How do I intercept messages from a USB device on Linux?

Question

I have a popular drawing tablet that I connect to my PC with USB. Once connected, the tablet detects hand movements and manipulates the pointer accordingly. Somewhere, the tablet is transmitting this data to my computer.

My goal is to intercept these transmissions and manipulate the mouse after I process the data. The buzzwords I have found are: device drivers and HID, but I haven't been able to piece together much more than that.

Assuming this is possible, I have a few questions:

1. How is this done if the data format is known?
2. How is this done if the data format is unknown/proprietary?

My computer is running Ubuntu (but answers related to any form of a Linux OS are greatly appreciated!).

---

Note: This question is similar but intended for Windows.

Inverness

Here is a good starting point: lxr.free-electrons.com/source/drivers/usb/README – Shellans

Answer 1

Actually you missed a buzzword "USB sniffing". ;-)

Here are a few tutorials on USB sniffing on Linux, to get you started.

• Official Wireshark wiki for USB monitoring
• biot.com/blog/usb-sniffing-on-linux (InternetArchive)
• tjworld.net/wiki/Linux/Ubuntu/USBmonitoring

Essentially you use the usbmon Linux kernel module to capture the USB-packets and Wireshark as a front-end to display and analyse the captured USB stream.

Omniscience

I finally got around to doing this and it worked great, so thanks again. The problem I have, though, is that this still doesn't prevent the message from reaching the OS (and subsequently moving the mouse). I'd like to find a way to prevent that entirely. – Inverness

@Inverness You could try disabling it with xinput askubuntu.com/questions/160945/… – Yovonnda

How to do the same on an Android mobile/tablet instead of Linux Desktop? – Falkner

@sdasdadas, how did you solve the problem? can you give some insight – Fab

Thanks @oleTange. Replaced it with a wayback-machine link. – Omniscience

Answer 2

To add another useful resource: Kernel manual for usbmon

You can use the following commands on Debian Linux to view debug log for usbmon in text format using usbmon Kernel's built in usb monitoring:

• $sudo -i to use root
• #modprobe usbmon
• #ls /sys/kernel/debug/usb/usbmon to view bus sockets
• #cat /sys/kernel/debug/usb/devices to view devices at each bus socket
• #cat /sys/kernel/debug/usb/usbmon/<bus socket> to view or you can route stdout to a file using >

Gt