# This file is part of Scapy # See http://www.secdev.org/projects/scapy for more information # Copyright (C) Philippe Biondi # Copyright (C) Gabriel Potter # This program is published under a GPLv2 license """ Default USB frames & Basic implementation """ # TODO: support USB headers for Linux and Darwin (usbmon/netmon) # https://github.com/wireshark/wireshark/blob/master/epan/dissectors/packet-usb.c # noqa: E501 import re import subprocess from scapy.config import conf from scapy.consts import WINDOWS from scapy.compat import chb, plain_str from scapy.data import MTU, DLT_USBPCAP from scapy.error import warning from scapy.fields import ByteField, XByteField, ByteEnumField, LEShortField, \ LEShortEnumField, LEIntField, LEIntEnumField, XLELongField, \ LenField from scapy.packet import Packet, bind_top_down from scapy.supersocket import SuperSocket from scapy.utils import PcapReader # USBpcap _usbd_status_codes = { 0x00000000: "Success", 0x40000000: "Pending", 0xC0000000: "Halted", 0x80000000: "Error" } _transfer_types = { 0x0: "Isochronous", 0x1: "Interrupt", 0x2: "Control" } # From https://github.com/wireshark/wireshark/blob/master/epan/dissectors/packet-usb.c # noqa: E501 _urb_functions = { 0x0008: "URB_FUNCTION_CONTROL_TRANSFER", 0x0009: "URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER", 0x000A: "URB_FUNCTION_ISOCH_TRANSFER", 0x000B: "URB_FUNCTION_GET_DESCRIPTOR_FROM_DEVICE", 0x000C: "URB_FUNCTION_SET_DESCRIPTOR_TO_DEVICE", 0x000D: "URB_FUNCTION_SET_FEATURE_TO_DEVICE", 0x000E: "URB_FUNCTION_SET_FEATURE_TO_INTERFACE", 0x000F: "URB_FUNCTION_SET_FEATURE_TO_ENDPOINT", 0x0010: "URB_FUNCTION_CLEAR_FEATURE_TO_DEVICE", 0x0011: "URB_FUNCTION_CLEAR_FEATURE_TO_INTERFACE", 0x0012: "URB_FUNCTION_CLEAR_FEATURE_TO_ENDPOINT", 0x0013: "URB_FUNCTION_GET_STATUS_FROM_DEVICE", 0x0014: "URB_FUNCTION_GET_STATUS_FROM_INTERFACE", 0x0015: "URB_FUNCTION_GET_STATUS_FROM_ENDPOINT", 0x0017: "URB_FUNCTION_VENDOR_DEVICE", 0x0018: "URB_FUNCTION_VENDOR_INTERFACE", 0x0019: "URB_FUNCTION_VENDOR_ENDPOINT", 0x001A: "URB_FUNCTION_CLASS_DEVICE", 0x001B: "URB_FUNCTION_CLASS_INTERFACE", 0x001C: "URB_FUNCTION_CLASS_ENDPOINT", 0x001F: "URB_FUNCTION_CLASS_OTHER", 0x0020: "URB_FUNCTION_VENDOR_OTHER", 0x0021: "URB_FUNCTION_GET_STATUS_FROM_OTHER", 0x0022: "URB_FUNCTION_CLEAR_FEATURE_TO_OTHER", 0x0023: "URB_FUNCTION_SET_FEATURE_TO_OTHER", 0x0024: "URB_FUNCTION_GET_DESCRIPTOR_FROM_ENDPOINT", 0x0025: "URB_FUNCTION_SET_DESCRIPTOR_TO_ENDPOINT", 0x0026: "URB_FUNCTION_GET_CONFIGURATION", 0x0027: "URB_FUNCTION_GET_INTERFACE", 0x0028: "URB_FUNCTION_GET_DESCRIPTOR_FROM_INTERFACE", 0x0029: "URB_FUNCTION_SET_DESCRIPTOR_TO_INTERFACE", 0x002A: "URB_FUNCTION_GET_MS_FEATURE_DESCRIPTOR", 0x0032: "URB_FUNCTION_CONTROL_TRANSFER_EX", 0x0037: "URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER_USING_CHAINED_MDL", 0x0002: "URB_FUNCTION_ABORT_PIPE", 0x001E: "URB_FUNCTION_SYNC_RESET_PIPE_AND_CLEAR_STALL", 0x0030: "URB_FUNCTION_SYNC_RESET_PIPE", 0x0031: "URB_FUNCTION_SYNC_CLEAR_STALL", } class USBpcap(Packet): name = "USBpcap URB" fields_desc = [ByteField("headerLen", None), ByteField("res", 0), XLELongField("irpId", 0), LEIntEnumField("usbd_status", 0x0, _usbd_status_codes), LEShortEnumField("function", 0, _urb_functions), XByteField("info", 0), LEShortField("bus", 0), LEShortField("device", 0), XByteField("endpoint", 0), ByteEnumField("transfer", 0, _transfer_types), LenField("dataLength", None, fmt="