使用Ubuntu下usb抓包工具(usbmon)进行数据抓取的一次记录

前言

使用反汇编还原的库调试打印机网络作业设置，打印出来的日志与原库有出入，在usb传输处始终有偏差。

调用反汇编还原的库：

DEBUG: Net_OnlyGetDataSizeFromReplyHdr:: In DEBUG: getNetDataByPrinterPipe:: No data need to readback DEBUG: getNetDataByPrinterPipe:: Out. rc = 1

调用原库：

DEBUG: Net_OnlyGetDataSizeFromReplyHdr:: In DEBUG: getNetDataByPrinterPipe:: readByte = 344 DEBUG: getNetDataByPrinterPipe:: malloc revBuf 344 bytes success. DEBUG: getNetDataByPrinterPipe:: Read Data Success DEBUG: getNetDataByPrinterPipe:: Receive Data, transferred = 344 DEBUG: getNetDataByPrinterPipe:: Out. rc = 1

usb传输 原库汇编片段：

.text:0000000000046C4E mov esi, [lpPrinter+220h] .text:0000000000046C54 lea rdi, aGetnetdatabypr_12 .text:0000000000046C5B xor eax, eax .text:0000000000046C5D call _DbgMsg .text:0000000000046C62 movzx esi, byte ptr [lpPrinter+220h] .text:0000000000046C69 mov rdi, [rsp+0B8h+handle] .text:0000000000046C6E mov r9d, 1388h .text:0000000000046C74 mov ecx, [rsp+0B8h+bufSize] .text:0000000000046C78 mov r8, r12 .text:0000000000046C7B mov rdx, r13 .text:0000000000046C7E call _libusb_bulk_transfer .text:0000000000046C83 errcode = rax ; int .text:0000000000046C83 test eax, eax .text:0000000000046C85 mov esi, eax .text:0000000000046C87 lea rdi, aGetnetdatabypr_13 .text:0000000000046C8E js short loc_46CCF .text:0000000000046C90 lea rdi, aGetnetdatabypr_14 .text:0000000000046C97 xor eax, eax .text:0000000000046C99 errcode = rsi ; int .text:0000000000046C99 call _DbgMsg .text:0000000000046C9E movzx esi, byte ptr [lpPrinter+21Ch] .text:0000000000046CA5 mov rdx, [rsp+0B8h+readBack] .text:0000000000046CAA mov r9d, 1388h .text:0000000000046CB0 mov rdi, [rsp+0B8h+handle] .text:0000000000046CB5 mov r8, r12 .text:0000000000046CB8 mov ecx, 20h .text:0000000000046CBD call _libusb_bulk_transfer .text:0000000000046CC2 errcode = rax ; int .text:0000000000046CC2 test eax, eax .text:0000000000046CC4 jns short loc_46CDE .text:0000000000046CC6 lea rdi, aGetnetdatabypr_15 .text:0000000000046CCD mov esi, eax .text:0000000000046CCF .text:0000000000046CCF loc_46CCF: ; CODE XREF: getNetDataByPrinterPipe+2D0↑j .text:0000000000046CCF xor eax, eax .text:0000000000046CD1 errcode = rsi ; int .text:0000000000046CD1 call _DbgMsg .text:0000000000046CD6 .text:0000000000046CD6 loc_46CD6: ; CODE XREF: getNetDataByPrinterPipe+343↓j .text:0000000000046CD6 xor r14d, r14d .text:0000000000046CD9 jmp loc_46D92 .text:0000000000046CDE ; --------------------------------------------------------------------------- .text:0000000000046CDE .text:0000000000046CDE loc_46CDE: ; CODE XREF: getNetDataByPrinterPipe+306↑j .text:0000000000046CDE inBuf = r14 ; BYTE * .text:0000000000046CDE errcode = rax ; int .text:0000000000046CDE lea rdi, aGetnetdatabypr_16 .text:0000000000046CE5 xor eax, eax .text:0000000000046CE7 call _DbgMsg .text:0000000000046CEC cmp [rsp+0B8h+transferred], 20h .text:0000000000046CF1 jz short loc_46D03 .text:0000000000046CF3 lea rdi, aGetnetdatabypr_17 .text:0000000000046CFA xor eax, eax .text:0000000000046CFC call _DbgMsg .text:0000000000046D01 jmp short loc_46CD6 .text:0000000000046D03 ; --------------------------------------------------------------------------- .text:0000000000046D03 .text:0000000000046D03 loc_46D03: ; CODE XREF: getNetDataByPrinterPipe+333↑j .text:0000000000046D03 mov rdi, [rsp+0B8h+readBack] ; readBack .text:0000000000046D08 call _Net_OnlyGetDataSizeFromReplyHdr .text:0000000000046D0D readByte = rax ; int .text:0000000000046D0D test eax, eax .text:0000000000046D0F jnz short loc_46D25 .text:0000000000046D11 lea rdi, aGetnetdatabypr_18 .text:0000000000046D18 xor r14d, r14d .text:0000000000046D1B call _DbgMsg .text:0000000000046D20 jmp loc_46DC3 .text:0000000000046D25 ; --------------------------------------------------------------------------- .text:0000000000046D25 .text:0000000000046D25 loc_46D25: ; CODE XREF: getNetDataByPrinterPipe+351↑j .text:0000000000046D25 inBuf = r14 ; BYTE * .text:0000000000046D25 readByte = rax ; int .text:0000000000046D25 lea rdi, aGetnetdatabypr_19 .text:0000000000046D2C mov esi, eax .text:0000000000046D2E movsxd r15, ebx .text:0000000000046D31 xor eax, eax .text:0000000000046D33 readByte = rsi ; int .text:0000000000046D33 call _DbgMsg

逆向还原出来的代码片段：

// 发送writeBuf中指令到打印机 rsl = libusb_bulk_transfer(handle, lpPrinter->usb.printer_EP_OUT, writeBuf, bufSize, &transferred, 5000); if( rsl != 0 ) { DbgMsg("getNetDataByPrinterPipe:: (1)Error during control transfer: errorcode = %d", rsl); revBuf = NULL; rc = 0; free(writeBuf); goto func_end; } DbgMsg("getNetDataByPrinterPipe:: Write command success"); // 接收打印机返回指令保存到replyHeader rsl = libusb_bulk_transfer(handle, lpPrinter->usb.printer_EP_IN, replyHeader, sizeof(replyHeader), &transferred, 5000); if( rsl != 0 ) { DbgMsg("getNetDataByPrinterPipe:: (2)Error libusb_bulk_transfer transfer: errorcode = %d", rsl); revBuf = NULL; rc = 0; free(writeBuf); goto func_end; } DbgMsg("getNetDataByPrinterPipe:: Read ReplyHeader Success"); // 接收的字节数是否与replyHeader数组长度相等，相等则接收成功 if( transferred != sizeof(replyHeader) ) { DbgMsg("getNetDataByPrinterPipe:: transferred != %d", sizeof(replyHeader)); revBuf = NULL; rc = 0; free(writeBuf); goto func_end; } //replyHeader中是否有回读指令 readByte = Net_OnlyGetDataSizeFromReplyHdr(replyHeader); if( !readByte ) { DbgMsg("getNetDataByPrinterPipe:: No data need to readback"); revBuf = NULL; rc = 1; free(writeBuf); goto func_end; } DbgMsg("getNetDataByPrinterPipe:: readByte = %d", readByte);

终究还是我才疏学浅，对半天汇编找不到哪里错了。于是抓取原库usb传输数据与还原库的数据对比查看。

正文

usbmon是ubuntu下内置的usb抓包工具。

neko@neko:~$ ls /lib/modules/4.15.0-20-generic/kernel/drivers/usb/mon/ usbmon.ko

使用方法 1）运行 sudo mount -t debugfs none /sys/kernel/debug （一般已经默认挂载） 2）运行 sudo modprobe usbmon 3）查看能够识别到的设备号：sudo ls /sys/kernel/debug/usb/usbmon

neko@neko:~$ sudo ls /sys/kernel/debug/usb/usbmon 0s 0u 1s 1t 1u 2s 2t 2u

4）查看需要监控的总线编号(Bus)：sudo cat /sys/kernel/debug/usb/devices

neko@neko:~$ sudo cat /sys/kernel/debug/usb/devices T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 12 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=0638 ProdID=2e0f Rev= 0.01 S: Manufacturer=ZHONGCHU S: Product=ZHONGCHU ZC-P6900DN S: SerialNumber=AAAAAAA C:* #Ifs= 2 Cfg#= 1 Atr=c0 MxPwr= 2mA I:* If#= 0 Alt= 0 #EPs= 5 Cls=06(still) Sub=ff Prot=ff Driver=(none) E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 32 Ivl=64ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=07(print) Sub=01 Prot=02 Driver=(none) E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms T: Bus=02 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=12 MxCh= 2 B: Alloc= 17/900 us ( 2%), #Int= 1, #Iso= 0 D: Ver= 1.10 Cls=09(hub ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1d6b ProdID=0001 Rev= 4.15 S: Manufacturer=Linux 4.15.0-20-generic uhci_hcd S: Product=UHCI Host Controller S: SerialNumber=0000:02:00.0 C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr= 0mA I:* If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub E: Ad=81(I) Atr=03(Int.) MxPS= 2 Ivl=255ms

根据设备的信息，如PID、VID、设备描述等，找到对应设备，则可知总线编号。 如我要找的设备信息如下，则对应的总线编号应为Bus=01，即我要监控的usb总线号为01

P: Vendor=0638 ProdID=2e0f Rev= 0.01 S: Manufacturer=ZHONGCHU S: Product=ZHONGCHU ZC-P6900DN

4）监听总线号所对应的usb数据包：cat /sys/kernel/debug/usb/usbmon/xu 这里x是总线号，我要监控的是Bus=01，故x对应1。若是想监听全部的数据包，x应为0

调用原库抓取的数据包：

neko@neko:~$ sudo cat /sys/kernel/debug/usb/usbmon/1u ffff952ac43140c0 3004133315 S Ci:1:012:0 s a1 00 0000 0000 0400 1024 < ffff952ac43140c0 3004133626 C Ci:1:012:0 0 103 = 00674d46 473a5a48 4f4e4743 4855203b 434d443a 4d465058 444d413b 4d444c3a ffff952ac43140c0 3004133753 S Ci:1:012:0 s 80 06 0300 0000 00ff 255 < ffff952ac43140c0 3004134909 C Ci:1:012:0 0 4 = 04030904 ffff952ac43140c0 3004134983 S Ci:1:012:0 s 80 06 0303 0409 00ff 255 < ffff952ac43140c0 3004137237 C Ci:1:012:0 0 16 = 10034100 41004100 41004100 41004100 ffff952ac6b58d80 3004427176 S Bo:1:012:1 -115 114 = 1b252d31 32333435 5840504a 4c20454e 54455220 4c414e47 55414745 203d2052 ffff952ac6b58d80 3004427585 C Bo:1:012:1 0 114 > ffff952ac6b58d80 3004427627 S Bi:1:012:1 -115 32 < ffff952ac6b58d80 3004441157 C Bi:1:012:1 0 32 = 23524553 4f504552 07018133 00000000 58010000 f7280000 00000000 00000000 ffff952ac6b58d80 3004441297 S Bi:1:012:1 -115 344 < ffff952ac6b58d80 3004442327 C Bi:1:012:1 0 344 = 9033c3ec 88550000 00000000 65000000 01000000 1b000000 2f6f7267 2f667265 ffff952ac6b58d80 3004442827 S Bo:1:012:1 -115 114 = 1b252d31 32333435 5840504a 4c20454e 54455220 4c414e47 55414745 203d2052 ffff952ac6b58d80 3004444242 C Bo:1:012:1 0 114 > ffff952ac6b58d80 3004444319 S Bi:1:012:1 -115 32 < ffff952ac6b58d80 3004451656 C Bi:1:012:1 0 32 = 23524553 4f504552 07018134 00000000 06000000 c4010000 00000000 00000000 ffff952ac6b58d80 3004451827 S Bi:1:012:1 -115 6 < ffff952ac6b58d80 3004453138 C Bi:1:012:1 0 6 = 00023251 59e6 ffff952ac6b58d80 3004453593 S Bo:1:012:1 -115 114 = 1b252d31 32333435 5840504a 4c20454e 54455220 4c414e47 55414745 203d2052 ffff952ac6b58d80 3004454791 C Bo:1:012:1 0 114 > ffff952ac6b58d80 3004454851 S Bi:1:012:1 -115 32 < ffff952ac6b58d80 3004459528 C Bi:1:012:1 0 32 = 23524553 4f504552 07018135 00000000 06000000 00000000 00000000 00000000 ffff952ac6b58d80 3004459665 S Bi:1:012:1 -115 6 < ffff952ac6b58d80 3004460768 C Bi:1:012:1 0 6 = 00000000 0000 ffff952ac43e5bc0 3019919468 S Ci:1:012:0 s a1 00 0000 0000 0400 1024 < ffff952ac43e5bc0 3019919821 C Ci:1:012:0 0 103 = 00674d46 473a5a48 4f4e4743 4855203b 434d443a 4d465058 444d413b 4d444c3a ffff952ac43e5bc0 3019920003 S Ci:1:012:0 s 80 06 0300 0000 00ff 255 < ffff952ac43e5bc0 3019921667 C Ci:1:012:0 0 4 = 04030904 ffff952ac43e5bc0 3019921765 S Ci:1:012:0 s 80 06 0303 0409 00ff 255 < ffff952ac43e5bc0 3019923118 C Ci:1:012:0 0 16 = 10034100 41004100 41004100 41004100 ffff952ac6b58cc0 3020193373 S Bo:1:012:1 -115 458 = 1b252d31 32333435 5840504a 4c20454e 54455220 4c414e47 55414745 203d2052 ffff952ac6b58cc0 3020193645 C Bo:1:012:1 0 458 > ffff952ac6b58cc0 3020193688 S Bi:1:012:1 -115 32 < ffff952ac6b58cc0 3020200401 C Bi:1:012:1 0 32 = 23524553 4f504552 07018236 00000000 00000000 00000000 00000000 00000000

调用逆向还原的库抓取的数据：

neko@neko:~$ sudo cat /sys/kernel/debug/usb/usbmon/1u ffff952aefab2540 3248502374 S Ci:1:012:0 s a1 00 0000 0000 0400 1024 < ffff952aefab2540 3248502807 C Ci:1:012:0 0 103 = 00674d46 473a5a48 4f4e4743 4855203b 434d443a 4d465058 444d413b 4d444c3a ffff952aefab2540 3248503007 S Ci:1:012:0 s 80 06 0300 0000 00ff 255 < ffff952aefab2540 3248504003 C Ci:1:012:0 0 4 = 04030904 ffff952ac43e4900 3248505240 S Ci:1:012:0 s 80 06 0303 0409 00ff 255 < ffff952ac43e4900 3248506024 C Ci:1:012:0 0 16 = 10034100 41004100 41004100 41004100 ffff952ac43e5380 3248788561 S Bo:1:012:1 -115 114 = 1b252d31 32333435 5840504a 4c20454e 54455220 4c414e47 55414745 203d2052 ffff952ac43e5380 3248788829 C Bo:1:012:1 0 114 > ffff952ac43e5380 3248788958 S Bi:1:012:1 -115 32 < ffff952ac43e5380 3248794049 C Bi:1:012:1 0 32 = 23524553 4f504552 07018133 00010000 00000000 00000000 00000000 00000000 ffff952ac43e5380 3248795935 S Bo:1:012:1 -115 114 = 1b252d31 32333435 5840504a 4c20454e 54455220 4c414e47 55414745 203d2052 ffff952ac43e5380 3248796883 C Bo:1:012:1 0 114 > ffff952ac43e5380 3248797023 S Bi:1:012:1 -115 32 < ffff952ac43e5380 3248803548 C Bi:1:012:1 0 32 = 23524553 4f504552 07018134 00010000 00000000 00000000 00000000 00000000 ffff952ac43e5380 3248805724 S Bo:1:012:1 -115 114 = 1b252d31 32333435 5840504a 4c20454e 54455220 4c414e47 55414745 203d2052 ffff952ac43e5380 3248806825 C Bo:1:012:1 0 114 > ffff952ac43e5380 3248806963 S Bi:1:012:1 -115 32 < ffff952ac43e5380 3248813440 C Bi:1:012:1 0 32 = 23524553 4f504552 07018135 00010000 00000000 00000000 00000000 00000000 ffff952ac43152c0 3251683411 S Ci:1:012:0 s a1 00 0000 0000 0400 1024 < ffff952ac43152c0 3251683764 C Ci:1:012:0 0 103 = 00674d46 473a5a48 4f4e4743 4855203b 434d443a 4d465058 444d413b 4d444c3a ffff952ac43152c0 3251683898 S Ci:1:012:0 s 80 06 0300 0000 00ff 255 < ffff952ac43152c0 3251685598 C Ci:1:012:0 0 4 = 04030904 ffff952ac43152c0 3251685695 S Ci:1:012:0 s 80 06 0303 0409 00ff 255 < ffff952ac43152c0 3251686886 C Ci:1:012:0 0 16 = 10034100 41004100 41004100 41004100 ffff952aefab29c0 3601628752 S Ci:1:012:0 s a1 00 0000 0000 0400 1024 < ffff952aefab29c0 3601629096 C Ci:1:012:0 0 103 = 00674d46 473a5a48 4f4e4743 4855203b 434d443a 4d465058 444d413b 4d444c3a ffff952aefab29c0 3601629223 S Ci:1:012:0 s 80 06 0300 0000 00ff 255 < ffff952aefab29c0 3601630282 C Ci:1:012:0 0 4 = 04030904 ffff952aefab29c0 3601630398 S Ci:1:012:0 s 80 06 0303 0409 00ff 255 < ffff952aefab29c0 3601631788 C Ci:1:012:0 0 16 = 10034100 41004100 41004100 41004100 ffff952aefab2840 3601941687 S Bo:1:012:1 -115 114 = 1b252d31 32333435 5840504a 4c20454e 54455220 4c414e47 55414745 203d2052 ffff952aefab2840 3601941951 C Bo:1:012:1 0 114 > ffff952aefab2840 3601942101 S Bi:1:012:1 -115 32 < ffff952aefab2840 3601947329 C Bi:1:012:1 0 32 = 23524553 4f504552 07018133 00010000 00000000 00000000 00000000 00000000 ffff952aefab2840 3601951485 S Bo:1:012:1 -115 114 = 1b252d31 32333435 5840504a 4c20454e 54455220 4c414e47 55414745 203d2052 ffff952aefab2840 3601951996 C Bo:1:012:1 0 114 > ffff952aefab2840 3601952184 S Bi:1:012:1 -115 32 < ffff952aefab2840 3601956917 C Bi:1:012:1 0 32 = 23524553 4f504552 07018134 00010000 00000000 00000000 00000000 00000000 ffff952ac43e4cc0 3601961587 S Bo:1:012:1 -115 114 = 1b252d31 32333435 5840504a 4c20454e 54455220 4c414e47 55414745 203d2052 ffff952ac43e4cc0 3601962277 C Bo:1:012:1 0 114 > ffff952ac43e4cc0 3601962619 S Bi:1:012:1 -115 32 < ffff952ac43e4cc0 3601966634 C Bi:1:012:1 0 32 = 23524553 4f504552 07018135 00010000 00000000 00000000 00000000 00000000

这里writeBuf发送的是114个字节数据，replyHeader接收32个字节数据。经对比看到发送的数据内容一致，而接收回来的数据内容不一样。按理来说发出去的一样，接收回来的也应该一样。目前还在找原因，解决问题了再更新。

要分析usb抓包后的数据，具体的数据格式如何解析，可以参考Linux内核源码库目录下的文档 ： kernel\doc\Documentation\usb\usbmon.txt 或内核官方网站文档

有大佬能看出来的还请留言指点迷津，感谢！