Reverse engineering an USB Video Grabber device protocol and creating a Linux kernel driver.
Mostly the same talk as in OSSConf 2013, with Alice in Wonderland pictures.
11. USB Addresses
●
Bus & Device number
Host
Device 1:1
Hub
Device 2:1
Hub
Device 2:2
Flash Drive
Device 3:1
Mouse
12. USB Addresses
$ lsusb
Bus 001
Bus 002
Bus 002
Bus 003
$ lsusb
...
Device
Device
Device
Device
-v
001:
001:
002:
001:
ID
ID
ID
ID
1d6b:0002
1337:abcd
1337:0123
dead:b4b3
Linux Foundation 2.0 root hub
Trololol USB 1.1 Hub
Trololol Flash Drive
Random Mouse
14. Our device
Device
Alternate setting 0
Endpoints:
Alternate setting 1
Endpoints:
0x81 Isochronous IN
0x82 Bulk
IN
0x81 Isochronous IN
0x82 Bulk
IN
0x83 Bulk
0x84 Interrupt
0x83 Bulk
0x84 Interrupt
IN
IN
IN
IN
15. The Plan
●
Make it work in Windows
●
Capture what happens
●
Find image data
●
Mimic the behavior in userspace
●
Transform into a kernel module
19. What did we see
●
Number of CONTROL requests
●
ISOCHRONOUS packets once capture starts
20. RGB
R R R R R R R R
G G G G G G G G
B B B B B B B B
21. YUV2
Y Y Y Y U1 U1 U1 U1
Y Y Y Y V1 V1 V1 V1
Y Y Y Y U2 U2 U2 U2
Y Y Y Y V2 V2 V2 V2
22. LibUSB
●
We could replay the traffic
●
In userspace – no kernel hacking needed
●
C, Python & Perl bindings
●
Now we need to find start & end of the picture
28. Video4Linux2
●
Provide a device with known API
●
●
read(), write()
●
ioctl()
●
●
open(), close()
mmap()
Negotiate format with userspace
29. Videobuf2
●
Manages buffers of frames
●
Connects to Video4Linux2
●
read(), write(), mmap()
●
some ioctl()s
–
Start/stop capture
–
Exchange buffers with userspace
30. USB framework
●
●
Setup the device
Allocate buffers for exchange of data with
device
●
Handle start/stop
●
Isochronous callbacks
●
Copy data from USB buffers to Videobuf2 buffers