Hello everyone
Welcome
To USB forensics and pentesting pentester Academy
In this video
We will
Continue our discussion of USB mass storage and we'll talk about communication how does your
You're hosed
Talk
To your thumb drive
So
As we said before typically this is bulk only mass storage also sometimes called BB
Bebe
Because it's Bok Bok Bok will talk about what that means in a bit
Or sometimes
USB
Mass storage USB MS
All Communications use ball pen points and there are three phases
The first phase is what we call the command block rapper phase cbw
The Dana transport phase which is optional depending on the commandant's being sent
And then the command status rapper phase
All of these happen over Vulcan points which is why some people called as BBB
Cuz it's ball fall ball
Command sent to the drive
Inside of a command block which is in the aptly-named command by rapper
And
Then that those commands are
Universally
Pretty much scuzzy commands the using reduce scuzzy command sent
And if they require some sort of data transport
That happens on the bulk endpoints
And all the transactions are terminated with a command status wrapper
By the way
Storage devices
Mass storage device is a little bit different in that
We talked about control endpoints previously and most other kinds of devices have all those commands
And sent over the control and points but
These are an exception
Everything is pretty much done over the Balkan points
What is this command block rapper look like well here is the C code
For a structure
So here's a structure of Define it starts with a signature
You might worry about what this decodes to
Until you realize that it's just
USB
See
For a command
And it's little endian
So that's why it's
Little bit
Backward from here
Then there's a tagless tag is kind of like a packet sequence number SO2 dissociates the
Status with
Be
Block the command
Transfer length
Whether it's in or out
The Logical unit number for petition if you will
And the link
For the command block the three High bits
Are zero and the rest of it has the length
And the command block
Is up to
16x long
Typically
It is
Greater than or equal to 6 so the shortest command that sinews
Is 6 bytes
Alright so
What about this command block command block
As we sad
Is 6 to 16 bytes
And the command is in the first bite and the rest of it
Are parameters
So freaked zample here I have
A format unit command
Which is opcode for
It needs a lan
Right
And it has 3 bits for a lion
And then we have format data
Is
Third extra parameter that follows or not
That's what this bet tells you
The next spit tells you if
There is a partial or complete defect list being used
And
Then the dfac
Defect list format
Some vendor specific information the interleave
And then a control character
A lot of this stuff in this particular command is going to be vendor-specific
Another example
Here we have a read command something that you would want to do a lot
Once again the operation code begins
Our Command Block and then we have an address
Some reserved bits
And a force unit access
Which means we don't want any cash do you want to deserve to Sable paging
What's the logical unit number and the LBA logical block address
Some Reserve bites
Transfer length and again I control character
Cell
What are some common commands
That you might see
You might see format units inquiry tell me about yourself
Mode select
And you'll see that are suffixes on many of these commands the suffix is relate to how long
All the commands are there shorter and longer versions of commands
We have mode sense
To determine
What is going on and then we have a bunch of read commands
Notice that some of these are marked as required
Yasir read 10 is pretty common re-12 would be more common with larger devices
There's a read capacity command
Read format capacities command
Some other
Associated commands
Report how many Lawns you have
Test if the unit is ready this is something that sent quite a bit in fact many devices will go to sleep
If they don't regularly receive these and then of course we have our right commands
So we sent a command
There is
Some sort
Data transfer for most of these commands
And then we get
Command status
Which is satana command status wrapper
Alright so it starts with a signature what's that signature this is actually USBS
For USB status
There's the associated tag right so what's the time it's that number that sequence number if you will
That relates this to a previous command
Then there's a data residue
That's the difference between your requested data and the actual data that you got
In other words is there more to come
And then we have a status bit now how does the status that work the status bit
Is
Going to tell you zero if it passed one if it had some sort of an era
It had a phaser so what's a phaser of phase error is
The way that they transfer information on a USB bus they alternate between two
Channels if you will data data 0.21 and there is some rules
For how this happens it if you get out of sync
That's a phaser
And when you get a phase are reported Then There are rules about how you should reset
Now the fail comes from actual physical scuzzy hard drives
Where they would have a wire
That if there was an error
That wire would be toggled
And there are recreating that
And USB
Now in order to know what actually happened you have to go in to that
Device you have to query yet to get the error information
Well that's all for this video and the next video will actually
Delve into Wireshark and look at some of this traffic
As always if you're enjoying your time here at pentester Academy tell a friend
See you soon