MobileRead Forums - View Single Post - PRS-500 reverse engineering the Reader USB protocol

kovidgoyal · 11-01-2006, 12:46 PM

Oh I agree, the documentation is the next step. This was just to let people know that it can be done easily and I'm working on it.

The way I work is by packet analysis. I use USBSnoop to capture the usb traffic generated by a particular call in ebook.py, for e.g. ls /etc. I then ananlyse the traffic pattern to decipher the SONY protocol. Yes ebookusb.dll is a wrapper around USB operations. There are two types of packets sent on the USB stream control packets and data packets. igor has already outlined the structure of the data packets, so all I have to do is identify the sequence of control packets corresponding to different function calls. The packets are encoded little endian, the first 16 bytes is usually meta-information, the remainder is the actual content. The code posted above is very preliminary, it doesn't really identify the structure of most packets, it simply duplicates the recorded USB data stream. At some point next week I will post better code that documents the structure and sequence of packets.

Generating your own table of packets is very easy. Just use USBSnoop and format the logs using spike.pl. You have to understand the USB 1.1 specification though. If that's too much trouble, wait till next week when I post the more structured code.

11-01-2006, 12:46 PM	#6
kovidgoyal creator of calibre Posts: 43,864 Karma: 22666666 Join Date: Oct 2006 Location: Mumbai, India Device: Various	Oh I agree, the documentation is the next step. This was just to let people know that it can be done easily and I'm working on it. The way I work is by packet analysis. I use USBSnoop to capture the usb traffic generated by a particular call in ebook.py, for e.g. ls /etc. I then ananlyse the traffic pattern to decipher the SONY protocol. Yes ebookusb.dll is a wrapper around USB operations. There are two types of packets sent on the USB stream control packets and data packets. igor has already outlined the structure of the data packets, so all I have to do is identify the sequence of control packets corresponding to different function calls. The packets are encoded little endian, the first 16 bytes is usually meta-information, the remainder is the actual content. The code posted above is very preliminary, it doesn't really identify the structure of most packets, it simply duplicates the recorded USB data stream. At some point next week I will post better code that documents the structure and sequence of packets. Generating your own table of packets is very easy. Just use USBSnoop and format the logs using spike.pl. You have to understand the USB 1.1 specification though. If that's too much trouble, wait till next week when I post the more structured code. Last edited by kovidgoyal; 11-01-2006 at 12:49 PM.