Skip to content

Instantly share code, notes, and snippets.

@abarisani

abarisani/usb_fingerprinting.md

Last active May 5, 2022 11:47
Show Gist options
  • Star 8 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save abarisani/4595a7c535435038e0571237893c81c4 to your computer and use it in GitHub Desktop.
Save abarisani/4595a7c535435038e0571237893c81c4 to your computer and use it in GitHub Desktop.
Download ZIP
Fingerprinting USB enumeration from different hosts
Raw
usb_fingerprinting.md

Introduction

The following information illustrates the differences between macOS, Windows and Linux in USB device enumeration sequence.

Specifically the comparison covers USB Mass Storage device enumeration, implemented with the TamaGo USB driver on a USB armory Mk II running armory-ums.

USB UMS setup sequence summary

  • macOS 10.15.5:

    1. set address
    2. get device descriptor (bLength)
    3. get string descriptors, without language/zero (1st: 2 bytes, 2nd: bLength)
    4. get configuration descriptor (1st: bLength, 2nd: wTotalLength)

  • Linux 5.7.1:

    1. get device descriptor (64 bytes)
    2. set address
    3. get device descriptor (bLength)
    4. get configuration descriptor (1st: bLength, 2nd: wTotalLength)
    5. get string descriptors, including language/zero (255 bytes)

  • Windows 10:

    1. get device descriptor (64 bytes)
    2. set address
    3. get device descriptor (bLength)
    4. get configuration descriptor (255 bytes)
    5. get string descriptors, including language/zero (255 bytes)
    6. get device descriptor (bLength)
    7. get configuration descriptor (1st: bLength, 2nd: wTotalLength)
    8. get string descriptors, including language/zero (1st: 2 bytes, 2nd: bLength)

USB UMS setup example - macOS 10.15.5

setup: &{RequestType:0 Request:5 Value:256 Index:0 Length:0}
imx6_usb: setting address 1
setup: &{RequestType:128 Request:6 Value:1 Index:0 Length:18}
imx6_usb: sending device descriptor
setup: &{RequestType:128 Request:6 Value:515 Index:1033 Length:2}
imx6_usb: sending string descriptor 2: "TamaGo"
setup: &{RequestType:128 Request:6 Value:515 Index:1033 Length:14}
imx6_usb: sending string descriptor 2: "TamaGo"
setup: &{RequestType:128 Request:6 Value:259 Index:1033 Length:2}
imx6_usb: sending string descriptor 1: "F-Secure"
setup: &{RequestType:128 Request:6 Value:259 Index:1033 Length:18}
imx6_usb: sending string descriptor 1: "F-Secure"
setup: &{RequestType:128 Request:6 Value:771 Index:1033 Length:2}
imx6_usb: sending string descriptor 3: "0011223344556677"
setup: &{RequestType:128 Request:6 Value:771 Index:1033 Length:34}
imx6_usb: sending string descriptor 3: "0011223344556677"
setup: &{RequestType:128 Request:6 Value:2 Index:0 Length:9}
imx6_usb: sending configuration descriptor 0 (9 bytes)
setup: &{RequestType:128 Request:6 Value:2 Index:0 Length:32}
imx6_usb: sending configuration descriptor 0 (32 bytes)
setup: &{RequestType:0 Request:9 Value:256 Index:0 Length:0}
imx6_usb: setting configuration value 1
imx6_usb: enabling EP1.0
imx6_usb: enabling EP1.1
setup: &{RequestType:161 Request:254 Value:0 Index:0 Length:1}

USB UMS setup example - Linux 5.7.1

setup: &{RequestType:128 Request:6 Value:1 Index:0 Length:64}
imx6_usb: sending device descriptor
setup: &{RequestType:0 Request:5 Value:8192 Index:0 Length:0}
imx6_usb: setting address 32
setup: &{RequestType:128 Request:6 Value:1 Index:0 Length:18}
imx6_usb: sending device descriptor
setup: &{RequestType:128 Request:6 Value:2 Index:0 Length:9}
imx6_usb: sending configuration descriptor 0 (9 bytes)
setup: &{RequestType:128 Request:6 Value:2 Index:0 Length:32}
imx6_usb: sending configuration descriptor 0 (32 bytes)
setup: &{RequestType:128 Request:6 Value:3 Index:0 Length:255}
imx6_usb: sending string descriptor zero
setup: &{RequestType:128 Request:6 Value:515 Index:1033 Length:255}
imx6_usb: sending string descriptor 2: "TamaGo"
setup: &{RequestType:128 Request:6 Value:259 Index:1033 Length:255}
imx6_usb: sending string descriptor 1: "F-Secure"
setup: &{RequestType:128 Request:6 Value:771 Index:1033 Length:255}
imx6_usb: sending string descriptor 3: "0011223344556677"
setup: &{RequestType:0 Request:9 Value:256 Index:0 Length:0}
imx6_usb: setting configuration value 1
imx6_usb: enabling EP1.1
imx6_usb: enabling EP1.0
setup: &{RequestType:161 Request:254 Value:0 Index:0 Length:1}

USB UMS setup example - Windows 10

setup: &{RequestType:128 Request:6 Value:1 Index:0 Length:64}
imx6_usb: sending device descriptor 
setup: &{RequestType:0 Request:5 Value:1280 Index:0 Length:0}
imx6_usb: setting address 5
setup: &{RequestType:128 Request:6 Value:1 Index:0 Length:18}
imx6_usb: sending device descriptor 
setup: &{RequestType:128 Request:6 Value:2 Index:0 Length:255}
imx6_usb: sending configuration descriptor 0 (255 bytes)
setup: &{RequestType:128 Request:6 Value:771 Index:1033 Length:255}
imx6_usb: sending string descriptor 3: "0011223344556677"
setup: &{RequestType:128 Request:6 Value:3 Index:0 Length:255}
imx6_usb: sending string descriptor zero
setup: &{RequestType:128 Request:6 Value:515 Index:1033 Length:255}
imx6_usb: sending string descriptor 2: "TamaGo"
setup: &{RequestType:128 Request:6 Value:1 Index:0 Length:18}
imx6_usb: sending device descriptor
setup: &{RequestType:128 Request:6 Value:2 Index:0 Length:9}
imx6_usb: sending configuration descriptor 0 (9 bytes)
setup: &{RequestType:128 Request:6 Value:2 Index:0 Length:32}
imx6_usb: sending configuration descriptor 0 (32 bytes)
setup: &{RequestType:128 Request:6 Value:3 Index:0 Length:2}
imx6_usb: sending string descriptor zero
setup: &{RequestType:128 Request:6 Value:3 Index:0 Length:4}
imx6_usb: sending string descriptor zero
setup: &{RequestType:128 Request:6 Value:771 Index:1033 Length:2}
imx6_usb: sending string descriptor 3: "0011223344556677"
setup: &{RequestType:128 Request:6 Value:771 Index:1033 Length:34}
imx6_usb: sending string descriptor 3: "0011223344556677"
setup: &{RequestType:0 Request:9 Value:256 Index:0 Length:0}
imx6_usb: setting configuration value 1
imx6_usb: enabling EP1.1
imx6_usb: enabling EP1.0
setup: &{RequestType:161 Request:254 Value:0 Index:0 Length:1}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment