Exotic Device Gets Linux Support Via Wireshark And Rust

What can you do if you have a nice piece of hardware that kinda works out of the box, but doesn’t have support for your operating system to get the full functionality out of it? [Harry Gill] found himself in such a situation with a new all-in-one (AIO) water cooling system. It didn’t technically require any operating system interaction to perform its main task, but things like settings adjustments or reading back statistics were only possible with Windows. He thought it would be nice to have those features in Linux as well, and as the communication is done via USB, figured the obvious solution is to reverse engineer the protocol and simply replicate it.

His first step was to set up a dual boot system (his attempts at running the software in a VM didn’t go very well) which allowed him to capture the USB traffic with Wireshark and USBPcap. Then it would simply be a matter of analyzing the captures and writing some Linux software to make sense of the data. The go-to library for USB tasks would be libusb, which has bindings for plenty of languages, but as an avid Rust user, that choice was never really an issue anyway.

How to actually make use of the captured data was an entirely different story though, and without documentation or much help from the vendor, [Harry] resorted to good old trial and error to find out which byte does what. Eventually he succeeded and was able to get the additional features he wanted supported in Linux — check out the final code in the GitHub repository if you’re curious what this looks like in Rust.

Capturing the USB communication with Wireshark seems generally a great way to port unsupported features to Linux, as we’ve seen earlier with an RGB keyboard and the VGA frame grabber that inspired it. If you want to dig deeper into the subject, [Harry] listed a few resources regarding USB in general, but there’s plenty more to explore with reverse engineering USB.

10 thoughts on “Exotic Device Gets Linux Support Via Wireshark And Rust

  1. Nice work!

    I wrote the Antec/Asetec Kuhler-920, and Kuhler-1250 drivers using a method similar to this.

    Sharing data like this with the open source community is how stuff gets done and learning happens!

    Good way to “clean room” reverse engineer crappy proprietary software/hardware. The Kuhler windows software took Mbs of Memory, mine..not so much, I’ll bet yours is the same way :)

    1. Part of the memory usage for the OEM Windows version is often because it’s minimal work done with Swiss army knife coding and UI libraries, due to the beancounters refusing to get a professional to do a good job because that costs too much.
      Oh and telemetry, as we all know is just the softly worded version of spying.

      1. Yep! The Antec one used the “.net” framework, meaning some java jockey got paid to learn C# in 24 hours, and banged out some code that “worked” for a narrow definition of working.

        I measured the memory usage of the “.net” version at 100Mb, with all it’s cruft.

        something like under 100k for the linux version.

        Not fancy, but gets the job done just as fine.

        1. You most certainly could have a decently fancy looking tool with just a few more kb :)
          I mean, there are enough small, reduced GUI frameworks around ..

          It’s kind of the difference between using React JS (which in 90% of the time is misused or abused) vs. Redux vs. just a few bits & bobs taken from Bootstrap or Bulma + a few lines of vanilla jS (see microjs for decent libs and helpers) :)

          cu, w0lf.

          1. This is a joke, isn’t it? I just looked, the Linux 64 bit App-Image.zip is 80MB. Written in HTML???????? What??????
            dd is 80kB and works just fine.
            (Yes, this is not really fair to compare a command-line tool with a GUI, but still…)

  2. Is it possible to do the same for Firewire or Thunderbolt devices on macOS?
    There are so much devices becoming unusable just because vendor stop providing drivers and supporting apps for newer OS.

    1. Theoretically it is possible. Unfortunately, there is no wireshark plugin or other sniffer for firewire or thunderbolt, as far as I know. So you would need to create those first…

Leave a Reply to ØCancel reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.