Sniffing the USB traffic of a PS4 controller

[Nytro]

Sniffing the USB traffic of a PS4 controller

by dyngnosis on Nov.17, 2013

So, in previous posts we looked at using facedancer21 and umap.py to fuzz the the PS4 USB interface. The fuzz cases are pretty simple but they certainly did their job.

It is time to start thinking about customizing the existing fuzzer to fuzz a specific device — the PS4 controller.

There has been a bunch of work getting open source support for the PS3 controller. So we have a great starting point to work with on that end. I’m going to have to read up on the USB protocol a bit better and really look at how umap implements its fuzz cases and how they implement the protocol.

For now lets take a look at the USB traffic generated by the device. To do this I used USBPcap with wireshark:

Below is a capture of the traffic that occurs when you plug the device in:

[1] Packet one is sent from the host to 30 (the usb device). It is asking for a descripter.

[2] The device sends a descripter response:

The device responds with information that identifies itself including idVendor of 0x054c for Sony Corp. and an idProduct of “0x05c4?. The PlayStation 3 controller responds with (0×0268) for Batoh Device / PlayStation 3 Controller.

Next (in packet 4) the host asks the device for a Configuration Descriptor.

In packet five the device responds and says hey.. my bMaxPower is FA (500ma)

In packet eight we find out that this device has two end points. On the PlayStation 3 controller we find endpoints at 2 and 1 (out and in respectively). On the PS4 controller we find endpoints at 4(in) and 3(out).

Also note the ” UNKNOWN DESCRIPTOR ”

The data is 09 21 11 01 00 01 22 d2 01

09 is clearly the length. I’ll have to look into the rest.

PS3 Endpoints:

PS4 Endpoints

The next interesting packet happens after packet 14 when the host asks the USB device for RPIPE Descriptor.

There are a ton of interesting patterns/sequences in this binary blob. We can even see the result of increment word values in the ascii representation.

NOTE: The PS3 controller does not send this data.

Packets 17 onward are the stream of data sent from the controller to the host device. I’ve been able to pick out values that represent the X Y Z axis of the controller gyroscope. I’m sure picking out the values that change when buttons are pressed is a simple procedure and something that was done long ago by other people when creating opensource drivers for the PS3 controller.

To go further I’ll need to go read some USB spec stuff and the open source implementations of the PS3 driver.

With this though, we do have enough to start customizing the fuzzer and start thinking about fields we can fuzz.

Sursa: Sniffing the USB traffic of a PS4 controller

Edited November 17, 2013 by Nytro