USB Spy

Project information

usb-spy is a USB Mass Storage traffic analyzer built around a WiFi or Ethernet-enabled microcontroller.

The board exposes a disk image (FAT or any filesystem) as a fake USB Mass Storage device to a target system, while the actual storage data is provided by a remote server over WiFi or Ethernet. This setup allows usb-spy to intercept and analyze every block access performed by the target.

Beyond raw block-level tracing, usb-spy understands filesystems and can map each accessed block back to the corresponding file and directory, making it easy to immediately see which file is being read or written, instead of only raw sector numbers.

Additionally, usb-spy can emulate any USB device by customizing device properties such as vendor ID, product ID, serial number, manufacturer, and product name through a JSON configuration file. This allows you to impersonate specific USB devices for testing and analysis purposes.

The tool is easily extendable through user-written Python stubs, allowing you to implement custom logic for handling USB read/write events and block-level operations.

usb hacking toctou tinyusb