Spying on USB

I have a friend with a machine (uP driven) that uses an Android tablet for control. They are connected via USB. I am working under the assumption that the Android tablet is the master in this situation.

Once coms is established, the tablet presents a UI for activating the machine. My friend has a custom accessory that he wants to attach. Ideally, he'd like to inject one of the button control signals into the machine without having to touch the Android tablet.

What I'm hoping for is a bit of guidance on how we might spy on the coms between the two devices. For the moment, I'm connecting either to my PC to see if I can get a response out of it.

As ever, you thoughts and input is appreciated.

Jon McPhalen
Hollywood, CA
It's Jon or JonnyMac -- please do not call me Jonny.


  • Adafruit sells a low/full speed USB protocol analyzer but it is rather pricy, especially if it is just going to be used for this one project. I don't have one so I can't say how well these work or how easy they are to use.

    If you have a logic analyzer with USB protocol analysis capability you could insert a cable breakout inline and tap the data signals.

    If you prefer a software based approach, you could see if any USB sniffer software is available for the Android tablet. There are definitely options available for Linux and Windows, but I wouldn't be surprised if Android comes up dry.
  • look at the machine to locate the usb-serial converter on the machine itself, tap rx/tx there and attach a propeller to read both of the signals.


    I am just another Code Monkey.
    A determined coder can write COBOL programs in any language. -- Author unknown.
    Press any key to continue, any other key to quit

    The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this post are to be interpreted as described in RFC 2119.
  • yetiyeti Posts: 587
    edited 2018-04-22 - 15:53:20
    ◁ propeller-wiki ▷ ◁ FastSpin ▷ ◁ Help Spin at RosettaCode.org ▷ ◁ No Source – No Go! ▷ ◁ DK-E ▷ ◁ :-D ▷ ◁ Stay OmmmmmmPtimistic! ▷ ◁ Why Asimov's Laws of Robotics Don't Work ▷ ◁ DNA is a four letter word. ▷ ◁ Stop slavery! Free all mitochondria! ▷
  • Jon,
    I did some tracing with the the P1 a couple of years back.
    I will see if I can find it in my archives if you like? Won't be able to do this till Wednesday though.
    My Prop boards: P8XBlade2, RamBlade, CpuBlade, TriBlade
    Prop OS (also see Sphinx, PropDos, PropCmd, Spinix)
    Website: www.clusos.com
    Prop Tools (Index) , Emulators (Index) , ZiCog (Z80)
  • Stockholm, Sweden
    I am only an egg -- Stranger in a Strange land, Robert A. Heinlein
  • rosco_pcrosco_pc Posts: 338
    edited 2018-04-23 - 04:29:44
    Wireshark might help: https://wiki.wireshark.org/CaptureSetup/USB
    or Micrisoft message analyzer: https://docs.microsoft.com/en-us/windows-hardware/drivers/usbcon/capture-and-view-ing-usb-traces-with-microsoft-message-analyzer-

    But that is more for analyzing between device and pc

    Aah, I knew I seen it somewhere: https://hackaday.com/2011/03/16/usb-man-in-the-middle-adapter/

    [EDIT: add link to passive USB tap and remove it again]
    Stockholm, Sweden
    I am only an egg -- Stranger in a Strange land, Robert A. Heinlein
  • So, my understanding here is that this machine must present a serial interface to the tablet and that there is a custom application that presents a number of functions that he can preform on this machine.

    He would like to be able to control this machine without using his tablet each time.

    This is not a simple process. The table interface is simple enough but the commands that are exchanged between the tablet and the machine could be very complicated. It may even have a heartbeat being send back and forth to make sure the tablet hasn't gone to sleep and is no longer in control.

    We need to know what the machine interface is doing. Either by getting the source to the application or specs for the machine. Trial and error here may break the machine.

  • Turns out that my customer had the APK for the display/control device. I am going to stick that onto a cheap Android table and connect the other end to a Propeller to see if -- through trial and error -- I can determine the query sequence. When I plugged my computer into the micro that actually runs the machine, it did respond as a USB slave. This makes me assume that the Android is the master hence my idea about using the Propeller to capture the query sequence from the Android.
    Jon McPhalen
    Hollywood, CA
    It's Jon or JonnyMac -- please do not call me Jonny.
  • You might want to try Labview by National Instruments. I use this with the Prop and Bs2 all the time. It will allow to have a control panel in windows to turn on switches, read I/O, analog signals etc.. The function in Labview for the USB is Visa, Visa open, Visa write, read. etc. They also have an Android toolkit.
  • Jon,
    Did you ever get this working?
Sign In or Register to comment.