Hi.

I use usb-proxy to analyze USB devices and it is very useful. However, it required minor fix to use injection feature in my environment.

Problem

In aarch64, a std::out_of_range exception is thrown if a injection rule doesn't match.

[email protected]:~/work/usb-proxy $ lsb_release -d
Description:    Debian GNU/Linux 11 (bullseye)
[email protected]:~/work/usb-proxy $ uname -a
Linux raspberrypi 5.15.56-v8+ #1575 SMP PREEMPT Fri Jul 22 20:31:26 BST 2022 aarch64 GNU/Linux
[email protected]:~/work/usb-proxy $ sudo ./usb-proxy --device=fe980000.usb --driver=fe980000.usb --vendor_id=0590 --product_id=001a --enable_injection
Device is: fe980000.usb
Driver is: fe980000.usb
vendor_id is: 1424
product_id is: 26
Injection enabled
Parsed injection file: injection.json
Device opened successfully
Setup USB config successfully
Start hotplug_monitor thread, thread id(32888)
Start for EP0, thread id(32886)
event: connect, length: 0
event: control, length: 8
  bRequestType: 0x80  (IN), bRequest: 0x06, wValue: 0x0100, wIndex: 0x0000, wLength: 8
  type = USB_TYPE_STANDARD
  req = USB_REQ_GET_DESCRIPTOR
  desc = USB_DT_DEVICE
terminate called after throwing an instance of 'std::out_of_range'
  what():  basic_string::replace: __pos (which is 4294967295) > this->size() (which is 8)
Aborted

std::basic_string::find returns std::string::npos if the pattern doesn't match. std::string::npos is 18446744073709551615UL in aarch64, but when it is assigned to __u32, it overflows and becomes 4294967295.

Fix

Use std::string::size_type instead of __u32. std::string::size_type is the correct return type for std::basic_string::find.

Alternatively, we can use the auto keyword without std::string::size_type explicitly.

first of all thanks for sharing your work, I successfuly proxied a ethernet adapter but fails with all HID i have

[email protected]:~/usb-proxy $ sudo ./usb-proxy --device=fe980000.usb --driver=fe980000.usb --vendor_id=1997 --product_id=2433 Device is: fe980000.usb Driver is: fe980000.usb vendor_id is: 6551 product_id is: 9267 Device opened successfully Start hotplug_monitor thread, thread id(2326) Setup USB config successfully Start for EP0, thread id(2324) event: connect, length: 0 event: control, length: 8 bRequestType: 0x80 (IN), bRequest: 0x06, wValue: 0x0100, wIndex: 0x0000, wLength: 64 type = USB_TYPE_STANDARD req = USB_REQ_GET_DESCRIPTOR desc = USB_DT_DEVICE ep0: transferred 18 bytes (in) event: control, length: 8 bRequestType: 0x80 (IN), bRequest: 0x06, wValue: 0x0100, wIndex: 0x0000, wLength: 18 type = USB_TYPE_STANDARD req = USB_REQ_GET_DESCRIPTOR desc = USB_DT_DEVICE ep0: transferred 18 bytes (in) event: control, length: 8 bRequestType: 0x80 (IN), bRequest: 0x06, wValue: 0x0200, wIndex: 0x0000, wLength: 255 type = USB_TYPE_STANDARD req = USB_REQ_GET_DESCRIPTOR desc = USB_DT_CONFIG ioctl(USB_RAW_IOCTL_EP0_WRITE): Cannot send after transport endpoint shutdown

Any idea whats causing this?

Hi. Nice work! I have some problems with running proxy.

Is it possible to "mitm" the communication between the flash drive and my external computer?

"pendrive" <-> (USB <- raspberrypi -> USB OTG) <-> my external pc

My setup: Raspberry Pi 4 B - 8gb ram Kernel 5.15.34 libusb-1.0.25

Im getting seqfault in libusb_handle_events_completed(NULL, NULL); stacktrace:

After commenting this line libusb_handle_events_completed(NULL, NULL); it looks working better, but still failing?

Device is: fe980000.usb
Driver is: fe980000.usb
vendor_id is: 2316
product_id is: 4096
5 Devices in list
Target device not found
Device opened successfully
Setup USB config successfully
Start hotplug_monitor thread, thread id(3243)
Start for EP0, thread id(3241)
event: connect, length: 0
event: control, length: 8
  bRequestType: 0x80  (IN), bRequest: 0x06, wValue: 0x0100, wIndex: 0x0000, wLength: 18
  type = USB_TYPE_STANDARD
  req = USB_REQ_GET_DESCRIPTOR
  desc = USB_DT_DEVICE
Control transfer succeed
ep0: transferred 18 bytes (in)
event: control, length: 8
  bRequestType: 0x80  (IN), bRequest: 0x06, wValue: 0x0302, wIndex: 0x0409, wLength: 2
  type = USB_TYPE_STANDARD
  req = USB_REQ_GET_DESCRIPTOR
  desc = USB_DT_STRING
Control transfer succeed
ep0: transferred 2 bytes (in)
event: control, length: 8
  bRequestType: 0x80  (IN), bRequest: 0x06, wValue: 0x0302, wIndex: 0x0409, wLength: 18
  type = USB_TYPE_STANDARD
  req = USB_REQ_GET_DESCRIPTOR
  desc = USB_DT_STRING
Control transfer succeed
ep0: transferred 18 bytes (in)
event: control, length: 8
  bRequestType: 0x80  (IN), bRequest: 0x06, wValue: 0x0301, wIndex: 0x0409, wLength: 2
  type = USB_TYPE_STANDARD
  req = USB_REQ_GET_DESCRIPTOR
  desc = USB_DT_STRING
Control transfer succeed
ep0: transferred 2 bytes (in)
event: control, length: 8
  bRequestType: 0x80  (IN), bRequest: 0x06, wValue: 0x0301, wIndex: 0x0409, wLength: 32
  type = USB_TYPE_STANDARD
  req = USB_REQ_GET_DESCRIPTOR
  desc = USB_DT_STRING
Control transfer succeed
ep0: transferred 32 bytes (in)
event: control, length: 8
  bRequestType: 0x80  (IN), bRequest: 0x06, wValue: 0x0f00, wIndex: 0x0000, wLength: 5
  type = USB_TYPE_STANDARD
  req = USB_REQ_GET_DESCRIPTOR
  desc = USB_DT_BOS
Control transfer succeed
ep0: transferred 5 bytes (in)
event: control, length: 8
  bRequestType: 0x80  (IN), bRequest: 0x06, wValue: 0x0f00, wIndex: 0x0000, wLength: 22
  type = USB_TYPE_STANDARD
  req = USB_REQ_GET_DESCRIPTOR
  desc = USB_DT_BOS
Control transfer succeed
ep0: transferred 22 bytes (in)
event: control, length: 8
  bRequestType: 0x80  (IN), bRequest: 0x06, wValue: 0x0200, wIndex: 0x0000, wLength: 9
  type = USB_TYPE_STANDARD
  req = USB_REQ_GET_DESCRIPTOR
  desc = USB_DT_CONFIG
Control transfer succeed
ep0: transferred 9 bytes (in)
event: control, length: 8
  bRequestType: 0x80  (IN), bRequest: 0x06, wValue: 0x0200, wIndex: 0x0000, wLength: 44
  type = USB_TYPE_STANDARD
  req = USB_REQ_GET_DESCRIPTOR
  desc = USB_DT_CONFIG
Control transfer succeed
ep0: transferred 44 bytes (in)
event: control, length: 8
  bRequestType: 0x00 (OUT), bRequest: 0x09, wValue: 0x0001, wIndex: 0x0000, wLength: 0
  type = USB_TYPE_STANDARD
  req = USB_REQ_SET_CONFIGURATION
Found desired configuration at index: 0
ep #0:
  name: ep1in
  addr: 1
  type: iso blk int
  dir : in  ___
  maxpacket_limit: 1024
  max_streams: 0
ep #1:
  name: ep1out
  addr: 1
  type: iso blk int
  dir : ___ out
  maxpacket_limit: 1024
  max_streams: 0
ep #2:
  name: ep2in
  addr: 2
  type: iso blk int
  dir : in  ___
  maxpacket_limit: 1024
  max_streams: 0
ep #3:
  name: ep2out
  addr: 2
  type: iso blk int
  dir : ___ out
  maxpacket_limit: 1024
  max_streams: 0
ep #4:
  name: ep3in
  addr: 3
  type: iso blk int
  dir : in  ___
  maxpacket_limit: 1024
  max_streams: 0
ep #5:
  name: ep3out
  addr: 3
  type: iso blk int
  dir : ___ out
  maxpacket_limit: 1024
  max_streams: 0
ep #6:
  name: ep4in
  addr: 4
  type: iso blk int
  dir : in  ___
  maxpacket_limit: 1024
  max_streams: 0
ep #7:
  name: ep4out
  addr: 4
  type: iso blk int
  dir : ___ out
  maxpacket_limit: 1024
  max_streams: 0
ep #8:
  name: ep5in
  addr: 5
  type: iso blk int
  dir : in  ___
  maxpacket_limit: 1024
  max_streams: 0
ep #9:
  name: ep5out
  addr: 5
  type: iso blk int
  dir : ___ out
  maxpacket_limit: 1024
  max_streams: 0
ep #10:
  name: ep6in
  addr: 6
  type: iso blk int
  dir : in  ___
  maxpacket_limit: 1024
  max_streams: 0
ep #11:
  name: ep6out
  addr: 6
  type: iso blk int
  dir : ___ out
  maxpacket_limit: 1024
  max_streams: 0
ep #12:
  name: ep7in
  addr: 7
  type: iso blk int
  dir : in  ___
  maxpacket_limit: 1024
  max_streams: 0
ep #13:
  name: ep7out
  addr: 7
  type: iso blk int
  dir : ___ out
  maxpacket_limit: 1024
  max_streams: 0
bNumEndpoints is 2
bulk_out: addr = 1, ep = #1
Creating thread for EP01
Start reading thread for EP01, thread id(3244)
bulk_in: addr = 2, ep = #2
Creating thread for EP82
Start writing thread for EP01, thread id(3245)
Start reading thread for EP82, thread id(3246)
process_eps done
Start writing thread for EP82, thread id(3247)
event: control, length: 8
  bRequestType: 0xa1  (IN), bRequest: 0xfe, wValue: 0x0000, wIndex: 0x0000, wLength: 1
  type = USB_TYPE_CLASS
  req = unknown = 0xfe
Control transfer succeed
ep0: transferred 1 bytes (in)
EP1(bulk_out): read 31 bytes from host
EP1(bulk_out): enqueued 31 bytes to queue
EP82(bulk_in): enqueued 13 bytes to queue
EP82(bulk_in): wrote 13 bytes to host
EP1(bulk_out): read 31 bytes from host
EP1(bulk_out): enqueued 31 bytes to queue
EP82(bulk_in): enqueued 36 bytes to queue
EP82(bulk_in): wrote 36 bytes to host
EP82(bulk_in): enqueued 13 bytes to queue
EP82(bulk_in): wrote 13 bytes to host
EP1(bulk_out): read 31 bytes from host
EP1(bulk_out): enqueued 31 bytes to queue
EP82(bulk_in): enqueued 13 bytes to queue
EP82(bulk_in): wrote 13 bytes to host
EP1(bulk_out): read 31 bytes from host
EP1(bulk_out): enqueued 31 bytes to queue
EP82(bulk_in): enqueued 36 bytes to queue
EP82(bulk_in): wrote 36 bytes to host
EP82(bulk_in): enqueued 13 bytes to queue
EP82(bulk_in): wrote 13 bytes to host
event: control, length: 8
  bRequestType: 0x80  (IN), bRequest: 0x06, wValue: 0x0300, wIndex: 0x0000, wLength: 255
  type = USB_TYPE_STANDARD
  req = USB_REQ_GET_DESCRIPTOR
  desc = USB_DT_STRING
Control transfer succeed
ep0: transferred 4 bytes (in)
EP1(bulk_out): read 31 bytes from host
EP1(bulk_out): enqueued 31 bytes to queue
EP82(bulk_in): enqueued 13 bytes to queue
EP82(bulk_in): wrote 13 bytes to host
EP1(bulk_out): read 31 bytes from host
EP1(bulk_out): enqueued 31 bytes to queue
EP82(bulk_in): enqueued 13 bytes to queue
EP82(bulk_in): wrote 13 bytes to host
EP1(bulk_out): read 31 bytes from host
EP1(bulk_out): enqueued 31 bytes to queue
EP82(bulk_in): enqueued 18 bytes to queue
EP82(bulk_in): enqueued 13 bytes to queue
EP82(bulk_in): wrote 18 bytes to host
EP82(bulk_in): wrote 13 bytes to host
EP1(bulk_out): read 31 bytes from host
EP1(bulk_out): enqueued 31 bytes to queue
EP82(bulk_in): enqueued 8 bytes to queue
EP82(bulk_in): enqueued 13 bytes to queue
EP82(bulk_in): wrote 8 bytes to host
EP82(bulk_in): wrote 13 bytes to host
EP1(bulk_out): read 31 bytes from host
EP1(bulk_out): enqueued 31 bytes to queue
EP82(bulk_in): enqueued 4 bytes to queue
EP82(bulk_in): enqueued 13 bytes to queue
EP82(bulk_in): wrote 4 bytes to host
EP82(bulk_in): wrote 13 bytes to host
EP1(bulk_out): read 31 bytes from host
EP1(bulk_out): enqueued 31 bytes to queue
EP82(bulk_in): enqueued 36 bytes to queue
EP82(bulk_in): wrote 36 bytes to host
EP82(bulk_in): enqueued 13 bytes to queue
EP82(bulk_in): wrote 13 bytes to host
EP1(bulk_out): read 31 bytes from host
EP1(bulk_out): enqueued 31 bytes to queue
EP82(bulk_in): enqueued 512 bytes to queue
EP82(bulk_in): enqueued 13 bytes to queue
EP82(bulk_in): wrote 512 bytes to host
EP82(bulk_in): wrote 13 bytes to host
EP1(bulk_out): read 31 bytes from host
EP1(bulk_out): enqueued 31 bytes to queue
EP82(bulk_in): enqueued 512 bytes to queue
EP82(bulk_in): wrote 512 bytes to host
EP82(bulk_in): enqueued 13 bytes to queue
EP82(bulk_in): wrote 13 bytes to host
EP1(bulk_out): read 31 bytes from host
EP1(bulk_out): enqueued 31 bytes to queue
EP82(bulk_in): enqueued 512 bytes to queue
EP82(bulk_in): enqueued 13 bytes to queue
EP82(bulk_in): wrote 512 bytes to host
EP82(bulk_in): wrote 13 bytes to host
EP1(bulk_out): read 31 bytes from host
EP1(bulk_out): enqueued 31 bytes to queue
EP82(bulk_in): enqueued 512 bytes to queue
EP82(bulk_in): enqueued 13 bytes to queue
EP82(bulk_in): wrote 512 bytes to host
EP82(bulk_in): wrote 13 bytes to host
EP1(bulk_out): read 31 bytes from host
EP1(bulk_out): enqueued 31 bytes to queue
EP82(bulk_in): enqueued 512 bytes to queue
EP82(bulk_in): enqueued 13 bytes to queue
EP82(bulk_in): wrote 512 bytes to host
EP82(bulk_in): wrote 13 bytes to host
EP1(bulk_out): read 31 bytes from host
EP1(bulk_out): enqueued 31 bytes to queue
EP82(bulk_in): enqueued 512 bytes to queue
EP82(bulk_in): enqueued 13 bytes to queue
EP82(bulk_in): wrote 512 bytes to host
EP82(bulk_in): wrote 13 bytes to host
EP1(bulk_out): read 31 bytes from host
EP1(bulk_out): enqueued 31 bytes to queue
EP82(bulk_in): enqueued 1024 bytes to queue
EP82(bulk_in): enqueued 512 bytes to queue
EP82(bulk_in): enqueued 13 bytes to queue
ioctl(USB_RAW_IOCTL_EP_WRITE): Cannot send after transport endpoint shutdown
ioctl(USB_RAW_IOCTL_EP_READ): Cannot send after transport endpoint shutdown

Hi, I've tested on Raspberry PI 4 and BeagleBone Black and on both there seems to be an issue with data from host to device. The issue may come from raw-gadget itself but I'm not sure what would be the right approach. It seems that when we get data from the host, it could contain more than just one packet (up to info.eps[i].limits.maxpacket_limit) which aside from the weird behavior on the actual device, it may also get lost when sent via libusb_interrupt_transfer in send_data (I'm unable to actually verify this on the device).

On BeagleBone Black I can see this when adding traces for data reception in ep_loop_read:

#[email protected]>481B/0x07/out
#[email protected]>545B/0x07/out
#[email protected]>481B/0x07/out
#[email protected]>545B/0x07/out
#[email protected]>545B/0x07/out
#[email protected]>481B/0x07/out
#[email protected]>481B/0x07/out
#[email protected]>481B/0x07/out
#[email protected]>481B/0x07/out 
#[email protected]>417B/0x07/out
#[email protected]> 33B/0x07/out
#[email protected]> 33B/0x07/out
#[email protected]> 33B/0x07/out

Meaning that at 253.250 (sec.ms) from starting the proxy it received 480 bytes (see first message - I added 1 byte because I am preserving the endpoint info for my own use). Sometimes the transfer size equals actual payload like in the last 3 cases where 32 bytes were received.

On BeagleBone Black, the maxpacket_limit is reported to be 512 for the EPs assigned for use via proxy. Any chance this can be tuned to only process one message at a time?

On Raspberry PI 4 the behavior is worse as it transfers 1024 bytes at a time most of the time and sometimes it gets blocked for a second with no transfer at all but the Raspberry PI is somewhat known to exhibit USB issues.

The transfers from device to host don't show any issue and they respect the expected message size.

Thanks in advance for any feedback