USB MITM: Building a Transparent USB Proxy with raw-gadget and libusb
- 時間
- 2026-08-08 14:10 ~ 14:40
- 講者
- Aristo Chen
- 位置
- TR213
- 共筆
議程簡介
The USB protocol is everywhere: keyboards, webcams, storage devices, embedded hardware test fixtures. Yet most developers treat it as a black box. What if you could sit transparently between a USB host and device, observe every packet, and selectively modify, drop, or inject traffic using nothing but open-source software running on a Raspberry Pi?
This talk walks through the design and implementation of
usb-proxy, an open-source USB
man-in-the-middle proxy built on the Linux kernel's raw-gadget driver and libusb.
What is usb-proxy?
usb-proxy positions a Linux machine with a USB OTG port between a real USB device and
its host. The host sees a synthetic device reconstructed in real time via raw-gadget,
while the real device is accessed through libusb on the other side. All traffic flows
through the proxy, where it can be logged, modified, or dropped using JSON-based rules.
The Injection Rule Engine
injection.json defines per-endpoint rules for control, interrupt, and bulk transfers.
Each rule can modify, ignore, or stall a matched packet. Three levels of transform are
supported and can be combined within a single rule, in order of increasing flexibility:
- Pattern replacement: matches fixed hex byte sequences and substitutes them. Ideal for simple, fixed substitutions such as swapping mouse button bytes.
- Declarative operations: applies arithmetic transforms in order on byte offsets, such as negating a movement axis or scaling cursor speed, without any scripting.
- Lua scripting: for logic that cannot be expressed declaratively, a rule can point to a Lua script. Each script maintains its own state across packets, enabling conditionals, loops, and stateful transforms like dead zones or speed caps.
What Will Be Coverd
- How the Linux USB stack is layered: UDC driver, gadget framework, and userspace
- How
raw-gadgetandlibusbwork together to build a transparent C++ proxy - The injection rule engine in action with a live demo
Talk Outline
| Section | Time |
|---|---|
| USB protocol and motivation | 5 min |
| raw-gadget + libusb architecture deep-dive | 10 min |
| Injection rule engine: live demo on how to modify and inject USB packets | 10 min |
| QA | 5 min |
Source: https://github.com/AristoChen/usb-proxy (Apache-2.0 license)
講者
Aristo Chen
Aristo Chen is an embedded Linux engineer with a strong interest in low-level systems programming and open-source development.
usb-proxy is a personal open-source project he built to deepen his understanding of the Linux USB stack from the ground up. The project combines the Linux kernel's raw-gadget driver, libusb, and a Lua scripting engine to create a transparent USB man-in-the-middle proxy that runs on hardware such as a Raspberry Pi. It has gathered over 250 stars and 40 forks on GitHub.
Beyond usb-proxy, he actively contributes to upstream open-source projects in the embedded Linux ecosystem, including U-Boot and the Linux kernel, with a focus on bootloader enablement and hardware bringup.