USB

USB#

Universal Serial Bus. A differential pair plus power and ground; host-driven, polled, hot-pluggable, and ubiquitous. The most attacked and most impersonated edge of any host. The operator either pulls firmware off a USB peripheral, dissects traffic to reverse-engineer a vendor protocol, or emulates a device to feed a target whatever class it trusts (HID keystrokes, mass storage, serial, network).

Wires#

Signal

Direction

Purpose

VBUS

Host to device

+5 V (USB 2.0); +5/+9/+15/+20 V on USB-C with PD.

D+, D-

Bidirectional

Differential signaling pair; NRZI-encoded.

GND

Reference

Ground.

CC1, CC2 (USB-C)

Configuration

Orientation, role detection, Power Delivery channel.

SBU1, SBU2, TX/RX pairs (USB-C)

Bidirectional

SuperSpeed lanes and alternate-mode signaling.

Wire format#

Logic on D+ / D- is NRZI with bit-stuffing; the host polls, the device responds. Packets carry a SYNC pattern, a PID (packet identifier), an endpoint address, payload, and a CRC.

  • Token packets (IN, OUT, SETUP) start a transaction.

  • Data packets carry up to 64 bytes (full-speed) or 512 bytes (high-speed) per transaction.

  • Handshake packets (ACK, NAK, STALL) end it.

  • SOF marks the start of a frame every 1 ms (or 125 µs on high-speed).

Speeds:

Standard

Speed

Low Speed (USB 1.0)

1.5 Mbps

Full Speed (USB 1.1)

12 Mbps

High Speed (USB 2.0)

480 Mbps

SuperSpeed (USB 3.0)

5 Gbps

SuperSpeed+ (USB 3.1 Gen 2)

10 Gbps

USB 3.2 Gen 2x2 / USB4

20 Gbps / 40 Gbps

Transfer types are control (configuration), bulk (mass storage), interrupt (HID), and isochronous (audio, video).

Pads#

The operator meets USB at one of three places.

Place

Note

USB-A / USB-C port

The host-facing interface; whatever the operator’s implant looks like to the target.

On-board test points

USB_DP and USB_DM pads on a PCB; the operator solders to them when the connector is gone or when the enclosure forbids physical access.

Chip-level

Direct attach to a USB controller’s D+ / D- pins on a flash dumping or fault-injection rig.

Tools#

Tool

Effect

lsusb

List attached devices.

lsusb -v, usbview

Dump device, configuration, and endpoint descriptors.

usbmon + Wireshark

Capture USB traffic and dissect it.

usbip

Tunnel USB devices over IP for remote attach.

Facedancer21, GreatFET, LUNA

Software-defined USB; emulate any device, fuzz any host.

USB Rubber Ducky, Bash Bunny, OMG Cable

Pre-built HID-injection and exfil tools.

Total Phase Beagle USB, Saleae

Protocol analyzers for live capture and decode.

References#

Contents