Reverse engineering USB drivers


When [Jespersaur] purchased a Luxeed LED keyboard, he was disappointed to find that the drivers were not open source and didn’t support all the features he wanted. His solution? Hack the drivers that come with it, and implement his own. In his article, he gives a basic rundown of beginning reverse engineering by multiple methods and a brief introduction to libusb. For the Linux drivers, check out [Kurt Stephens]’s site, where he supplies a link to the source code, instructions on building it, and a tutorial on sending commands to the keyboard.

17 thoughts on “Reverse engineering USB drivers

  1. Nice hack.
    He can now easily make the keyboard adapt to the environment he is working on.
    I would love to integrate one of these with VIM. Make it highlight the bracket close key when a function was left open for example. fade out less important keys for programming in C. Change color of keys regarding the syntax highlighting color of the keyword it is being typed.

    One can also edit the gnome sourcecode to grab a list of all accelerators for a given window and highlight them in the keyboard.

    The possibilities are endless.

  2. @mrx: It wouldn’t even have to stop at vim. Tied in with Gnome or another desktop manager, this could be a powerful tool for application-specific scripts and shortcut key coloring. Color packs could even be provided in a method similar to TextMate’s bundles.

  3. Slightly off topic, but is it possible to change the device name of a USB device?
    Like when I plug in my USB flash drive it identifies itself as Lenovo USB flash drive, or my Seagate drive identifies itself as a Seagate Free Agent Drive (strange usb enclosure doesn’t show the hard drive model number)

    Is it possible to change that?

  4. @aw

    You have to check which usb controller the device has. For simple devices (like HID) the name is most probably hardcoded on the chip. For more complex usb devices, there is a chance it is firmware driven so you might be able to re-flash the microcontroller or external rom.

  5. kernel code under Linux and BSD is blatantly simple not matter what type of driver it is. In windows you have to deal with poorly documented hooks and data structures.

    I would of just used syser, softice or modified ollydbg for it, but that’s being naive. Anything to do with reversing on NT at a assembler level is usually aggravating.

    If you know the pe structure good enough you can usually unpack and modify fairly easy targets, but the kernel level is nasty, and even more of a headache on vista and 7.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s