Hacker News new | ask | show | jobs
by ncmncm 2947 days ago
I see so much custom hardware. Can somebody tell me why running the drivers of interest in a virtualbox/qemu image, and logging interaction on the host OS, doesn't do a better job than custom hardware?
3 comments

I'm not sure why this person listed so much hardware, I've done some USB protocol reversing using a TotalPhase Beagle 480. I think I probably could have done something in software, but the nice thing is the TotalPhase software is a lot like Wireshark -- which I was already familiar with. I wasn't totally familiar with hacking around USB so it made learning how USB worked much easier instead of me just pulling data off the wire and trying to start from scratch.
With the software-only approach (e.g. usbmon), the interface is even more like Wireshark :) https://wiki.wireshark.org/CaptureSetup/USB
Depending on your needs, you absolutely can do it in software. The first few steps are about software, and in particular, probably just using Wireshark + USBPcap or usbmon is sufficient for basic cases.

The hardware side of things is the area that interests me more though, if you want to get into higher speeds than can be handled in software only, or if you want to start doing weird/interesting things in the 'emulate' side of it (not just capturing (eg. facedancer). Coming from a security perspective, those sorts of tools are invaluable for getting to some of the depths that I may want to reach.

Is that possible? I thought vbox et al enabled USB communication by allowing the guest OS drivers to hit the hardware directly.
Maybe you need Linux for the host OS, that not everybody already has. It might be like KVM switches, that nobody using Linux would ever feel like they needed.