Building and Hacking USB with FPGAs

Building and Hacking USB with FPGAs

Speakers: Michael Ossmann, Founder & CTO, Great Scott Gadgets

Conference: ShmooCon

YouTube: https://www.youtube.com/watch?v=-_jUZBMeU5w

Overview

In this ShmooCon talk, Michael Ossmann, founder and CTO of Great Scott Gadgets, delves into the evolution and application of open-source tools and hardware for building and hacking USB devices using Field-Programmable Gate Arrays (FPGAs). The presentation traces a decade of development, from the ambitious but ultimately abandoned Daisho project to the realization of its core concepts in the Synthon multi-tool and the Luna gateware library. Ossmann highlights the critical role of open-source hardware and software in empowering security researchers, reverse engineers, and hardware developers to deeply understand and manipulate the ubiquitous USB standard.

The talk emphasizes the often-overlooked complexities of USB 2.0, which remains the most universal and prevalent USB interface despite the advent of faster "SuperSpeed" variants. Ossmann introduces Packetry, a purpose-built USB analysis software designed to overcome the limitations of general-purpose network analyzers like Wireshark for high-volume USB traffic. He also showcases the enhanced capabilities of the Face Dancer framework when integrated with Synthon, demonstrating powerful techniques for emulating USB devices and reverse engineering their protocols. This presentation is crucial for anyone involved in hardware security, embedded systems development, or low-level protocol analysis, offering both theoretical insights and practical, open-source solutions.

Background

▶ Watch: Introduction: Open-source USB tools and FPGAs (0:00)

The journey into open-source USB tooling at Great Scott Gadgets began over a decade ago with the Daisho project. Demonstrated at ShmooCon in 2015, Daisho was an ambitious undertaking featuring a large FPGA at its core, flanked by three SuperSpeed USB physical layer transceivers (PHYs). Its architecture was designed for man-in-the-middle interception and monitoring of USB 3.x connections, as well as other high-speed interfaces like HDMI and Gigabit Ethernet via modular front-ends. While a groundbreaking proof of concept, Daisho proved expensive to develop, manufacture, and required extensive software work to become a practical product. Funding ran out, and the project was ultimately abandoned, but the foundational ideas persisted.

Following Daisho, Great Scott Gadgets explored two new concepts: USB Star, a scaled-down version of Daisho focused solely on USB 2.0 with a single board and three USB 2.0 PHYs, and GreatFET, a microcontroller-based device inspired by Travis Goodspeed's GoodFET and Face Dancer projects. GreatFET, designed to be a more achievable goal given the team's initial unfamiliarity with FPGAs, provided a platform for USB device emulation and general-purpose I/O. For several years, GreatFET served as the primary focus, developing into a versatile USB multi-tool.

The turning point for the USB Star concept came in late 2019, when Kate Temkin, a key contributor at Great Scott Gadgets, independently designed a USB sniffer that mirrored the original USB Star vision. This design ultimately evolved into Synthon, a USB 2.0 test instrument featuring an FPGA, three USB 2.0 PHYs, and four USB ports. Synthon was conceptualized as a low-cost, high-speed USB analyzer, a hacking multi-tool, and a general-purpose USB and FPGA development platform. It leverages the versatility of FPGAs to provide unparalleled flexibility in USB research.

Critical to Synthon's development is the Luna project, an open-source USB gateware library built with Amaranth HDL. This Python-based Hardware Description Language (HDL) revolutionized FPGA development at Great Scott Gadgets, replacing traditional and often cumbersome languages like Verilog and VHDL. Luna, combined with an ecosystem of open-source FPGA tools such as Yosys for synthesis, nextpnr for place and route, and Project Trellis for documenting the Lattice ECP5 FPGA used in Synthon, allows for rapid iteration and development of complex USB logic directly on the FPGA. This shift to an entirely open-source toolchain dramatically reduced development friction and unlocked new possibilities for hardware and gateware design, a stark contrast to the challenges faced during the Daisho era.

The talk also clarifies the nuances of USB speeds. While Low Speed (1.5 megabits per second) and Full Speed (12 megabits per second) are common for basic devices like mice and most microcontrollers, High Speed (480 megabits per second) is essential for high-throughput devices like the HackRF. SuperSpeed (5 gigabits per second and up), defined by USB 3.x and 4, offers even greater bandwidth. However, USB 2.0, a 25-year-old standard, remains the most universal interface due to its pervasive backward compatibility across all USB versions and devices, making it a critical area for security research.

Key Findings

▶ Watch: USB speed demystified: low, full, high, super speed (3:20)

The core findings of this talk revolve around the successful creation and application of a comprehensive open-source ecosystem for USB development and security analysis.

1. Synthon as a Versatile USB 2.0 Platform: Synthon emerges as a low-cost, high-speed USB 2.0 analyzer, hacking multi-tool, and general-purpose FPGA development platform. Its architecture, featuring an FPGA and three USB 2.0 PHYs, enables passive monitoring, device emulation, and active manipulation of USB 2.0 traffic. This single board significantly lowers the barrier to entry for advanced USB research compared to previous, more expensive solutions.
2. Luna and the Open-Source FPGA Revolution: The Luna gateware library, written in Amaranth HDL (a Python-based HDL), demonstrates a paradigm shift in FPGA development. Coupled with the open-source toolchain of Yosys, nextpnr, and Project Trellis, Luna enables rapid, efficient, and entirely open-source synthesis and deployment of complex gateware onto FPGAs. This ecosystem allows for the creation of full USB device controllers in seconds, significantly accelerating hardware development and research.
3. Packetry: A Superior USB Analysis Tool: Packetry is introduced as a custom-built USB analysis software, written in Rust, specifically designed to overcome the limitations of general-purpose packet analyzers like Wireshark when dealing with USB. Its key advantages include:

• Hierarchical View: Presenting USB traffic in a logical hierarchy of transfers, transactions, and individual packets, making complex interactions much easier to understand.
• Wire-Level Sniffing: Unlike Wireshark with USBMon, Packetry captures actual packets over the wire, providing a true representation of bus activity, including crucial low-level details that USBMon (which captures the host kernel's view) might miss.
• Performance: Packetry can handle millions of USB packets in real-time and load large capture files significantly faster than Wireshark, providing interactive viewing even during loading.
• Intelligent Filtering: It intelligently groups or hides less relevant packets (like Start of Frame (SOF) packets) by default, while allowing users to drill down when needed.

1. Enhanced Face Dancer Capabilities: The Face Dancer software framework, when used with Synthon, achieves unprecedented capabilities for USB device emulation. It eliminates bottlenecks present in older hardware (e.g., the 115 kilobits per second limitation of Face Dancer 2.1) and supports high-speed USB 2.0 emulation with an arbitrary number of endpoints (up to 32, or more if the standard is extended). This allows researchers to emulate a wider range of complex USB devices in Python for security testing and reverse engineering.
2. Diverse USB Device Construction Methods: The talk outlines multiple approaches for building USB devices, both in software and hardware:

• Software: Using Face Dancer (Python), custom gateware with Luna (Amaranth HDL), or writing firmware for a soft CPU (C/Rust) running on the FPGA within Synthon.
• Hardware: Expanding Synthon via Pmod or mezzanine connectors (e.g., Acalia SDR add-on), modifying the Synthon design itself (e.g., URTi radio platform), or leveraging any Amaranth HDL-compatible FPGA with Luna (using simple 3.3V IO pins for low/full speed, or an external ULPI PHY for high speed).

1. Future Directions for USB Hacking: Ossmann teases future developments, including Luna SuperSpeed (experimental support for USB 3.x using existing PHYs or FPGA high-speed serial transceivers), implementing Face Dancer directly in gateware for even higher performance, and developing Luna host controllers for creating USB host devices.

These findings collectively present a powerful, accessible, and highly flexible toolkit for anyone looking to explore, analyze, and secure the intricate world of USB.

Technical Deep Dive

▶ Watch: Why USB 2.0 remains the most universal standard (5:00)

The technical core of this talk revolves around the synergistic relationship between FPGAs, open-source hardware designs, and specialized software for USB analysis and emulation.

At the heart of Synthon is a Lattice ECP5 FPGA, chosen for its compatibility with the growing open-source FPGA toolchain. This FPGA is connected to three dedicated USB 2.0 PHYs, which handle the physical layer communication for USB Low Speed (1.5 Mbps), Full Speed (12 Mbps), and High Speed (480 Mbps). The board features four USB ports: two host-facing ports for control and two target-facing ports (Type-A and Type-C) that are wired directly together and share a single PHY. This configuration allows Synthon to act as a transparent pass-through device for passive monitoring or as an active man-in-the-middle proxy.

The Luna gateware library is central to programming the FPGA. Unlike traditional FPGA development with Verilog or VHDL, Luna utilizes Amaranth HDL, a Python-based Hardware Description Language. This means engineers can define hardware logic using Python constructs, which are then compiled into a bitstream for the FPGA. The benefits are substantial:

• Rapid Development: Python's expressiveness and extensive libraries allow for faster design and verification cycles.
• Open-Source Ecosystem: Luna integrates seamlessly with Yosys (for RTL synthesis), nextpnr (for place and route), and Project Trellis (which provides open documentation and tools for Lattice FPGAs). This complete open-source toolchain eliminates reliance on proprietary, often expensive, and slow vendor tools, enabling synthesis and loading of complex USB device controllers onto the FPGA in mere seconds.

Packetry, the custom USB analysis software, is written in Rust for performance and memory safety. Its design addresses fundamental limitations of using general-purpose tools like Wireshark for USB traffic. USB traffic is inherently hierarchical:

• Transfers: High-level data exchanges (e.g., a device requesting its name).
• Transactions: Individual request/response pairs within a transfer (e.g., SETUP, IN, OUT).
• Packets: The smallest units of data on the bus (e.g., PID, DATA, CRC).

Packetry's interface presents this hierarchy clearly, allowing users to expand and collapse layers of detail. This contrasts sharply with Wireshark using USBMon (the Linux kernel's USB monitoring facility), which presents USB Request Blocks (URBs) – the operating system's view of USB activity – rather than the raw packets on the wire. USBMon captures the host controller's commands and responses, not the actual bus signaling. For instance, a single URB request in USBMon might correspond to multiple transactions and dozens of individual packets on the wire, making low-level debugging impossible with USBMon. Packetry's wire-level capture and hierarchical display are crucial for diagnosing physical layer issues or understanding precise timing.

Furthermore, Packetry's performance is optimized for the high volume of USB traffic. A typical high-speed USB device, even at default sample rates, can generate millions of packets per second, including frequent Start of Frame (SOF) packets (which occur every 125 microseconds). Packetry efficiently handles these large captures, allowing real-time monitoring and fast loading of multi-million packet files, a task that can significantly slow or crash Wireshark. It intelligently groups SOF packets into a single entry by default, reducing visual clutter while retaining the ability to inspect them if needed.

The Face Dancer framework for USB device emulation has seen significant architectural improvements with Synthon. Originally limited by microcontroller performance and a restricted number of endpoints (e.g., Face Dancer 2.1 had a 115 kbps bottleneck and only five unidirectional endpoints, with only one bidirectional pipe available for custom use), Synthon leverages the FPGA's reconfigurability. The USB device controller implemented in Luna gateware on the FPGA can support high-speed USB 2.0 and an arbitrary number of endpoints, well beyond the 32 specified by the USB 2.0 standard if extensions are needed. This allows for highly realistic and flexible emulation of complex USB devices directly from Python scripts running on a host computer. The Face Dancer software communicates with a soft CPU (a CPU implemented in gateware on the FPGA) running Rust firmware, which then controls the USB PHYs.

Building USB devices is explored through three dimensions:

1. Software-defined devices:

• Face Dancer (Python): Rapid prototyping and emulation.
• Luna Gateware (Amaranth HDL): Direct implementation of USB device controllers on the FPGA, offering maximum control and performance.
• Soft CPU Firmware (C/Rust): Running custom code on a CPU synthesized within the FPGA, providing a familiar programming environment for complex logic without needing to write full gateware.

1. Hardware expansion of Synthon:

• Pmod Connectors: Standardized peripheral modules (e.g., LEDs, sensors) can be plugged into Synthon's generic pin connectors.
• Mezzanine Connector: A dedicated expansion port for more complex add-on boards, like Acalia, an experimental software-defined radio (SDR) platform that leverages Synthon for USB connectivity.

1. Custom FPGA designs with Luna:

• Modifying Synthon: Projects like URTi (Universal Radio Test Instrument) demonstrate how Synthon's open-source design can be adapted, stripping out unneeded components and integrating new hardware (e.g., radio front-ends) directly.
• Any FPGA with Luna: The Luna library can be used with any Amaranth HDL-compatible FPGA. For low-speed and full-speed USB, only two 3.3V IO pins (D+ and D-) and a pull-up resistor are required. For high-speed USB, an external ULPI (UTMI+ Low Pin Interface) PHY chip is recommended, as rolling one's own high-speed PHY is exceedingly complex.

Future technical directions include Luna SuperSpeed, which is already experimental, utilizing either the Daisho project's USB 3.x PHYs or high-speed serial transceivers built into some FPGAs. This aims to bring the Luna ecosystem to USB 3.x and beyond. Other goals include implementing Face Dancer directly in gateware for higher performance and developing Luna host controllers to enable FPGAs to act as USB hosts, not just devices.

Demo / Proof of Concept

▶ Watch: Abandoning Daisho; new vision: USB Star and GreatFET (6:00)

The talk featured two primary demonstrations: one showcasing Packetry for USB analysis and another illustrating Face Dancer for USB device emulation and reverse engineering.

The first demo highlighted Packetry's capabilities by capturing the enumeration of a HackRF One software-defined radio when plugged into a host computer via Synthon. The demonstration contrasted Packetry's output with that of Wireshark using USBMon:

• HackRF Enumeration: Packetry immediately displayed the hierarchical nature of USB communication, showing transfers, transactions, and individual packets involved in the host asking "what are you called?" and the HackRF responding "I'm called HackRF One." This detailed, wire-level view revealed the multiple packets and transactions underlying a single high-level request.
• Wireshark Comparison: When the same enumeration was captured with Wireshark using USBMon, the output showed USB Request Blocks (URBs), which represent the Linux kernel's view of USB. This view presented only high-level requests and responses, obscuring the underlying packets and transactions on the wire. Ossmann emphasized that if something went wrong at the physical layer, USBMon would offer no visibility.
• Performance and SOF Packets: A further comparison involved capturing a HackRF data transfer, generating millions of packets. Packetry handled this in real-time and loaded a 6-million-packet capture file in seconds, allowing immediate interaction. Wireshark, when attempting to open the same file, struggled significantly, with a progress bar indicating a lengthy loading process and no interactivity until completion. Packetry's intelligent handling of Start of Frame (SOF) packets – grouping them by default but allowing drill-down – was also demonstrated as a significant usability improvement over Wireshark, which displays every SOF packet by default, creating immense clutter.

The second demo showcased Face Dancer for reverse engineering a device by emulating it. The goal was to emulate a HackRF One to fool the hackrf_info command-line tool:

• Initial Emulation: An initial Python script using Face Dancer was created with only the HackRF's Vendor ID (VID) and Product ID (PID). When run, hackrf_info detected "found HackRF" but immediately reported a "read pipe error failure" when trying to read the board ID.
• The suggest Feature: Ossmann then introduced Face Dancer's powerful --suggest option. Running the script with --suggest and then terminating it after the error prompted Face Dancer to suggest Python code to handle the specific USB request that failed. In this case, it suggested handling request 14, which was asking for one byte of data (the board ID).
• Iterative Reverse Engineering:

1. By adding the suggested code and returning a dummy value (e.g., board_ID = 1), hackrf_info was fooled into thinking it found a "Jawbreaker" (the beta platform preceding HackRF One).
2. Changing the returned board ID to 2 successfully emulated a HackRF One.
3. The next error occurred when hackrf_info tried to read the firmware version string. Using --suggest again, Face Dancer recommended handling request 15 for 255 bytes. Ossmann added code to return a custom string like "ShmooCon version", which successfully fooled hackrf_info into displaying the emulated version.

This demo vividly illustrated how Face Dancer, particularly with its suggest feature, allows for rapid, iterative reverse engineering of USB devices by progressively satisfying the host software's expectations. Ossmann also mentioned a blog post by Mike Walters where this exact method was used to reverse engineer an electronic calibration kit for a Vector Network Analyzer (VNA) without physical access to the original hardware, and a video series by Martin that applies this technique to the PlayStation 5 controller.

Defensive Implications

▶ Watch: GreatFET: A microcontroller-based USB hacking platform (7:40)

The detailed understanding and manipulation of USB protocols, as demonstrated by Synthon and Face Dancer, carry significant defensive implications for organizations and individuals:

1. Vulnerability Research and Testing of USB Stacks: Face Dancer, especially with its high-speed and arbitrary endpoint capabilities on Synthon, is an invaluable tool for security researchers to stress-test and find vulnerabilities in host operating system USB stacks. By emulating malformed or unexpected USB devices, defenders can identify potential denial-of-service vulnerabilities, privilege escalation flaws, or even remote code execution opportunities that could be exploited by malicious USB devices. This allows proactive patching before exploits emerge in the wild.

1. Rogue Device Detection and Analysis: The ability to sniff USB traffic at the wire level with Packetry allows for deep inspection of unknown or suspicious USB devices. Defenders can analyze the exact enumeration process, device descriptors, and subsequent communications to identify anomalies that might indicate a malicious or compromised device (e.g., a device masquerading as a legitimate peripheral but exhibiting unusual behavior or requesting unexpected permissions). This can aid in forensic analysis and incident response.

1. Firmware Reverse Engineering and Auditing: The Face Dancer emulation technique is powerful for reverse engineering the communication protocols of proprietary USB devices without needing the physical device itself or its host software. This capability allows security teams to understand how devices communicate, identify potential weaknesses in their protocols, and audit device firmware for backdoors or vulnerabilities, even if the device is not physically present. The example of reverse engineering a VNA calibration kit highlights the utility for industrial control systems or specialized hardware.

1. Hardware Security Assessment: Synthon, as a general-purpose FPGA development platform, enables the creation of custom hardware security tools. This could include building hardware-accelerated fuzzers for USB interfaces, implementing custom monitors for specific USB device classes, or even developing hardware-based countermeasures against known USB attacks. The open-source nature of the hardware design also allows for independent security audits of Synthon itself.

1. Education and Training: The open-source nature of Synthon, Luna, Packetry, and Face Dancer, coupled with their detailed documentation and tutorials, provides an accessible platform for educating security professionals and developers about the intricacies of USB. This hands-on experience with low-level USB interaction is crucial for building a deeper understanding of potential attack vectors and developing robust defenses against them.

1. Supply Chain Security: By providing tools to verify the behavior of USB devices, organizations can enhance their supply chain security. An incoming USB peripheral could be subjected to automated analysis using Synthon and Packetry to confirm it behaves as expected and doesn't contain hidden malicious functionalities or firmware modifications.

In essence, these tools empower defenders to move beyond surface-level USB security, enabling deep inspection, proactive vulnerability discovery, and thorough auditing of USB-connected hardware and software, ultimately strengthening the overall security posture against a pervasive and often-exploited interface.

Key Takeaways

• USB 2.0 Remains Paramount: Despite faster USB standards, USB 2.0 (High Speed, Full Speed, Low Speed) is the most universal and backward-compatible interface, making its analysis and security crucial for nearly all modern systems.
• Open-Source FPGA Tools Revolutionize Hardware Development: The combination of Amaranth HDL, Luna gateware, Yosys, nextpnr, and Project Trellis provides a robust, fast, and entirely open-source ecosystem for FPGA development, enabling rapid prototyping and deployment of complex hardware logic like USB device controllers.
• Specialized USB Analysis is Essential: General-purpose network analyzers like Wireshark are inadequate for deep USB analysis due to their focus on host-level URBs rather than wire-level packets and their inability to handle the high volume and hierarchical nature of USB traffic. Packetry fills this gap with its hierarchical view, performance, and wire-level fidelity.
• Face Dancer is a Powerful Reverse Engineering and Security Testing Tool: When combined with Synthon, the Face Dancer framework allows for high-speed, flexible USB device emulation with arbitrary endpoints, making it an indispensable tool for reverse engineering unknown devices, auditing proprietary protocols, and stress-testing host operating system USB stacks.
• Synthon is a Versatile Multi-Tool: Synthon serves as a low-cost, high-speed USB analyzer, a USB hacking multi-tool, and a general-purpose FPGA development platform, providing a single, accessible device for a wide range of hardware security and development tasks.
• Multiple Pathways to Build USB Devices: The talk highlights diverse methods for creating USB devices, from high-level Python scripting with Face Dancer to low-level gateware development with Luna, and various hardware expansion options, demonstrating the flexibility offered by the open-source ecosystem.

About the Speaker(s)

Michael Ossmann is the founder and CTO of Great Scott Gadgets, a company dedicated to creating open-source hardware tools for security research and education. He is widely recognized in the security community for his contributions to open-source hardware, most notably as the creator of the HackRF One, a popular open-source software-defined radio. Ossmann has a long history of presenting at security conferences like ShmooCon, where he often shares insights into hardware hacking, radio frequency security, and embedded systems. His work consistently emphasizes the importance of open-source principles for fostering innovation, transparency, and accessibility in the field of hardware and security research.