I'm currently enjoying a forensics CTF challenge. We were provided a PCAPNG file. When opened in Wireshark, the file contains a sequence of URB_INTERRUPT packets from two devices - but no GET_DESCRIPTOR info that identifies either device.
The first device give a sequence of 8-bit data like this:
00:00:00:00:00:00:00:00
00:00:04:00:00:00:00:00
00:00:04:15:00:00:00:00
00:00:00:15:00:00:00:00
00:00:08:15:00:00:00:00
00:00:08:00:00:00:00:00
00:00:00:00:00:00:00:00
02:00:00:00:00:00:00:00
02:00:2d:00:00:00:00:00
00:00:2d:00:00:00:00:00
Guessing that this was a keyboard, I decoded the sequence to this message:
scanlines-are-real-cool-guys
Which seems like a hint, right? The second (much longer) sequence of URB_INTERRUPT packets from the second device is 7-bit data like this:
01:00:01:00:02:00:00
01:00:00:00:02:00:00
01:00:00:00:01:00:00
01:00:00:00:02:00:00
01:00:01:00:01:00:00
01:00:01:00:02:00:00
01:00:00:00:02:00:00
01:00:01:00:01:00:00
01:00:01:00:00:00:00
01:00:00:00:01:00:00
01:00:ff:ff:01:00:00
01:00:fe:ff:00:00:00
01:00:ff:ff:00:00:00
01:00:ff:ff:00:00:00
01:00:ff:ff:ff:ff:00
01:00:ff:ff:ff:ff:00
01:00:ff:ff:ff:ff:00
01:00:ff:ff:ff:ff:00
I guessed that this could be a mouse - even though most mouse data seem to only contain 4 bits, based on the fact that:
- Only two of the bits seem to change in any significant way - all other bits seem to only ever be
00,01, orff- thus potentially being the x and y coordinates - The variable data stays in between 0 and 255
- Mice and keyboards seem to be the most common devices using URB_INTERRUPT
Acting on that guess, I sent the data through AWK:
awk -F: 'function comp(v){if(v>127)v-=256;return v}{x+=comp(strtonum("0x"$3));y+=comp(strtonum("0x"$5))}$1=="01"{print x,y}' hexoutput_second-part.txt > mouse1.txt
And then through GNUPLOT - hoping to get a traced message or something from an on-screen keyboard. But no luck - the plot ends up as:
Not especially helpful.
So my question is - how would I go tracking down what other devices could be sending 7 bit URB_INTERRUPT data? What is the best way to attack this identification process?
Thank you!
