如何在 Linux 上拦截来自 USB 设备的消息？

Question

I have a popular drawing tablet that I connect to my PC with USB. Once connected, the tablet detects hand movements and manipulates the pointer accordingly. Somewhere, the tablet is transmitting this data to my computer.

My goal is to intercept these transmissions and manipulate the mouse after I process the data. The buzzwords I have found are: device drivers and HID , but I haven't been able to piece together much more than that.

Assuming this is possible, I have a few questions:

1. How is this done if the data format is known?
2. How is this done if the data format is unknown/proprietary?

My computer is running Ubuntu (but answers related to any form of a Linux OS are greatly appreciated!).

---

Note: This question is similar but intended for Windows.

Answer 1

Actually you missed a buzzword " USB sniffing ". ;-)

Here are a few tutorials on USB sniffing on Linux, to get you started.

• Official Wireshark wiki for USB monitoring
• biot.com/blog/usb-sniffing-on-linux (InternetArchive)
• tjworld.net/wiki/Linux/Ubuntu/USBmonitoring

Essentially you use the usbmon Linux kernel module to capture the USB-packets and Wireshark as a front-end to display and analyse the captured USB stream.

Answer 2

To add another useful resource: Kernel manual for usbmon

You can use the following commands on Debian Linux to view debug log for usbmon in text format using usbmon Kernel's built in usb monitoring:

• $sudo -i to use root
• #modprobe usbmon
• #ls /sys/kernel/debug/usb/usbmon to view bus sockets
• #cat /sys/kernel/debug/usb/devices to view devices at each bus socket
• #cat /sys/kernel/debug/usb/usbmon/<bus socket> to view or you can route stdout to a file using >