linux下UsbMon-WireShark之USB協議抓取分析

yooooooo發表於2024-08-29
Linux協議

usbmon配置

使用usbmon抓包分的，是需要 核心開啟CONFIG_USB_MON=m, 重新編譯核心, 編譯ko :

make ARCH=arm64 CROSS_COMPILE=aarch64-himix100-linux- CONFIG_USB_MON=m  M=./drivers/usb/ modules

裝置掛載debugfs, 載入ko :

mount -t debugfs debugfs /sys/kernel/debug/
insmod usbmon.ko

檢視是否成功產生/sys/kernel/debug/usb/usbmon/目錄 :

[root@dvrdvs config] # ls /sys/kernel/debug/usb/usbmon/
0s  0u  1s  1t  1u  2s  2t  2u  3s  3t  3u  4s  4t  4u

找到所需監控的匯流排編號

執行“cat /sys/kernel/debug/usb/devices”。分別裝置的資訊，包括裝置描述、Vendor、ProdID等。例如：

T:  Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=12  MxCh= 0
D:  Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
P:  Vendor=0557 ProdID=2004 Rev= 1.00
S:  Manufacturer=ATEN
S:  Product=UC100KM V2.00

"Bus=03"指的是3號匯流排。通常使用使用lsusb得到裝置的匯流排號。例如：

Bus 003 Device 002: ID 0557:2004 ATEN UC100KM V2.00

tcpdump 配置

下載最新libpcap和tcpdump, 當前是libpcap-1.9.1和tcpdump-4.9.3.

下載地址 :Index of /release

將libpcap-1.9.1和tcpdump-4.9.3放在同一個目錄下, 先編譯libcap :

  1. ./configure --host=aarch64-himix100-linux --with-pcap=linux
  2. make

再編譯tcpdump :

  1. ./configure --host=aarch64-himix100-linux
  2. make

將tcpdump放到裝置上, 執行./tcpdump -D :

[root@dvrdvs ] # ./tcpdump -D
1.eth0 [Up, Running]
2.lo [Up, Running, Loopback]
3.any (Pseudo-device that captures on all interfaces) [Up, Running]
4.usbmon0 (Raw USB traffic, all USB buses) [none]
5.usbmon1 (Raw USB traffic, bus number 1)
6.usbmon2 (Raw USB traffic, bus number 2)
7.usbmon3 (Raw USB traffic, bus number 3)
8.usbmon4 (Raw USB traffic, bus number 4)
9.eth1 [none]

可以看到有多個usbmon, 這裡檢視一下我們需要的裝置 :

[root@dvrdvs config] # cat /sys/kernel/debug/usb/devices
T:  Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=480  MxCh= 1
B:  Alloc=  0/800 us ( 0%), #Int=  0, #Iso=  0
D:  Ver= 2.00 Cls=09(hub  ) Sub=00 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=1d6b ProdID=0002 Rev= 4.09
S:  Manufacturer=Linux 4.9.37 xhci-hcd
S:  Product=xHCI Host Controller
S:  SerialNumber=12300000.xhci_0
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  0mA
I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   4 Ivl=256ms
T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=480  MxCh= 4
D:  Ver= 2.00 Cls=09(hub  ) Sub=00 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=05e3 ProdID=0608 Rev=85.37
S:  Product=USB2.0 Hub
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   1 Ivl=256ms
T:  Bus=02 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=5000 MxCh= 1
B:  Alloc=  0/800 us ( 0%), #Int=  0, #Iso=  0
D:  Ver= 3.00 Cls=09(hub  ) Sub=00 Prot=03 MxPS= 9 #Cfgs=  1
P:  Vendor=1d6b ProdID=0003 Rev= 4.09
S:  Manufacturer=Linux 4.9.37 xhci-hcd
S:  Product=xHCI Host Controller
S:  SerialNumber=12300000.xhci_0
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  0mA
I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   4 Ivl=256ms
T:  Bus=03 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=480  MxCh= 1
B:  Alloc=  0/800 us ( 0%), #Int=  0, #Iso=  0
D:  Ver= 2.00 Cls=09(hub  ) Sub=00 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=1d6b ProdID=0002 Rev= 4.09
S:  Manufacturer=Linux 4.9.37 xhci-hcd
S:  Product=xHCI Host Controller
S:  SerialNumber=12310000.xhci_1
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  0mA
I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   4 Ivl=256ms
T:  Bus=04 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=5000 MxCh= 1
B:  Alloc=  0/800 us ( 0%), #Int=  0, #Iso=  0
D:  Ver= 3.00 Cls=09(hub  ) Sub=00 Prot=03 MxPS= 9 #Cfgs=  1
P:  Vendor=1d6b ProdID=0003 Rev= 4.09
S:  Manufacturer=Linux 4.9.37 xhci-hcd
S:  Product=xHCI Host Controller
S:  SerialNumber=12310000.xhci_1
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=  0mA
I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub  ) Sub=00 Prot=00 Driver=hub
E:  Ad=81(I) Atr=03(Int.) MxPS=   4 Ivl=256ms
T:  Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  3 Spd=5000 MxCh= 0
D:  Ver= 3.10 Cls=ff(vend.) Sub=00 Prot=00 MxPS= 9 #Cfgs=  2
P:  Vendor=0525 ProdID=a4a0 Rev= 4.09
S:  Manufacturer=Linux 4.9.37 with dwc3-gadget
S:  Product=Gadget Zero
S:  SerialNumber=0123456789.0123456789.0123456789
C:* #Ifs= 1 Cfg#= 3 Atr=c0 MxPwr=  8mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
E:  Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:  If#= 0 Alt= 1 #EPs= 4 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
E:  Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=82(I) Atr=01(Isoc) MxPS=1024 Ivl=1ms
E:  Ad=02(O) Atr=01(Isoc) MxPS=1024 Ivl=1ms
C:  #Ifs= 1 Cfg#= 2 Atr=c0 MxPwr=  8mA
I:  If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=
E:  Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms

選擇包含有 P: Vendor=xxx ProdID=xxx Rev= xxx 的段落（即篩選出你要抓包的USB裝置的PID/VID號）, 如果匯流排號是1(即Bus=01), 則是1u, 如果匯流排號是2, 則是2u, 依次類推.

特殊情況是0u表示監聽所有匯流排.

Gadget Zero的Bus=04, 利用tcpdump擷取usb資料 :

./tcpdump -i usbmon4 -w /home/config/usb_log.pcap

wireshark

wireshark中選擇檔案->開啟, 找到相應的資料, 開啟. (如果沒有, 安裝稍微新一點的wireshark)如圖 :

接下來就可以對裡面的資料進行分析了.

相關文章