Month: July 2010

• Rhythmbox crashed again (hacking without music is dreadful)
• Weird SELinux problems after resuming from suspend

I hope the video works. If it doesn’t, please download first. So we can replace packets on the fly, in and out. And of course, you could design a more complex scenario: Let the first read pass by unmodified but after that modify the packets.

typedef struct pcap_hdr_s {
        guint32 magic_number;   /* magic number */
        guint16 version_major;  /* major version number */
        guint16 version_minor;  /* minor version number */
        gint32  thiszone;       /* GMT to local correction */
        guint32 sigfigs;        /* accuracy of timestamps */
        guint32 snaplen;        /* max length of captured packets, in octets */
        guint32 network;        /* data link type */
} pcap_hdr_t;

Wirehsark dumps the following:

0000000: d4 c3 b2 a1 02 00 04 00 00 00 00 00 00 00 00 00  ................
0000010: ff ff 00 00 dc 00 00 00 43 8e 44 4c d7 96 05 00  ........C.DL....

So I might be able to implement saving to PCap at some stage.

muelli@bigbox ~/git/qemu $ git rebase setup_fds 
First, rewinding head to replay your work on top of it...
Applying: Temporary migration to usb_packet_filter_setup_fds
Using index info to reconstruct a base tree...
Falling back to patching base and 3-way merge...
Auto-merging usb-linux.c
CONFLICT (content): Merge conflict in usb-linux.c
Failed to merge in the changes.
Patch failed at 0001 Temporary migration to usb_packet_filter_setup_fds

When you have resolved this problem run "git rebase --continue".
If you would prefer to skip this patch, instead run "git rebase --skip".
To restore the original branch and stop rebasing run "git rebase --abort".


muelli@bigbox ~/git/qemu $ nano usb-linux.c # hack hack hack
muelli@bigbox ~/git/qemu $ git add usb-linux.c
muelli@bigbox ~/git/qemu $ git rebase --continue
Applying: Temporary migration to usb_packet_filter_setup_fds
No changes - did you forget to use 'git add'?

When you have resolved this problem run "git rebase --continue".
If you would prefer to skip this patch, instead run "git rebase --skip".
To restore the original branch and stop rebasing run "git rebase --abort".

muelli@bigbox ~/git/qemu $ 

WTF?!

That one is brilliant, too:

muelli@bigbox ~/git/qemu $ git rebase -i setup_fds
# Stupid me: I selected "f" for the very first entry in that edit window
Cannot 'fixup' without a previous commit
# Fair enough, let me restart then:
muelli@bigbox ~/git/qemu $ git rebase setup_fds 
Interactive rebase already started
# O_o WTF? What else, besides aborting, could I possibly do anyway?!
muelli@bigbox ~/git/qemu $ git rebase --abort
muelli@bigbox ~/git/qemu $ git rebase setup_fds 
# Now it works...

That replace filter produced interesting results. I replaced every “A” transmitted by a “B”. On the host, I created a file on a mass storage with 4KB “A”s. When “cat”ting the file from the guest, I saw “A”s. But copying the file in the guest resulted in the new file having all “B”s. I expected the “cat” showing all “B”s, too. And as far as I can see, the “A”s are actually replaced for the “cat”.

Of course, Istanbul crashed while trying to make that screencast.
Note that the filter code actually changed by now, not only because I enhanced the protocol (in the version you’re seeing, only USB payload is exchanged. In the new version, also the PID, device address and device endpoint are filtered) but also because I refactored the communication bits into a USBPacket class.
I missed to show the pen drive from the host point of view after having copied the file in the guest, but the “bbbb” file is full of “B”s.

Sorry for that video being so poorly embedded in this wordpress instance. You might want to try to download the video directly.

So yeah, we can potentially filter USB packets by now, which allows us in-place fuzzing. But that’s cumbersome because we need to have a device attached to the host. So the goal must be to be able to do USB communication without a device being attached to the host but with a program that emulates the USB device in question.

    int interface = atoi(argv[1]);
    fd = open("/dev/bus/usb/002/006", O_RDWR);
    result = ioctl(fd, USBDEVFS_RELEASEINTERFACE, &interface);
    //result = ioctl(fd, USBDEVFS_CLAIMINTERFACE, &interface);
    printf("Result: %d, errno: %d %s\n", result, errno, strerror(errno));

and fails with Invalid Argument for RELEASE or for CLAIM with -EINVAL (Invalid Argument) or -ENOENT (No such file or directory). I have no idea what I am doing wrong. So if you do, please tell me 😛
Oh, and these ioctls are not exported to Python I think. At least I couldn’t find the correct ioctl number for USBDEVFS_CLAIMINTERFACE without progamming a tiny C program to print it out for me.