EE 587 Advanced Embedded Systems USB software sniffers EE 587 Advanced Embedded Systems Prof. James E. Lumpp Presented by Sri Harsha Yenuganti Wednesday, February 14, 2018 USB software Sniffers

What are we going to see today? Today we are going to see some of the free software USB sniffers available . We will compare them and analyze their use for our application. The sniffers explained are SniffUSB/USB Snoopy( Free ) Snoopy Pro ( Free ) USBSpy ( $49.00) Wednesday, February 14, 2018 USB software Sniffers

SniffUSB Screenshot Wednesday, February 14, 2018 USB software Sniffers

Sniff USB Log file [0 ms] UsbSnoop compiled on Jan 18 2003 22:41:32 loading [0 ms] UsbSnoop - DriverEntry(ba0b0c40) : Windows NT WDM version 1.32 [28 ms] UsbSnoop - AddDevice(ba0b0f50) : DriverObject 849ac1e8, pdo 849f15b8 [29 ms] UsbSnoop - DispatchAny(ba0ae610) : IRP_MJ_PNP (0x00000018) [29 ms] UsbSnoop - MyDispatchPNP(ba0b0ee0) : IRP_MJ_PNP (0x00000018) [29 ms] UsbSnoop - DispatchAny(ba0ae610) : IRP_MJ_PNP (IRP_MN_QUERY_RESOURCE_REQUIREMENTS) [29 ms] UsbSnoop - MyDispatchPNP(ba0b0ee0) : IRP_MJ_PNP (IRP_MN_QUERY_RESOURCE_REQUIREMENTS) [56709 ms] UsbSnoop - DispatchAny(ba0ae610) : IRP_MJ_PNP (IRP_MN_QUERY_DEVICE_RELATIONS) [56709 ms] UsbSnoop - MyDispatchPNP(ba0b0ee0) : IRP_MJ_PNP (IRP_MN_QUERY_DEVICE_RELATIONS) [56714 ms] UsbSnoop - DispatchAny(ba0ae610) : IRP_MJ_PNP (IRP_MN_REMOVE_DEVICE) [56714 ms] UsbSnoop - MyDispatchPNP(ba0b0ee0) : IRP_MJ_PNP (IRP_MN_REMOVE_DEVICE) [56714 ms] UsbSnoop - RemoveDevice(ba0b0e90) : fido=8465ed38 pdx=8465edf0 [56714 ms] UsbSnoop - DriverUnload(ba0b0de0) : DriverObject 849ac1e8, IRQL=0 [56714 ms] Driver unloaded! MyThreadFunction : myMsgCount=15 myMaxSemaphoreCount=3 myMaxIrql=0, myAllocationFailed=0, mySemaphoreFailed=0 Wednesday, February 14, 2018 USB software Sniffers

SnoopyPro A free USB sniffing software. It allows you to record each URB sent to and received from a USB device. WARNING: Don't use it if you don't know what you're doing!!!! We're not responsible for anything that happens to you, your system, your devices, your marriage, etc. etc. User must know the VID and PID of the USB Device . Wednesday, February 14, 2018 USB software Sniffers

Screen shot Wednesday, February 14, 2018 USB software Sniffers

Screenshot (contd.) Wednesday, February 14, 2018 USB software Sniffers

Demerits: SnoopyPro has a buffer size limitation making it unable to receive packets above a certain size. If it receives a large packet, it stops logging. Doesn't have a pretty gui for log analysis, but exports every part of the packet into a textual log file. Wednesday, February 14, 2018 USB software Sniffers

USBSpy A Software USB Sniffer(Commercial)

Wednesday, February 14, 2018 USB software Sniffers

USBSpy Features at a Glance Interception of all I/O requests and events between a USD device and its host. USBSpy doesn't create any additional filters, devices that could otherwise destroy the structure of drivers in your system. Extended search and filtering options. Triggers on packet types, device requests, completion statuses, errors, etc. Automatic capture of hot-plugged devices. Interception at system boot. Export of traffic logs into XML. Clear intuitive interface. Wednesday, February 14, 2018 USB software Sniffers

Types of Requests Supported USBSpy, designed for recording and monitoring input/output requests of USB devices, supports the following types of requests: URB (USB Request Block) Hub and HID PNP (Plug'n'Play) Power USB Internal ioctls Remove events Wednesday, February 14, 2018 USB software Sniffers

Merits: Has almost the same data capture facilities as the more expensive ones like USBlyser, USB Monitor. Very cheap. Only $49/single license. Displays the raw data also. Support for triggers available. Facilitates Background capturing. Wednesday, February 14, 2018 USB software Sniffers

Demerits: No support for graph display Only Text display available No export of capture list content or any part of it to plain text, CSV, HTML formats. It only supports .dat and XML formats. Support for multiple devices monitoring at a time. Wednesday, February 14, 2018 USB software Sniffers

Conclusion A brief analysis of 3 software sniffers is presented. SniffUSB seems to be less informative about the data exchanged. Snoopy Pro is the best available free sniffer on the net. But it can sniff only URB packets. USBSpy is almost similar to Snoopy Pro except for the fact that it can sniff more request types than the snoopy Pro which can do only URB packet sniffs. Any Queries ? Wednesday, February 14, 2018 USB software Sniffers