Hello !!


I'm trying to filter usb transfer from/to a device to/from the host.

My first goal is to print URB transfer from kernel. But i don't know where i need to modify kernel source to do that.

There is hcd.c, usb.c or urb.c lib which looks like good (in particular hcd) with function as "usb_hcd_submit_urb()". But i'm not sure from where to begin.

I want to print this urb at the lower layer is possible to do.

Could you help me ?
Thank you very much !!

I can only provide general advice here as I don't have direct experience with attempting this. As a start you might want to investigate using the usbmon module and wireshark

Some useful references:
http://dan3lmi.blogspot.co.nz/2012/1...different.html
https://wiki.wireshark.org/CaptureSetup/USB

Good luck.

Hi !

Thank you for you answer !

But i've already look at usbmon, and usbmon capture usb traffic between usbcore and user spacer.

I've read that USB transfer were handle in usbcore thanks to the UHCD (USB Host Controller Driver) and/or by USB Host Driver.

Cf this picture : http://img.my.csdn.net/uploads/20120...745829QFit.gif

But i've understand what i want, it's to patch this source file .c of the kernel to have result as usbmon, or more informations ^^


Thank you very much for your help !

That's well past my ability, and it's not a trivial task I can imagine!

You mentioned in your opening post
What kind of device(s) are you interested in here? That might influence the method of attack.

I guess you're already very familiar with USB drivers and Linux stack, but I thought I'd share these links anyway...
http://www.linux-usb.org/
https://www.mattcutts.com/blog/linux...e-driver-info/
http://matthias.vallentin.net/blog/2...wn-usb-device/

Hello


Tahnk you !

Yes i've already visited this but it's a level too higher layer. I need to go to the lower layer is possible.

To begin, i'm wanted to filter HID USB (mice, keyboard, ...). I don't know if it's possible to intercept usb packet. Look at : Image

If I refer to it, I could filter usb packet on USB Host Controller Driver, so i need to modify ehci-???.c on the source drivers/usb/host. But I don't know where ?

Maybe i make wrong way, and I don't understand, or maybe it's not possible (Don't say yes x) ).

I do it for a project, because i'm in intership.

Thanks for all !