Usb traffic sniffer Ps4#

Packets 17 onward are the stream of data sent from the controller to the host device. NOTE: The PS3 controller does not send this data. We can even see the result of increment word values in the ascii representation.

There are a ton of interesting patterns/sequences in this binary blob. The next interesting packet happens after packet 14 when the host asks the USB device for RPIPE Descriptor.

Usb traffic sniffer Ps4#

On the PS4 controller we find endpoints at 4(in) and 3(out).Ġ9 is clearly the length. On the PlayStation 3 controller we find endpoints at 2 and 1 (out and in respectively). In packet eight we find out that this device has two end points. In packet five the device responds and says hey. Next (in packet 4) the host asks the device for a Configuration Descriptor. The PlayStation 3 controller responds with (0×0268) for Batoh Device / PlayStation 3 Controller. The device responds with information that identifies itself including idVendor of 0x054c for Sony Corp. Packet one is sent from the host to 30 (the usb device). To do this I used USBPcap with wireshark:īelow is a capture of the traffic that occurs when you plug the device in: I’m going to have to read up on the USB protocol a bit better and really look at how umap implements its fuzz cases and how they implement the protocol.įor now lets take a look at the USB traffic generated by the device. So we have a great starting point to work with on that end. There has been a bunch of work getting open source support for the PS3 controller. It is time to start thinking about customizing the existing fuzzer to fuzz a specific device - the PS4 controller. The fuzz cases are pretty simple but they certainly did their job. So, in previous posts we looked at using facedancer21 and umap.py to fuzz the the PS4 USB interface. Sniffing the USB traffic of a PS4 controller