usb's quirks ... how to sniff bios'es messages addressed to usb rom chip
Hello guys, reading the FreeBSD forums I learned about the usb freebsd mailing list. I try to explain my question. Plugging in an hard disk into the usb port (without mounting the filesystem), I've noticed that the inserting operation was detected by the chip and a counter inside the HD memory was increased by one each time the hard disk was inserted. So a write operation has been happen !! The drive in question is a solid hard disk SSD 1TB Samsung 850 EVO Sata III. This test has been done on a Linux O.S (that is a very disaster in terms of security policy, due to the demons of the GUI !) This sounds like something done by the BIOS. Some can keep track on a wide variety of things. For example, it happens that the Bios keep track of the times when the case is opened. QUESTION: Is the FreeBSD usbdump(8) the right way to listen on events coming from bios (in this case a writing access) and show changes happened into the rom memory of the chip of the usb HD ? Appreciated is any your help also about the correct sintax of the usbdump. Thanks in advance. Vincenzo. --- Questa email è stata esaminata alla ricerca di virus da AVG. http://www.avg.com ___ freebsd-usb@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-usb To unsubscribe, send any mail to "freebsd-usb-unsubscr...@freebsd.org"
Re: usb's quirks ... how to sniff bios'es messages addressed to usb rom chip
On 03/19/18 19:46, Vincenzo Di Salvo wrote: Hello guys, reading the FreeBSD forums I learned about the usb freebsd mailing list. I try to explain my question. Plugging in an hard disk into the usb port (without mounting the filesystem), I've noticed that the inserting operation was detected by the chip and a counter inside the HD memory was increased by one each time the hard disk was inserted. So a write operation has been happen !! The drive in question is a solid hard disk SSD 1TB Samsung 850 EVO Sata III. This test has been done on a Linux O.S (that is a very disaster in terms of security policy, due to the demons of the GUI !) This sounds like something done by the BIOS. Some can keep track on a wide variety of things. For example, it happens that the Bios keep track of the times when the case is opened. QUESTION: Is the FreeBSD usbdump(8) the right way to listen on events coming from bios (in this case a writing access) and show changes happened into the rom memory of the chip of the usb HD ? Appreciated is any your help also about the correct sintax of the usbdump. Hi, usbdump has a manual page, man usbdump, describing how to use it. There is also a Google Summer of code project to add wireshark support for the FreeBSD usbdump format. --HPS ___ freebsd-usb@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-usb To unsubscribe, send any mail to "freebsd-usb-unsubscr...@freebsd.org"
R: usb's quirks ... how to sniff bios'es messages addressed to usb rom chip
What you surmise, effectively happens.
I can see the same behavior when I directly pluging and then unpluging the
HD using the SATA power connector (I think that this happens for those hard
disks or usb sticks whose chip is designed to detect a such action).
However, my interest is: how to detect the bit that increment the counter in
the SMART register using usbdump(8) or wireshark.
Is there a document that explain in details the usbdump output ?
Regarding Wireshark what output string I need to look for (SMART ?
POWER ?)
I kindly contact you to know if someone of the list has already done this
test, if he can address me on the right street among the numerous
informations shown by wireshark or usbdump.
Tutorials also are appreciated (if they exist).
Regards.
-Messaggio originale-
Da: Bertrand Petit [mailto:elr...@phoe.frmug.org]
Inviato: martedì 20 marzo 2018 00:01
A: Vincenzo Di Salvo
Oggetto: Re: usb's quirks ... how to sniff bios'es messages addressed to usb
rom chip
On Mon, Mar 19, 2018 at 07:46:57PM +0100, Vincenzo Di Salvo wrote:
>
> Plugging in an hard disk into the usb port (without mounting the
> filesystem), I've noticed that the inserting operation was detected by the
> chip and a counter inside the HD memory was increased by one each time the
> hard disk was inserted.
This description leads me to surmise that you are maybe observing
the
incrementation, by the HD itself, of a SMART register on power availability
transitions as it is designed to do. I think you will observe the same
behavior when directly pluging and then unpluging the SATA power connector.
--
%!PS -- Bertrand Petit
/D{def}def/E{exch}D/G{get}D/I{2
div}D/U{dup}D/L{roll}D/Y{setgray}D/N{newpath}D
/O{N 0 0 moveto}D/P{pop}D/T{translate}D currentpagedevice/PageSize G U 0 G/w
E
D 1 G /h E D w I h I T 0 Y 1 setlinewidth 0 1 2 { P 120 rotate 2 4 w U mul h
U
mul add sqrt I 50 add {N 50 0 3 2 L 0 360 arc stroke}for}for/s{O true
charpath
pathbbox exch 4 -1 L E sub I 3 1 L sub I} D /l(bp)D 0.94 Y /Helvetica
findfont
22 scalefont setfont l s P(x)s exch P T O l show showpage
---
Questa email è stata esaminata alla ricerca di virus da AVG.
http://www.avg.com
___
freebsd-usb@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-usb
To unsubscribe, send any mail to "freebsd-usb-unsubscr...@freebsd.org"
