7 ms·

Hacking the Kinect - How to hack USB device drivers

245 points by there 16y ago

kanwisher 16y ago
This is the most detailed explanation on howto explore a USB device I've seen. Need more articles like this!
- ladyada 16y ago
  lvr.com also has incredibly useful information. support jan axelson and buy one of her books, they're essential for any usb development!
  - jonhendry 16y ago
    The website isn't very well laid out.
    - jonhendry 16y ago
      Well, it isn't. It's just a big mess barfed up onto html. Some links are to elsewhere on the same site. Intermixed with those are links to some other site. I'm not saying there isn't useful information there, or that her book sucks. I'm just saying her website is a poorly organized mess that makes it less useful unless you know exactly what you're looking for. For a USB newbie it'd just be a maze of links, all alike.
- follower 16y ago
  If you're interested in a more of a "project log" style (rather than a complete article) you might want to take a look at my previous efforts at reversing a wireless USB dongle: http://code.rancidbacon.com/LearningAboutAtmelRZRAVEN http://code.rancidbacon.com/LearningAboutAtmelRZRAVEN And if you happen to like reading about other people's (sometimes uncompleted) reversing projects like I do I've got a few more of those too: :) http://code.rancidbacon.com/ProjectDigitalSpyCameraPen http://code.rancidbacon.com/ProjectDigitalSpyCameraPen http://code.rancidbacon.com/ProjectPyX86 http://code.rancidbacon.com/ProjectPyX86 http://code.rancidbacon.com/LearningAboutSkannerzRacerz http://code.rancidbacon.com/LearningAboutSkannerzRacerz And a more general reverse engineering link collection: http://code.rancidbacon.com/ReverseEngineering http://code.rancidbacon.com/ReverseEngineering
daeken 16y ago
This is seriously awesome. While I've spent a lot of time reversing network protocols (and thus had a good foundation on which to pick up USB hacking (which I documented at http://daeken.com/hacking-the-belkin-network-usb-hub http://daeken.com/hacking-the-belkin-network-usb-hub and, to a lesser extent, at http://daeken.com/emokit-hacking-the-emotiv-epoc-brain-computer-0 http://daeken.com/emokit-hacking-the-emotiv-epoc-brain-compu... )), most people have never dropped to this level. We need more articles like this. Good work. Edit: So, I have an idea, and I think this may be the community to ask about it. I'm considering going to a company (specifically, one that produces some network software or a USB device) and asking them to get a copy/unit of their product, which I will then reverse-engineer in full public view, with the intention of making it fully transparent, and hopefully getting other people into this stuff. It could be something that's already open (either intentionally or by someone reversing it and publishing a driver or other code), or something that's currently closed. But the whole goal is to end up with a set of data that people can work through, along the lines of my Belkin post (but better organized, and published as things go on). Anyone have any suggestions for who I should approach about this? Or hell, any startups want me to reverse their stuff for the greater good?
- chime 16y ago
  What about the iPhone/iPad dock connector? There's lots of interesting devices being hooked up to them. For USB, what about barcode scanners and keyboards? It would be very interesting to see how they communicate with the computer and I figure it would be relatively simple, compared to say an external USB drive.
  - daeken 16y ago
    I really want to do this with the support of the manufacturer for a change; that's what actually makes it difficult to choose a target. I've hacked a lot of stuff in the past, but it's never been with the manufacturer's support, and I think that somewhere out there, there's a perfect target. One which is not only a good learning experience for people, but a good marketing opportunity for some company.
gte910h 16y ago
I've written USB drivers before (linux, but USB is the same for everything) and this is exactly how you do it even if you know all the command you're writing into the device. Spot on.
joshu 16y ago
wait - the kinect has a motor?
- dtf 16y ago
  To tilt the camera up and down, making it more adaptable to the range of televisions it may be housed on or under.
  - dotBen 16y ago
    and to get a wider field of vision for the camera as it records and analyzes your living room and sends it to advertisers and marketers to build an even more detailed profile on you. http://www.engadget.com/2010/11/15/microsoft-exec-caught-in-privacy-snafu-says-kinect-might-tailor/ http://www.engadget.com/2010/11/15/microsoft-exec-caught-in-...
    - eli 16y ago
      ...is something that isn't actually happening and would violate Microsoft privacy policy if it did.
- lwhi 16y ago
  .. and an accelerometer (to keep track of the camera orientation)
iantimothy 16y ago
I asked about this a few days ago. This appearing now is just awesome. Would like to say a big thanks for taking the time to share your knowledge.
- ladyada 16y ago
  you're welcome! we write a new tutorial every tuesday - some beginner, some advanced. if you subscribe to the blog rss feed you can get the notifications
lwhi 16y ago
A straightforward, in-depth guide which is easy to understand. It's absolutely superb ... but am I alone in being put off by the high cost of a USB analyser?
- NateLawson 16y ago
  While the Beagle 480 is $1200, the Beagle 12 (full/low speed) is only $400. You can force a high speed peripheral down to full speed by using a USB 1.1 hub. The protocols are identical at the application layer, although there are a few low-level differences in flow control packets. http://www.totalphase.com/products/beagle_usb12/ http://www.totalphase.com/products/beagle_usb12/ The PS3 hack only needed full-speed descriptors: http://rdist.root.org/2010/08/30/theories-of-how-ps-jailbreak-works/ http://rdist.root.org/2010/08/30/theories-of-how-ps-jailbrea... http://rdist.root.org/2010/09/01/more-details-surface-on-ps-jailbreak/ http://rdist.root.org/2010/09/01/more-details-surface-on-ps-...
- EventHorizon 16y ago
  Unfortunately, no. I worked for places that wouldn't even approve the purchase of the 2.0 beagle. I guess that what happens when the equipment and my pay come from separate budgets. That said one can use Linux as an analyser when windows is the usb-host by running windows in a vm. There are also software analysers that tap into the windows stack available. The Kinect is one of the few peripherals that isn't windows based.
- joezydeco 16y ago
  There are some software-only tools like USBlyzer (Windows only I think) that work pretty well. I've been able to sniff traffic exactly like the examples in this Kinect page. http://www.usblyzer.com http://www.usblyzer.com
- ladyada 16y ago
  a hardware usb analyzer is just one of those things that's terribly expensive, not really even because of the hardware (its not that complicated) but because of the software which must be really good and this one runs on all OS's. I will admit I used this project as an excuse to get one but good electrical engineering tools cost in the thousands of $
huadie 16y ago
╭⌒╮WELCOME http://www.onseeking.com/ http://www.onseeking.com/ ----- ~ ¤ ╭⌒╮ ╭⌒╮ ╭⌒╭⌒╮╭⌒╮～╭⌒╮ HANDBAG 35$ ,））））,''）~~ ,''~） ╱◥█◣ ╱◥█◣ SHOES 35$ ｜田｜田｜｜田｜田｜ CLOTH 15$ ╬╬╬╬╬╬╬╬╬╬╬╬╬╬ 2010 NEW Your fashion! Your season! Michael bag fashion tidalcurrent.the fashionable element "bag" you - glamour infinite. Mass commodity, low discount, the buy cheaper. { www. onseeking .com } mall price can buy eligible products and services. Select all kinds of women, men's shoes, etc, { onseeking .com } shopping navigation! In addition, the company has a good reputation, quality standard, At a reasonable price. In the past few years, have been deeply overseas My friends for their support. Therefore, please rest assured purchase. ====== Free transport====== !!!!!!!!!!!!!! (http://www.onseeking.com/ http://www.onseeking.com/) !!!!!!!!!!!! input this URL: (http://onseeking.com/ http://onseeking.com/) you can find many cheap and fashion stuff (jor dan s-h-o-e-s) (NBA NFL NHL MLB j-e-r-s-e-y) ( lv h-a-n-d-b-a-g) (cha nel w-a-l-l-e-t) (D&G s-u-n-g-l-a-s-s-e-s) (ed har dy j-a-c-k-e-t) (UG G b-o-o-t) WE ACCEPT PYAPAL PAYMENT YOU MUST NOT MISS IT!! ----------------------

245 points by there 16y ago

kanwisher 16y ago

This is the most detailed explanation on howto explore a USB device I've seen. Need more articles like this!

ladyada 16y ago
lvr.com also has incredibly useful information. support jan axelson and buy one of her books, they're essential for any usb development!
- jonhendry 16y ago
  The website isn't very well laid out.
  - jonhendry 16y ago
    Well, it isn't. It's just a big mess barfed up onto html. Some links are to elsewhere on the same site. Intermixed with those are links to some other site. I'm not saying there isn't useful information there, or that her book sucks. I'm just saying her website is a poorly organized mess that makes it less useful unless you know exactly what you're looking for. For a USB newbie it'd just be a maze of links, all alike.
follower 16y ago
If you're interested in a more of a "project log" style (rather than a complete article) you might want to take a look at my previous efforts at reversing a wireless USB dongle: http://code.rancidbacon.com/LearningAboutAtmelRZRAVEN http://code.rancidbacon.com/LearningAboutAtmelRZRAVEN And if you happen to like reading about other people's (sometimes uncompleted) reversing projects like I do I've got a few more of those too: :) http://code.rancidbacon.com/ProjectDigitalSpyCameraPen http://code.rancidbacon.com/ProjectDigitalSpyCameraPen http://code.rancidbacon.com/ProjectPyX86 http://code.rancidbacon.com/ProjectPyX86 http://code.rancidbacon.com/LearningAboutSkannerzRacerz http://code.rancidbacon.com/LearningAboutSkannerzRacerz And a more general reverse engineering link collection: http://code.rancidbacon.com/ReverseEngineering http://code.rancidbacon.com/ReverseEngineering

daeken 16y ago

This is seriously awesome. While I've spent a lot of time reversing network protocols (and thus had a good foundation on which to pick up USB hacking (which I documented at http://daeken.com/hacking-the-belkin-network-usb-hub http://daeken.com/hacking-the-belkin-network-usb-hub and, to a lesser extent, at http://daeken.com/emokit-hacking-the-emotiv-epoc-brain-computer-0 http://daeken.com/emokit-hacking-the-emotiv-epoc-brain-compu... )), most people have never dropped to this level. We need more articles like this. Good work. Edit: So, I have an idea, and I think this may be the community to ask about it. I'm considering going to a company (specifically, one that produces some network software or a USB device) and asking them to get a copy/unit of their product, which I will then reverse-engineer in full public view, with the intention of making it fully transparent, and hopefully getting other people into this stuff. It could be something that's already open (either intentionally or by someone reversing it and publishing a driver or other code), or something that's currently closed. But the whole goal is to end up with a set of data that people can work through, along the lines of my Belkin post (but better organized, and published as things go on). Anyone have any suggestions for who I should approach about this? Or hell, any startups want me to reverse their stuff for the greater good?

chime 16y ago
What about the iPhone/iPad dock connector? There's lots of interesting devices being hooked up to them. For USB, what about barcode scanners and keyboards? It would be very interesting to see how they communicate with the computer and I figure it would be relatively simple, compared to say an external USB drive.
- daeken 16y ago
  I really want to do this with the support of the manufacturer for a change; that's what actually makes it difficult to choose a target. I've hacked a lot of stuff in the past, but it's never been with the manufacturer's support, and I think that somewhere out there, there's a perfect target. One which is not only a good learning experience for people, but a good marketing opportunity for some company.

gte910h 16y ago

I've written USB drivers before (linux, but USB is the same for everything) and this is exactly how you do it even if you know all the command you're writing into the device. Spot on.

joshu 16y ago

wait - the kinect has a motor?

dtf 16y ago
To tilt the camera up and down, making it more adaptable to the range of televisions it may be housed on or under.
- dotBen 16y ago
  and to get a wider field of vision for the camera as it records and analyzes your living room and sends it to advertisers and marketers to build an even more detailed profile on you. http://www.engadget.com/2010/11/15/microsoft-exec-caught-in-privacy-snafu-says-kinect-might-tailor/ http://www.engadget.com/2010/11/15/microsoft-exec-caught-in-...
  - eli 16y ago
    ...is something that isn't actually happening and would violate Microsoft privacy policy if it did.
lwhi 16y ago
.. and an accelerometer (to keep track of the camera orientation)

iantimothy 16y ago

I asked about this a few days ago. This appearing now is just awesome. Would like to say a big thanks for taking the time to share your knowledge.

ladyada 16y ago
you're welcome! we write a new tutorial every tuesday - some beginner, some advanced. if you subscribe to the blog rss feed you can get the notifications

lwhi 16y ago

A straightforward, in-depth guide which is easy to understand. It's absolutely superb ... but am I alone in being put off by the high cost of a USB analyser?

NateLawson 16y ago
While the Beagle 480 is $1200, the Beagle 12 (full/low speed) is only $400. You can force a high speed peripheral down to full speed by using a USB 1.1 hub. The protocols are identical at the application layer, although there are a few low-level differences in flow control packets. http://www.totalphase.com/products/beagle_usb12/ http://www.totalphase.com/products/beagle_usb12/ The PS3 hack only needed full-speed descriptors: http://rdist.root.org/2010/08/30/theories-of-how-ps-jailbreak-works/ http://rdist.root.org/2010/08/30/theories-of-how-ps-jailbrea... http://rdist.root.org/2010/09/01/more-details-surface-on-ps-jailbreak/ http://rdist.root.org/2010/09/01/more-details-surface-on-ps-...
EventHorizon 16y ago
Unfortunately, no. I worked for places that wouldn't even approve the purchase of the 2.0 beagle. I guess that what happens when the equipment and my pay come from separate budgets. That said one can use Linux as an analyser when windows is the usb-host by running windows in a vm. There are also software analysers that tap into the windows stack available. The Kinect is one of the few peripherals that isn't windows based.
joezydeco 16y ago
There are some software-only tools like USBlyzer (Windows only I think) that work pretty well. I've been able to sniff traffic exactly like the examples in this Kinect page. http://www.usblyzer.com http://www.usblyzer.com
ladyada 16y ago
a hardware usb analyzer is just one of those things that's terribly expensive, not really even because of the hardware (its not that complicated) but because of the software which must be really good and this one runs on all OS's. I will admit I used this project as an excuse to get one but good electrical engineering tools cost in the thousands of $

huadie 16y ago

╭⌒╮WELCOME http://www.onseeking.com/ http://www.onseeking.com/ ----- ~ ¤ ╭⌒╮ ╭⌒╮ ╭⌒╭⌒╮╭⌒╮～╭⌒╮ HANDBAG 35$ ,））））,''）~~ ,''~） ╱◥█◣ ╱◥█◣ SHOES 35$ ｜田｜田｜｜田｜田｜ CLOTH 15$ ╬╬╬╬╬╬╬╬╬╬╬╬╬╬ 2010 NEW Your fashion! Your season! Michael bag fashion tidalcurrent.the fashionable element "bag" you - glamour infinite. Mass commodity, low discount, the buy cheaper. { www. onseeking .com } mall price can buy eligible products and services. Select all kinds of women, men's shoes, etc, { onseeking .com } shopping navigation! In addition, the company has a good reputation, quality standard, At a reasonable price. In the past few years, have been deeply overseas My friends for their support. Therefore, please rest assured purchase. ====== Free transport====== !!!!!!!!!!!!!! (http://www.onseeking.com/ http://www.onseeking.com/) !!!!!!!!!!!! input this URL: (http://onseeking.com/ http://onseeking.com/) you can find many cheap and fashion stuff (jor dan s-h-o-e-s) (NBA NFL NHL MLB j-e-r-s-e-y) ( lv h-a-n-d-b-a-g) (cha nel w-a-l-l-e-t) (D&G s-u-n-g-l-a-s-s-e-s) (ed har dy j-a-c-k-e-t) (UG G b-o-o-t) WE ACCEPT PYAPAL PAYMENT YOU MUST NOT MISS IT!! ----------------------