Skip to content

Instantly share code, notes, and snippets.

@mrschyte

mrschyte/Trace for USB Gadget Load Secret

Created October 27, 2023 08:00
Show Gist options
  • Save mrschyte/d9de2ff6ad95157ff43bc55fec618621 to your computer and use it in GitHub Desktop.
Save mrschyte/d9de2ff6ad95157ff43bc55fec618621 to your computer and use it in GitHub Desktop.
Download ZIP
Trace for USB Gadget Load
Raw
g1.ltrace
[pid 1231] strdup("gt") = 0x55d7a57c72a0
[pid 1231] __xpg_basename(0x55d7a57c72a0, 116, 0x55d7a57c72a0, 0x55d7a57c7267) = 0x55d7a57c72a0
[pid 1231] strcmp("gt", "gt") = 0
[pid 1231] usbg_init(0x55d7a4848019, 0x7fff26245a40, 0x55d7a4848008, 0) = 0
[pid 1231] config_init(0x7fff26245a70, 0, 0, 0x7ff77d4ef1b0) = 0x55d7a57c7410
[pid 1231] stat(0x55d7a484b1ec, 0x7fff26245970, 1, 2) = 0xffffffff
[pid 1231] config_read_file(0x7fff26245a70, 0x55d7a484b1f7, 0x55d7a484b1f7, 0x7ff77d51665a) = 1
[pid 1231] config_setting_get_member(0x55d7a57c7640, 0x55d7a484b233, 0x55d7a484b233, 0) = 0
[pid 1231] config_setting_get_member(0x55d7a57c7640, 0x55d7a484b257, 0x55d7a484b257, 0) = 0
[pid 1231] config_setting_get_member(0x55d7a57c7640, 0x55d7a484b265, 0x55d7a484b265, 0) = 0
[pid 1231] config_setting_get_member(0x55d7a57c7640, 0x55d7a484b27b, 0x55d7a484b27b, 0) = 0
[pid 1231] config_setting_get_member(0x55d7a57c7640, 0x55d7a484b28a, 0x55d7a484b28a, 0) = 0
[pid 1231] strcmp("udc", "load") = 9
[pid 1231] strcmp("settings", "load") = 7
[pid 1231] strcmp("config", "load") = -9
[pid 1231] strcmp("func", "load") = -6
[pid 1231] strcmp("create", "load") = -9
[pid 1231] strcmp("rm", "load") = 6
[pid 1231] strcmp("get", "load") = -5
[pid 1231] strcmp("set", "load") = 7
[pid 1231] strcmp("enable", "load") = -7
[pid 1231] strcmp("disable", "load") = -8
[pid 1231] strcmp("gadget", "load") = -5
[pid 1231] strcmp("template", "load") = 8
[pid 1231] strcmp("load", "load") = 0
[pid 1231] calloc(1, 40) = 0x55d7a57c7890
[pid 1231] getopt_long(3, 0x7fff26245c00, "oh", 0x7fff26245860, 0) = 1
[pid 1231] getopt_long(3, 0x7fff26245c00, "oh", 0x7fff26245860, 0) = -1
[pid 1231] fopen("g1.scheme", "r") = 0x55d7a57c7460
[pid 1231] usbg_import_gadget(0x55d7a57c7360, 0x55d7a57c7460, 0x7fff262477ea, 0x7fff26244958) = 0
[pid 1231] usbg_enable_gadget(0x55d7a57c72c0, 0, 0x55d7a57c7900, 0x55d2f8062ec7) = 0
[pid 1231] fclose(0x55d7a57c7460) = 0
[pid 1231] config_destroy(0x7fff26245a70, 1, 0x55d7a57c7, 1) = 0
[pid 1231] +++ exited (status 0) +++
Raw
g1.scheme
attrs :
{
idVendor = 0x1d6b; # Linux Foundation
idProduct = 0x104; # Multifunction composite gadget
bcdDevice = 0x0100; // v1.0.0
bcdUSB = 0x0200; // USB 2.0
};
strings = (
{
lang = 0x409;
manufacturer = "Linux";
product = "Gadget Device";
serialnumber = "11111";
}
);
os_descs :
{
use = 1;
qw_sign = "MSFT100";
b_vendor_code = 0xcd;
};
functions :
{
rndis_usb0 :
{
instance = "usb0";
type = "rndis";
os_descs = (
{
interface = "rndis";
compatible_id = "RNDIS";
sub_compatible_id = "5162001";
}
);
};
ncm_usb0 :
{
instance = "usb0";
type = "ncm";
};
};
configs = (
{
id = 1;
name = "c";
attrs : {
bmAttributes = 0x80; // bus-powered
bMaxPower = 250;
};
functions = (
{
name = "rndis.usb0";
function = "rndis_usb0";
}
);
},
{
id = 2;
name = "c";
attrs : {
bmAttributes = 0x80; // bus-powered
bMaxPower = 250;
};
functions = (
{
name = "ncm.usb0";
function = "ncm_usb0";
}
);
}
);
Raw
g1.strace
execve("/usr/bin/gt", ["gt", "load", "--file=g1.scheme", "g1"], 0x7fff4feb0720 /* 16 vars */) = 0
brk(NULL) = 0x560e0089b000
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0cc38e5000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=33462, ...}, AT_EMPTY_PATH) = 0
mmap(NULL, 33462, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f0cc38dc000
close(3) = 0
openat(AT_FDCWD, "/lib/libusbgx.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\0\0\0\0\0\0\0"..., 832) = 832
newfstatat(3, "", {st_mode=S_IFREG|0755, st_size=423968, ...}, AT_EMPTY_PATH) = 0
mmap(NULL, 119704, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f0cc38be000
mmap(0x7f0cc38c6000, 53248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x8000) = 0x7f0cc38c6000
mmap(0x7f0cc38d3000, 24576, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x15000) = 0x7f0cc38d3000
mmap(0x7f0cc38d9000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1a000) = 0x7f0cc38d9000
close(3) = 0
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libconfig.so.9", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 /\0\0\0\0\0\0"..., 832) = 832
newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=47768, ...}, AT_EMPTY_PATH) = 0
mmap(NULL, 4240128, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0cc34b2000
mmap(0x7f0cc3600000, 2142976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0) = 0x7f0cc3600000
munmap(0x7f0cc34b2000, 1368064) = 0
munmap(0x7f0cc380c000, 725760) = 0
mprotect(0x7f0cc360b000, 2093056, PROT_NONE) = 0
mmap(0x7f0cc380a000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xa000) = 0x7f0cc380a000
close(3) = 0
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220s\2\0\0\0\0\0"..., 832) = 832
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 784, 64) = 784
newfstatat(3, "", {st_mode=S_IFREG|0755, st_size=1922136, ...}, AT_EMPTY_PATH) = 0
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 784, 64) = 784
mmap(NULL, 1970000, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f0cc341f000
mmap(0x7f0cc3445000, 1396736, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x26000) = 0x7f0cc3445000
mmap(0x7f0cc359a000, 339968, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x17b000) = 0x7f0cc359a000
mmap(0x7f0cc35ed000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1ce000) = 0x7f0cc35ed000
mmap(0x7f0cc35f3000, 53072, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f0cc35f3000
close(3) = 0
mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f0cc38bb000
arch_prctl(ARCH_SET_FS, 0x7f0cc38bb740) = 0
set_tid_address(0x7f0cc38bba10) = 1205
set_robust_list(0x7f0cc38bba20, 24) = 0
rseq(0x7f0cc38bc060, 0x20, 0, 0x53053053) = 0
mprotect(0x7f0cc35ed000, 16384, PROT_READ) = 0
mprotect(0x7f0cc380a000, 4096, PROT_READ) = 0
mprotect(0x7f0cc38d9000, 4096, PROT_READ) = 0
mprotect(0x560dfe9a6000, 4096, PROT_READ) = 0
mprotect(0x7f0cc3917000, 8192, PROT_READ) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
munmap(0x7f0cc38dc000, 33462) = 0
getrandom("\x2a\x1c\xfe\xd2\xaf\xe4\xb3\x64", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x560e0089b000
brk(0x560e008bc000) = 0x560e008bc000
openat(AT_FDCWD, "/sys/kernel/config/usb_gadget", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0755, st_size=0, ...}, AT_EMPTY_PATH) = 0
close(3) = 0
openat(AT_FDCWD, "/sys/class/udc", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0755, st_size=0, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x560e0089b3f0 /* 3 entries */, 32768) = 80
getdents64(3, 0x560e0089b3f0 /* 0 entries */, 32768) = 0
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/config/usb_gadget", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
newfstatat(3, "", {st_mode=S_IFDIR|0755, st_size=0, ...}, AT_EMPTY_PATH) = 0
getdents64(3, 0x560e008a34c0 /* 2 entries */, 32768) = 48
getdents64(3, 0x560e008a34c0 /* 0 entries */, 32768) = 0
close(3) = 0
newfstatat(AT_FDCWD, "~/.gt.conf", 0x7ffe77972020, 0) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/gt/gt.conf", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=350, ...}) = 0
newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=350, ...}, AT_EMPTY_PATH) = 0
read(3, "# Default udc to enable gadgets "..., 8192) = 350
read(3, "", 4096) = 0
read(3, "", 8192) = 0
close(3) = 0
openat(AT_FDCWD, "g1.scheme", O_RDONLY) = 3
newfstatat(3, "", {st_mode=S_IFREG|0644, st_size=1837, ...}, AT_EMPTY_PATH) = 0
read(3, "attrs :\n{\n\tidVendor = 0x1d6b; # "..., 8192) = 1837
read(3, "", 4096) = 0
read(3, "", 8192) = 0
mkdir("/sys/kernel/config/usb_gadget/g1", 0777) = 0
openat(AT_FDCWD, "/sys/kernel/config/usb_gadget/g1/UDC", O_RDONLY) = 4
newfstatat(4, "", {st_mode=S_IFREG|0644, st_size=4096, ...}, AT_EMPTY_PATH) = 0
read(4, "\n", 4096) = 1
read(4, "", 4096) = 0
close(4) = 0
openat(AT_FDCWD, "/sys/kernel/config/usb_gadget/g1/bcdUSB", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
newfstatat(4, "", {st_mode=S_IFREG|0644, st_size=0, ...}, AT_EMPTY_PATH) = 0
write(4, "0x0200\n", 7) = 7
close(4) = 0
openat(AT_FDCWD, "/sys/kernel/config/usb_gadget/g1/idVendor", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
newfstatat(4, "", {st_mode=S_IFREG|0644, st_size=0, ...}, AT_EMPTY_PATH) = 0
write(4, "0x1d6b\n", 7) = 7
close(4) = 0
openat(AT_FDCWD, "/sys/kernel/config/usb_gadget/g1/idProduct", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
newfstatat(4, "", {st_mode=S_IFREG|0644, st_size=0, ...}, AT_EMPTY_PATH) = 0
write(4, "0x0104\n", 7) = 7
close(4) = 0
openat(AT_FDCWD, "/sys/kernel/config/usb_gadget/g1/bcdDevice", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
newfstatat(4, "", {st_mode=S_IFREG|0644, st_size=0, ...}, AT_EMPTY_PATH) = 0
write(4, "0x0100\n", 7) = 7
close(4) = 0
openat(AT_FDCWD, "/sys/kernel/config/usb_gadget/g1/strings/0x409", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = -1 ENOENT (No such file or directory)
mkdir("/sys/kernel/config/usb_gadget/g1/strings/0x409", 0777) = 0
openat(AT_FDCWD, "/sys/kernel/config/usb_gadget/g1/strings/0x409//manufacturer", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
newfstatat(4, "", {st_mode=S_IFREG|0644, st_size=0, ...}, AT_EMPTY_PATH) = 0
write(4, "Linux", 5) = 5
close(4) = 0
openat(AT_FDCWD, "/sys/kernel/config/usb_gadget/g1/strings/0x409//product", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
newfstatat(4, "", {st_mode=S_IFREG|0644, st_size=0, ...}, AT_EMPTY_PATH) = 0
write(4, "Gadget Device", 13) = 13
close(4) = 0
openat(AT_FDCWD, "/sys/kernel/config/usb_gadget/g1/strings/0x409//serialnumber", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
newfstatat(4, "", {st_mode=S_IFREG|0644, st_size=0, ...}, AT_EMPTY_PATH) = 0
write(4, "11111", 5) = 5
close(4) = 0
mkdir("/sys/kernel/config/usb_gadget/g1/functions/rndis.usb0", 0777) = 0
openat(AT_FDCWD, "/sys/kernel/config/usb_gadget/g1/functions/rndis.usb0/os_desc/interface.rndis//compatible_id", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
newfstatat(4, "", {st_mode=S_IFREG|0644, st_size=0, ...}, AT_EMPTY_PATH) = 0
write(4, "RNDIS", 5) = 5
close(4) = 0
openat(AT_FDCWD, "/sys/kernel/config/usb_gadget/g1/functions/rndis.usb0/os_desc/interface.rndis//sub_compatible_id", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
newfstatat(4, "", {st_mode=S_IFREG|0644, st_size=0, ...}, AT_EMPTY_PATH) = 0
write(4, "5162001", 7) = 7
close(4) = 0
mkdir("/sys/kernel/config/usb_gadget/g1/functions/ncm.usb0", 0777) = 0
mkdir("/sys/kernel/config/usb_gadget/g1/configs/c.1", 0777) = 0
openat(AT_FDCWD, "/sys/kernel/config/usb_gadget/g1/configs/c.1/bmAttributes", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
newfstatat(4, "", {st_mode=S_IFREG|0644, st_size=0, ...}, AT_EMPTY_PATH) = 0
write(4, "0x80\n", 5) = 5
close(4) = 0
openat(AT_FDCWD, "/sys/kernel/config/usb_gadget/g1/configs/c.1/MaxPower", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
newfstatat(4, "", {st_mode=S_IFREG|0644, st_size=0, ...}, AT_EMPTY_PATH) = 0
write(4, "250\n", 4) = 4
close(4) = 0
symlink("/sys/kernel/config/usb_gadget/g1/functions/rndis.usb0", "/sys/kernel/config/usb_gadget/g1/configs/c.1/rndis.usb0") = 0
mkdir("/sys/kernel/config/usb_gadget/g1/configs/c.2", 0777) = 0
openat(AT_FDCWD, "/sys/kernel/config/usb_gadget/g1/configs/c.2/bmAttributes", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
newfstatat(4, "", {st_mode=S_IFREG|0644, st_size=0, ...}, AT_EMPTY_PATH) = 0
write(4, "0x80\n", 5) = 5
close(4) = 0
openat(AT_FDCWD, "/sys/kernel/config/usb_gadget/g1/configs/c.2/MaxPower", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
newfstatat(4, "", {st_mode=S_IFREG|0644, st_size=0, ...}, AT_EMPTY_PATH) = 0
write(4, "250\n", 4) = 4
close(4) = 0
symlink("/sys/kernel/config/usb_gadget/g1/functions/ncm.usb0", "/sys/kernel/config/usb_gadget/g1/configs/c.2/ncm.usb0") = 0
openat(AT_FDCWD, "/sys/kernel/config/usb_gadget/g1/os_desc", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 4
newfstatat(4, "", {st_mode=S_IFDIR|0755, st_size=0, ...}, AT_EMPTY_PATH) = 0
close(4) = 0
openat(AT_FDCWD, "/sys/kernel/config/usb_gadget/g1/os_desc//qw_sign", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
newfstatat(4, "", {st_mode=S_IFREG|0644, st_size=0, ...}, AT_EMPTY_PATH) = 0
write(4, "MSFT100", 7) = 7
close(4) = 0
openat(AT_FDCWD, "/sys/kernel/config/usb_gadget/g1/os_desc//b_vendor_code", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
newfstatat(4, "", {st_mode=S_IFREG|0644, st_size=0, ...}, AT_EMPTY_PATH) = 0
write(4, "0xcd\n", 5) = 5
close(4) = 0
openat(AT_FDCWD, "/sys/kernel/config/usb_gadget/g1/os_desc//use", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
newfstatat(4, "", {st_mode=S_IFREG|0644, st_size=0, ...}, AT_EMPTY_PATH) = 0
write(4, "1\n", 2) = 2
close(4) = 0
openat(AT_FDCWD, "/sys/kernel/config/usb_gadget/g1/UDC", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
newfstatat(4, "", {st_mode=S_IFREG|0644, st_size=0, ...}, AT_EMPTY_PATH) = 0
write(4, "dummy_udc.0", 11) = 11
close(4) = 0
close(3) = 0
exit_group(0) = ?
+++ exited with 0 +++
Raw
Trace for USB Gadget Load
# gt load --file=g1.scheme g1
# ls /sys/kernel/config/usb_gadget/g1/os_desc/
b_vendor_code qw_sign use ;; # I'd expect to have c.1 linked here
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment