USBPcapOdinDumper

We have moved to https://codeberg.org/KOLANICH-tools/USBPcapOdinDumper, grab new versions there.

Under the disguise of "better security" Micro$oft-owned GitHub has discriminated users of 1FA passwords while having commercial interest in success of FIDO 1FA specifications and Windows Hello implementation which it promotes as a replacement for passwords. It will result in dire consequencies and is competely inacceptable, read why.

If you don't want to participate in harming yourself, it is recommended to follow the lead and migrate somewhere away of GitHub and Micro$oft. Here is the list of alternatives and rationales to do it. If they delete the discussion, there are certain well-known places where you can get a copy of it. Read why you should also leave GitHub.

---

It's a tool to dump ODIN3 messages into files with human-readable names for further reverse-engineering. Both usbmon (the subsystem in Linux kernel) and usbpcap (the app for Windows) captures are supported.

Requirements

• plumbum - for the fancy CLI.
• RichConsole - for colors in console. It's mandatory because this shit is used internally to generate file names, so in console the names are colorful.
• Pipeline - The main app's pipeline.
• kaitaistruct - runtime for Kaitai Striuct-generated parsers.

How to use

python3 -m USBPcapOdinDumper pcap_file_1.pcap

or

python3 -m USBPcapOdinDumper

to process all the files in the current folder.

It will generate the folders in the current folder for each pcap file.

For each isUseful (see isUseful methods) packet it will generate the file, which name usually have encoded:

• the packet number in pcap
• the type of USB transaction (only bulk are useful for us)
• the direction showed with an arrow
• some info from enums of odin messages. If enum values are incorrect, an error occurs, info about which enum and which value is incorrect will be added into a file name.

The parser of ODIN3 messages is based on Benjamin Dobell's Heimdall flasher.

Samples of protocol:

• https://github.com/Benjamin-Dobell/Heimdall/files/1414758/ODIN_flash_capture.zip
• https://lindi.iki.fi/lindi/I9195IXXU1AOB1/KTU84P.I9195IXXU1AOB1_upgrade_Kies3.2.15072_2_Windows7_x64.pcap
• https://lindi.iki.fi/lindi/I9195IXXU1AOB1/AP_flash_odin3.10_Windows7_x64.pcap
• https://lindi.iki.fi/lindi/I9195IXXU1AOB1/recovery_flash_heimdall_d0526a3b_Debian_x64.pcap
• https://lindi.iki.fi/lindi/I9195IXXU1AOB1/recovery_flash_heimdall_d0526a3b_Debian_x64.try2.pcap
• https://lindi.iki.fi/lindi/I9195IXXU1AOB1/recovery_flash_valgrind_heimdall_d0526a3b_Debian_x64.pcap