windows USB device drivers for the purpose of creating compatible device drivers for Linux.

Obviously the process will be different for non-USB devices, but I hope this shows that while it’s an interesting experience, reverse engineering is pretty damn hard, especially you have so little to go on. It’s much easier if you can get a copy of the manufacturers technical documents, which is sometimes possible.

linuxreverse engineeringusb

This article explains the creation process of a Linux kernel device driver foran undocumented USB device. After having reverse-engineered the USBcommunication protocol, I present the architecture of the USB device driver. Inaddition to the kernel driver I introduce a simple user-space tool that can beused to control the device. Although I have to delve into the specifics of aparticular device, the process can be applied to other USB devices as well.

Introduction

Recently, I found a fancy device while searching eBay: the DreamCheeky USBmissile launcher. The manufacturer neitherprovides a Linux driver nor publishes the USB protocol specification. Only abinary Windows driver is available, turning the missile launcher into complete“black-box” for Linux users. What a challenge! Let’s get the damn gadgetworking under Linux.

To facilitate USB programming, the USB interface is accessible from user-spacewith libusb, a programming API concealinglow-level kernel interaction. The proper way to write a device driver for themissile launcher would hence be to leverage this API and ignore any kernelspecifics. Nevertheless, I wanted to get involved with kernel programming anddecided thus to write a kernel module despite the increased complexity andhigher effort.

The remainder of this article is structured as follows. After pointing to somerelated work, I give a quick USB overview. Thereafter, I present thereverse-engineering process to gather the unknown USB commands steering themissile launcher. To come up with a full-featured kernel device driver, Idescribe the kernel module architecture which incorporates the derived controlcommands. Finally, I demonstrate a simple tool in user-space that makes use ofthe driver.

Related Work

Aaronia port devices driver. Apparently I have not been the only one who played with this gadget. However,none of the existing approaches I have encountered pursue the creation of aLinux device driver for the kernel. The LauncherLibrary provides a user-spacelibrary based on libusb. AHmissile is aGTK+ control tool; a ncurses application isavailable, too.Apple users get happy with the USB missile launcherNZ project. Moreover, the python implementationpymissile supports a missilelauncher of a different manufacturer. The author combined the missilelauncher with a webcam in order to to create an automated sentry guard reactingon motion. I will return to these funky ideas later.

USB Primer

The universal serial bus (USB) connects a host computer with numerousperipheral devices. It was designed to unify a wide range of slow and old buses(parallel, serial, and keyboard connections) into a single bus type. It istopologically not constructed as a bus, but rather as a tree of severalpoint-to-point links. The USB host controller periodically polls each device ifit has data to send. With this design, no device can send before it has not beenasked to do so, resulting in a plug-and-play-friendly architecture.

Linux supports two main types of drivers: host and device drivers. Let’s ignorethe host component and have a deeper look at the USB device. As shown on theright side, a USB device consists of one or more configurationswhich in turn have one ore more interfaces. These interfaces contain zero ormore endpoints which make up the basic form of USB communication. An endpointis always uni-directional, either from the host to the device (OUT endpoint)or from the device to the host (IN endpoint). There are four types ofendpoints and each transmits data in a different way:

Control
Interrupt
Bulk
Isochronous

Control endpoints are generally used to control the USB deviceasynchronously, i.e. sending commands to it or retrieving status informationabout it. Every device possesses a control “endpoint 0” which is used by the USBcore to initialize the device. Interrupt endpoints occur periodicallyand transfer small fixed-size data portions every time when the USB host asksthe device. They are commonly used by mice and keyboards as primary transportmethod. As bulk and isochronous endpoints are not relevant forour missile launcher, I skip their discussion. An excellent introduction from aprogramming perspective gives the Linux DeviceDrivers book. Below issome output from lsusb -v providing detailed information about the missilelauncher.

The output is structured and indented like a typical USB device. First, vendorand product ID uniquely identify this USB gadget. These IDs are used by the USBcore to decide which driver to give a device to. Moreover, hotplug scripts candecide which driver to load when a particular device is plugged in. Next, wecan read off the maximum power usage (100 mA) in the configuration section. Thesubordinate interface contains apparently one interrupt IN endpoint (besidesthe control endpoint 0) that can be accessed at address 0x81. Because it isan IN endpoint, it returns status information from the device. To handle theincoming data we first need to understand the missile launcher controlprotocol.

Carsoft Engineering USB Devices Driver

Introduction

Related Work

USB Primer

Reverse-Engineering the USB Protocol