USB

USB¶

Umap2: NCC's python USB host security tool
USB host/device implementation using PIO of raspberry pi pico (RP2040).
USB Exploitaing with a raspberry pi pico
ViewSB is a USB analyzer that supports various capture backends including GreatFET, OpenVizsla, and usbmon.
Coding a USB Driver

When a USB is plugged in it sends a start of frame packets every 1 ms.

Uses a Data+ and an Data- to create destructive interference to prevent the cable acting like an antenna.

USB Versions¶

Source

Marketing Information:

Speeds:

Types of Devices¶

https://microchipdeveloper.com/usb:device-classes

HID Devices¶

Details on Making your own Keyboard
HID Keyboard Protocol Details

Signals¶

http://www.usbmadesimple.co.uk/ums_3.htm

sync:

Reset: Both data lines are put low for 10ms

End of Packet: Both data lines are put low for 2 bits

Suspend:

Resume:

Keep Alive:

Transfer Types¶

Control Transfers: Configuration and implementation specific commands (used to configure a device)
Bulk Transfers: Large amounts of sequential data (generated or consumed in relatively large and bursty quantities)
Interrupt Transfers: A limited latency data transfer to or from a device (used for timely but reliable delivery of data)
Isochronous Transfers: Continuous Real-time data stream (occupy a prenegotiated amount of USB bandwidth with a prenegotiated delivery latency)

All USB devices must support a specially designated pipe at endpoint zero to which the USB device’s control pipe will be attached.

Packet Formats¶

• Packets are started by the sync signal and terminated by the EOP

• Token
  • OUT (0001)
  • IN (1001)
  • SOF (0101)
  • SETUP (1101)
• Data
  • DATA0 (0011)
  • DATA1 (1011)
  • DATA2 (0111)
  • MDATA (1111)
• Handshake
  • ACK (0001)
  • NAK (0001)
  • STALL (0001)
  • NYET (0001)
• Special
  • PRE (1100)
  • EER (1100)
  • SPLIT (1000)
  • PING (0100)
  • RESRV (0000)

Control Transfer Packet¶

Setup Packet:

bmReqest Type:
- Transfer Direction
- Host -> Device (request_type |= 0x0 << 7)
- Device -> Host (request_type |= 0x1 << 7)
- Type
- Standard (request_type |= 0x00 << 5)
- Class (request_type |= 0x01 << 5)
- Vendor (request_type |= 0x10 << 5)
- Reserved (request_type |= 0x11 << 5)
- Recipient
- Device (request_type |= 0x00000 )
- Interface (request_type |= 0x00001 )
- Endpoint (request_type |= 0x00010 )
- Other (request_type |= 0x00011 )
- Reserved (request_type |= 0x00000 )

bRequest:

wValue:

wIndex:

wLength:
- If this is non Zero. This means that there will be a data phase that follows this.
- If Transfer Direction is set to Device -> Host then will receive data from the device
- If Transfer Direction is set to Host -> Device then will send data to the device
- Once this is done a Zero length packet is sent to show that the data is done