1 /* packet-adb.c
2 * Routines for Android Debug Bridge Transport Protocol
3 *
4 * Copyright 2014 Michal Labedzki for Tieto Corporation
5 *
6 * Wireshark - Network traffic analyzer
7 * By Gerald Combs <gerald@wireshark.org>
8 * Copyright 1998 Gerald Combs
9 *
10 * SPDX-License-Identifier: GPL-2.0-or-later
11 */
12
13 #include "config.h"
14
15 #include <epan/packet.h>
16 #include <epan/prefs.h>
17 #include <epan/expert.h>
18 #include <wiretap/wtap.h>
19
20 #include "packet-adb_service.h"
21 #include "packet-usb.h"
22
23 static int proto_adb = -1;
24 static int hf_command = -1;
25 static int hf_argument_0 = -1;
26 static int hf_argument_1 = -1;
27 static int hf_data_length = -1;
28 static int hf_data_crc32 = -1;
29 static int hf_magic = -1;
30 static int hf_local_id = -1;
31 static int hf_remote_id = -1;
32 static int hf_version = -1;
33 static int hf_max_data = -1;
34 static int hf_zero = -1;
35 static int hf_sequence = -1;
36 static int hf_online = -1;
37 static int hf_auth_type = -1;
38 static int hf_data = -1;
39 static int hf_service = -1;
40 static int hf_data_fragment = -1;
41 static int hf_command_in_frame = -1;
42 static int hf_completed_in_frame = -1;
43 static int hf_service_start_in_frame = -1;
44 static int hf_close_local_in_frame = -1;
45 static int hf_close_remote_in_frame = -1;
46 static int hf_connection_info = -1;
47
48 static gint ett_adb = -1;
49 static gint ett_adb_arg0 = -1;
50 static gint ett_adb_arg1 = -1;
51 static gint ett_adb_crc = -1;
52 static gint ett_adb_magic = -1;
53
54 static expert_field ei_invalid_magic = EI_INIT;
55 static expert_field ei_invalid_crc = EI_INIT;
56 static expert_field ei_invalid_data = EI_INIT;
57
58 static dissector_handle_t adb_handle;
59 static dissector_handle_t adb_service_handle;
60
61 static gint proto_tcp = -1;
62 static gint proto_usb = -1;
63
64 static wmem_tree_t *command_info = NULL;
65 static wmem_tree_t *service_info = NULL;
66
67 typedef struct service_data_t {
68 guint32 start_in_frame;
69
70 guint32 close_local_in_frame;
71 guint32 close_remote_in_frame;
72
73 guint32 local_id;
74 guint32 remote_id;
75
76 const gchar *service;
77 } service_data_t;
78
79 typedef struct command_data_t {
80 guint32 command;
81
82 guint32 command_in_frame;
83 guint32 response_in_frame;
84
85 guint32 arg0;
86 guint32 arg1;
87
88 guint32 data_length;
89 guint32 crc32;
90
91 guint32 completed_in_frame;
92 guint32 reassemble_data_length;
93 guint8 *reassemble_data;
94 guint32 reassemble_error_in_frame;
95 } command_data_t;
96
97 static guint32 max_in_frame = G_MAXUINT32;
98
99 static const value_string command_vals[] = {
100 { 0x434e5953, "Synchronize" },
101 { 0x45534c43, "Close" },
102 { 0x45545257, "Write" },
103 { 0x48545541, "Authenticate" },
104 { 0x4e584e43, "Connect" },
105 { 0x4e45504f, "Open" },
106 { 0x59414b4f, "Okay" },
107 { 0, NULL }
108 };
109
110 static const value_string magic_vals[] = {
111 { 0xFFFFFFFF ^ 0x434e5953, "Synchronize" },
112 { 0xFFFFFFFF ^ 0x45534c43, "Close" },
113 { 0xFFFFFFFF ^ 0x45545257, "Write" },
114 { 0xFFFFFFFF ^ 0x48545541, "Authenticate" },
115 { 0xFFFFFFFF ^ 0x4e584e43, "Connect" },
116 { 0xFFFFFFFF ^ 0x4e45504f, "Open" },
117 { 0xFFFFFFFF ^ 0x59414b4f, "Okay" },
118 { 0, NULL }
119 };
120
121 static const value_string auth_type_vals[] = {
122 { 1, "Token" },
123 { 2, "Signature" },
124 { 3, "RSA Public Key" },
125 { 0, NULL }
126 };
127
128 #define A_SYNC 0x434e5953
129 #define A_CLSE 0x45534c43
130 #define A_WRTE 0x45545257
131 #define A_AUTH 0x48545541
132 #define A_CNXN 0x4e584e43
133 #define A_OPEN 0x4e45504f
134 #define A_OKAY 0x59414b4f
135
136 #define ADB_TCP_PORT 5555
137
138 void proto_register_adb(void);
139 void proto_reg_handoff_adb(void);
140
141 static void
save_command(guint32 cmd,guint32 arg0,guint32 arg1,guint32 data_length,guint32 crc32,service_data_t * service_data,gint proto,void * data,packet_info * pinfo,service_data_t ** returned_service_data,command_data_t ** returned_command_data)142 save_command(guint32 cmd, guint32 arg0, guint32 arg1, guint32 data_length,
143 guint32 crc32, service_data_t *service_data, gint proto, void *data,
144 packet_info *pinfo, service_data_t **returned_service_data,
145 command_data_t **returned_command_data)
146 {
147 wmem_tree_key_t key[6];
148 guint32 interface_id;
149 guint32 bus_id;
150 guint32 device_address;
151 guint32 side_id;
152 guint32 frame_number;
153 command_data_t *command_data;
154 wmem_tree_t *wmem_tree;
155 gint direction = P2P_DIR_UNKNOWN;
156 usb_conv_info_t *usb_conv_info = (usb_conv_info_t *) data;
157
158 frame_number = pinfo->num;
159
160 if (pinfo->rec->presence_flags & WTAP_HAS_INTERFACE_ID)
161 interface_id = pinfo->rec->rec_header.packet_header.interface_id;
162 else
163 interface_id = 0;
164
165 if (proto == proto_usb) {
166 usb_conv_info = (usb_conv_info_t *) data;
167 DISSECTOR_ASSERT(usb_conv_info);
168
169 direction = usb_conv_info->direction;
170
171 bus_id = usb_conv_info->bus_id;
172 device_address = usb_conv_info->device_address;
173
174 key[0].length = 1;
175 key[0].key = &interface_id;
176 key[1].length = 1;
177 key[1].key = &bus_id;
178 key[2].length = 1;
179 key[2].key = &device_address;
180 key[3].length = 1;
181 key[3].key = &side_id;
182 key[4].length = 1;
183 key[4].key = &frame_number;
184 key[5].length = 0;
185 key[5].key = NULL;
186 } else { /* tcp */
187 if (pinfo->destport == ADB_TCP_PORT)
188 direction = P2P_DIR_SENT;
189 else
190 direction = P2P_DIR_RECV;
191
192 key[0].length = 1;
193 key[0].key = &interface_id;
194 key[1].length = 1;
195 key[2].length = 1;
196 if (direction == P2P_DIR_SENT) {
197 key[1].key = &pinfo->srcport;
198 key[2].key = &pinfo->destport;
199 } else {
200 key[1].key = &pinfo->destport;
201 key[2].key = &pinfo->srcport;
202 }
203 key[3].length = 1;
204 key[3].key = &side_id;
205 key[4].length = 1;
206 key[4].key = &frame_number;
207 key[5].length = 0;
208 key[5].key = NULL;
209 }
210
211 if (direction == P2P_DIR_SENT)
212 if (cmd == A_CLSE)
213 side_id = arg1; /* OUT: local id */
214 else
215 side_id = arg0; /* OUT: local id */
216 else
217 side_id = arg1; /* IN: remote id */
218
219 if (cmd == A_OPEN) {
220 service_data = wmem_new(wmem_file_scope(), service_data_t);
221
222 service_data->start_in_frame = pinfo->num;
223 service_data->close_local_in_frame = max_in_frame;
224 service_data->close_remote_in_frame = max_in_frame;
225
226 service_data->local_id = arg0;
227 service_data->remote_id = arg1;
228
229 service_data->service = "unknown";
230
231 wmem_tree_insert32_array(service_info, key, service_data);
232 }
233
234 command_data = wmem_new(wmem_file_scope(), command_data_t);
235
236 command_data->command = cmd;
237 command_data->arg0 = arg0;
238 command_data->arg1 = arg1;
239
240 command_data->command_in_frame = pinfo->num;
241 command_data->response_in_frame = max_in_frame;
242
243 command_data->crc32 = crc32;
244 command_data->data_length = data_length;
245 if (data_length == 0)
246 command_data->completed_in_frame = pinfo->num;
247 else
248 command_data->completed_in_frame = max_in_frame;
249 command_data->reassemble_data_length = 0;
250 command_data->reassemble_data = (guint8 *) wmem_alloc(wmem_file_scope(), command_data->data_length);
251 command_data->reassemble_error_in_frame = 0;
252
253 key[3].length = 1;
254 key[3].key = &frame_number;
255 key[4].length = 0;
256 key[4].key = NULL;
257 wmem_tree_insert32_array(command_info, key, command_data);
258
259 if (direction == P2P_DIR_SENT)
260 if (command_data->command == A_CLSE)
261 side_id = command_data->arg1; /* OUT: local id */
262 else
263 side_id = command_data->arg0; /* OUT: local id */
264 else
265 side_id = command_data->arg1; /* IN: remote id */
266
267 key[3].length = 1;
268 key[3].key = &side_id;
269 key[4].length = 0;
270 key[4].key = NULL;
271
272 wmem_tree = (wmem_tree_t *) wmem_tree_lookup32_array(service_info, key);
273 if (wmem_tree) {
274 service_data = (service_data_t *) wmem_tree_lookup32_le(wmem_tree, frame_number);
275 }
276
277 if (cmd == A_OKAY) {
278 if (!service_data) {
279 if (direction == P2P_DIR_SENT)
280 side_id = command_data->arg0; /* OUT: local id */
281 else
282 side_id = command_data->arg1; /* IN: remote id */
283
284 wmem_tree = (wmem_tree_t *) wmem_tree_lookup32_array(service_info, key);
285 if (wmem_tree) {
286 service_data = (service_data_t *) wmem_tree_lookup32_le(wmem_tree, frame_number);
287 }
288 }
289
290 if (service_data && service_data->remote_id == 0 && direction == P2P_DIR_RECV) {
291 if (direction == P2P_DIR_SENT) {
292 service_data->remote_id = arg1;
293 } else {
294 service_data->remote_id = arg0;
295 }
296
297 side_id = service_data->remote_id;
298
299 key[4].length = 1;
300 key[4].key = &frame_number;
301 key[5].length = 0;
302 key[5].key = NULL;
303
304 wmem_tree_insert32_array(service_info, key, service_data);
305 }
306 } else if (cmd == A_CLSE) {
307 if (service_data) {
308 if (direction == P2P_DIR_RECV && service_data->local_id == arg1)
309 service_data->close_local_in_frame = pinfo->num;
310 else if (direction == P2P_DIR_SENT && service_data->remote_id == arg1)
311 service_data->close_remote_in_frame = pinfo->num;
312 }
313 }
314
315 DISSECTOR_ASSERT(returned_service_data && returned_command_data);
316 *returned_service_data = service_data;
317 *returned_command_data = command_data;
318 }
319
320 static gint
dissect_adb(tvbuff_t * tvb,packet_info * pinfo,proto_tree * tree,void * data)321 dissect_adb(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data)
322 {
323 proto_item *main_item;
324 proto_tree *main_tree;
325 proto_item *arg0_item;
326 proto_tree *arg0_tree;
327 proto_item *arg1_item;
328 proto_tree *arg1_tree;
329 proto_item *magic_item;
330 proto_item *crc_item;
331 proto_tree *crc_tree = NULL;
332 proto_item *sub_item;
333 gint offset = 0;
334 guint32 command;
335 guint32 arg0;
336 guint32 arg1;
337 guint32 data_length = 0;
338 guint32 crc32 = 0;
339 usb_conv_info_t *usb_conv_info = NULL;
340 wmem_tree_key_t key[5];
341 guint32 interface_id;
342 guint32 bus_id;
343 guint32 device_address;
344 guint32 side_id;
345 guint32 frame_number;
346 gboolean is_command = TRUE;
347 gboolean is_next_fragment = FALSE;
348 gboolean is_service = FALSE;
349 gint proto;
350 gint direction = P2P_DIR_UNKNOWN;
351 wmem_tree_t *wmem_tree;
352 command_data_t *command_data = NULL;
353 service_data_t *service_data = NULL;
354
355 col_set_str(pinfo->cinfo, COL_PROTOCOL, "ADB");
356 col_clear(pinfo->cinfo, COL_INFO);
357
358 main_item = proto_tree_add_item(tree, proto_adb, tvb, offset, -1, ENC_NA);
359 main_tree = proto_item_add_subtree(main_item, ett_adb);
360
361 frame_number = pinfo->num;
362
363 /* XXX: Why? If interface is USB only first try is correct
364 * (and seems strange...), in other cases standard check for
365 * previous protocol is correct */
366 proto = (gint) GPOINTER_TO_INT(wmem_list_frame_data(/*wmem_list_frame_prev*/(wmem_list_tail(pinfo->layers))));
367 if (proto != proto_usb) {
368 proto = (gint) GPOINTER_TO_INT(wmem_list_frame_data(wmem_list_frame_prev(wmem_list_tail(pinfo->layers))));
369 }
370
371 if (proto == proto_usb) {
372 usb_conv_info = (usb_conv_info_t *) data;
373 DISSECTOR_ASSERT(usb_conv_info);
374
375 direction = usb_conv_info->direction;
376 } else if (proto == proto_tcp) {
377 if (pinfo->destport == ADB_TCP_PORT)
378 direction = P2P_DIR_SENT;
379 else
380 direction = P2P_DIR_RECV;
381 } else {
382 return offset;
383 }
384
385 if (pinfo->rec->presence_flags & WTAP_HAS_INTERFACE_ID)
386 interface_id = pinfo->rec->rec_header.packet_header.interface_id;
387 else
388 interface_id = 0;
389
390 if (proto == proto_usb) {
391 bus_id = usb_conv_info->bus_id;
392 device_address = usb_conv_info->device_address;
393
394 key[0].length = 1;
395 key[0].key = &interface_id;
396 key[1].length = 1;
397 key[1].key = &bus_id;
398 key[2].length = 1;
399 key[2].key = &device_address;
400 key[3].length = 0;
401 key[3].key = NULL;
402 } else { /* tcp */
403 key[0].length = 1;
404 key[0].key = &interface_id;
405 key[1].length = 1;
406 key[2].length = 1;
407 if (direction == P2P_DIR_SENT) {
408 key[1].key = &pinfo->srcport;
409 key[2].key = &pinfo->destport;
410 } else {
411 key[1].key = &pinfo->destport;
412 key[2].key = &pinfo->srcport;
413 }
414 key[3].length = 0;
415 key[3].key = NULL;
416 }
417
418 wmem_tree = (wmem_tree_t *) wmem_tree_lookup32_array(command_info, key);
419 if (wmem_tree) {
420 command_data = (command_data_t *) wmem_tree_lookup32_le(wmem_tree, frame_number);
421 if (command_data && command_data->completed_in_frame >= frame_number &&
422 command_data->command_in_frame <= frame_number) {
423
424 if (command_data->command_in_frame != frame_number) {
425 is_command = FALSE;
426 is_next_fragment = TRUE;
427 }
428
429 data_length = command_data->data_length;
430 crc32 = command_data->crc32;
431
432 if (direction == P2P_DIR_SENT) {
433 if (command_data->command == A_CLSE)
434 side_id = command_data->arg1; /* OUT: local id */
435 else
436 side_id = command_data->arg0; /* OUT: local id */
437 } else {
438 side_id = command_data->arg1; /* IN: remote id */
439 }
440
441 key[3].length = 1;
442 key[3].key = &side_id;
443 key[4].length = 0;
444 key[4].key = NULL;
445
446 wmem_tree = (wmem_tree_t *) wmem_tree_lookup32_array(service_info, key);
447 if (wmem_tree) {
448 service_data = (service_data_t *) wmem_tree_lookup32_le(wmem_tree, frame_number);
449 if (service_data && command_data->command == A_OPEN) {
450 is_service = TRUE;
451 }
452 }
453 }
454 }
455
456 /* Simple heuristics to check if packet is command or data */
457 if ((command_data && command_data->completed_in_frame <= frame_number) || !command_data) {
458 if (tvb_reported_length(tvb) < 24) {
459 is_command = FALSE;
460 } else if (tvb_reported_length(tvb) >= 24) {
461 command = tvb_get_letohl(tvb, offset);
462
463 if (command != A_SYNC && command != A_CLSE && command != A_WRTE &&
464 command != A_AUTH && command != A_CNXN && command != A_OPEN && command != A_OKAY)
465 is_command = FALSE;
466 else if (command != (0xFFFFFFFF ^ tvb_get_letohl(tvb, offset + 20)))
467 is_command = FALSE;
468
469 if (is_command) {
470 data_length = tvb_get_letohl(tvb, offset + 12);
471 crc32 = tvb_get_letohl(tvb, offset + 16);
472 }
473 if (command == A_OPEN) is_service = TRUE;
474 }
475 }
476
477 if (service_data && !(command_data->command == A_OPEN && is_next_fragment)) {
478 sub_item = proto_tree_add_string(main_tree, hf_service, tvb, offset, 0, service_data->service);
479 proto_item_set_generated(sub_item);
480 }
481
482 if (service_data) {
483 sub_item = proto_tree_add_uint(main_tree, hf_service_start_in_frame, tvb, offset, 0, service_data->start_in_frame);
484 proto_item_set_generated(sub_item);
485
486 if (service_data->close_local_in_frame < max_in_frame) {
487 sub_item = proto_tree_add_uint(main_tree, hf_close_local_in_frame, tvb, offset, 0, service_data->close_local_in_frame);
488 proto_item_set_generated(sub_item);
489 }
490
491 if (service_data->close_remote_in_frame < max_in_frame) {
492 sub_item = proto_tree_add_uint(main_tree, hf_close_remote_in_frame, tvb, offset, 0, service_data->close_remote_in_frame);
493 proto_item_set_generated(sub_item);
494 }
495 }
496
497 if (is_command) {
498 proto_tree_add_item(main_tree, hf_command, tvb, offset, 4, ENC_LITTLE_ENDIAN);
499 command = tvb_get_letohl(tvb, offset);
500 offset += 4;
501
502 col_append_str(pinfo->cinfo, COL_INFO, val_to_str_const(command, command_vals, "Unknown command"));
503
504 arg0_item = proto_tree_add_item(main_tree, hf_argument_0, tvb, offset, 4, ENC_LITTLE_ENDIAN);
505 arg0_tree = proto_item_add_subtree(arg0_item, ett_adb_arg0);
506 arg0 = tvb_get_letohl(tvb, offset);
507 offset += 4;
508
509 arg1_item = proto_tree_add_item(main_tree, hf_argument_1, tvb, offset, 4, ENC_LITTLE_ENDIAN);
510 arg1_tree = proto_item_add_subtree(arg1_item, ett_adb_arg1);
511 arg1 = tvb_get_letohl(tvb, offset);
512 offset += 4;
513
514 switch (command) {
515 case A_CNXN:
516 proto_tree_add_item(arg0_tree, hf_version, tvb, offset - 8, 4, ENC_LITTLE_ENDIAN);
517 proto_tree_add_item(arg1_tree, hf_max_data, tvb, offset - 4, 4, ENC_LITTLE_ENDIAN);
518
519 col_append_fstr(pinfo->cinfo, COL_INFO, "(version=%u.%u.%u, max_data=%u)", tvb_get_guint8(tvb, offset - 5), tvb_get_guint8(tvb, offset - 6), tvb_get_letohs(tvb, offset - 7), tvb_get_letohl(tvb, offset - 4));
520 break;
521 case A_AUTH:
522 proto_tree_add_item(arg0_tree, hf_auth_type, tvb, offset - 8, 4, ENC_LITTLE_ENDIAN);
523 proto_tree_add_item(arg1_tree, hf_zero, tvb, offset - 4, 4, ENC_LITTLE_ENDIAN);
524
525 col_append_fstr(pinfo->cinfo, COL_INFO, "(type=%s, 0)", val_to_str_const(tvb_get_letohl(tvb, offset - 8), auth_type_vals, "Unknown"));
526 break;
527 case A_OPEN:
528 proto_tree_add_item(arg0_tree, hf_local_id, tvb, offset - 8, 4, ENC_LITTLE_ENDIAN);
529 proto_tree_add_item(arg1_tree, hf_zero, tvb, offset - 4, 4, ENC_LITTLE_ENDIAN);
530
531 col_append_fstr(pinfo->cinfo, COL_INFO, "(local=%u, 0)", tvb_get_letohl(tvb, offset - 8));
532 break;
533 case A_WRTE:
534 proto_tree_add_item(arg0_tree, hf_local_id, tvb, offset - 8, 4, ENC_LITTLE_ENDIAN);
535 proto_tree_add_item(arg1_tree, hf_remote_id, tvb, offset - 4, 4, ENC_LITTLE_ENDIAN);
536
537 col_append_fstr(pinfo->cinfo, COL_INFO, "(local=%u, remote=%u)", arg0, arg1);
538 break;
539 case A_CLSE:
540 case A_OKAY:
541 proto_tree_add_item(arg0_tree, hf_local_id, tvb, offset - 8, 4, ENC_LITTLE_ENDIAN);
542 proto_tree_add_item(arg1_tree, hf_remote_id, tvb, offset - 4, 4, ENC_LITTLE_ENDIAN);
543
544 col_append_fstr(pinfo->cinfo, COL_INFO, "(local=%u, remote=%u)", tvb_get_letohl(tvb, offset - 8), tvb_get_letohl(tvb, offset - 4));
545 break;
546 case A_SYNC:
547 proto_tree_add_item(arg0_tree, hf_online, tvb, offset - 8, 4, ENC_LITTLE_ENDIAN);
548 proto_tree_add_item(arg1_tree, hf_sequence, tvb, offset - 4, 4, ENC_LITTLE_ENDIAN);
549
550 col_append_fstr(pinfo->cinfo, COL_INFO, "(online=%s, sequence=%u)", tvb_get_letohl(tvb, offset - 8) ? "Yes": "No", tvb_get_letohl(tvb, offset - 4));
551 break;
552 }
553
554 proto_tree_add_item(main_tree, hf_data_length, tvb, offset, 4, ENC_LITTLE_ENDIAN);
555 offset += 4;
556
557 if (data_length > 0)
558 col_append_fstr(pinfo->cinfo, COL_INFO, " length=%u ", data_length);
559
560 crc_item = proto_tree_add_item(main_tree, hf_data_crc32, tvb, offset, 4, ENC_LITTLE_ENDIAN);
561 crc_tree = proto_item_add_subtree(crc_item, ett_adb_crc);
562 crc32 = tvb_get_letohl(tvb, offset);
563 offset += 4;
564
565 magic_item = proto_tree_add_item(main_tree, hf_magic, tvb, offset, 4, ENC_LITTLE_ENDIAN);
566 if ((tvb_get_letohl(tvb, offset) ^ 0xFFFFFFFF) != command) {
567 proto_tree *expert_tree;
568
569 expert_tree = proto_item_add_subtree(magic_item, ett_adb_magic);
570 proto_tree_add_expert(expert_tree, pinfo, &ei_invalid_magic, tvb, offset, 4);
571 }
572
573 if (!pinfo->fd->visited)
574 save_command(command, arg0, arg1, data_length, crc32, service_data, proto, data, pinfo, &service_data, &command_data);
575 offset += 4;
576 }
577
578 if (!pinfo->fd->visited && command_data) {
579 if (command_data->command_in_frame != frame_number) {
580 is_command = FALSE;
581 is_next_fragment = TRUE;
582 }
583
584 data_length = command_data->data_length;
585 crc32 = command_data->crc32;
586
587 if ((command_data->command_in_frame != frame_number && tvb_captured_length(tvb) == data_length) ||
588 (command_data->command_in_frame == frame_number && tvb_captured_length(tvb) == data_length + 24)
589 ) {
590 command_data->reassemble_data_length = command_data->data_length;
591 command_data->completed_in_frame = frame_number;
592 }
593 }
594
595 if (is_next_fragment && command_data) {
596 sub_item = proto_tree_add_uint(main_tree, hf_command_in_frame, tvb, offset, 0, command_data->command_in_frame);
597 proto_item_set_generated(sub_item);
598
599 sub_item = proto_tree_add_uint(main_tree, hf_command, tvb, offset, 0, command_data->command);
600 proto_item_set_generated(sub_item);
601
602 sub_item = proto_tree_add_uint(main_tree, hf_data_length, tvb, offset, 0, command_data->data_length);
603 proto_item_set_generated(sub_item);
604
605 crc_item = proto_tree_add_uint(main_tree, hf_data_crc32, tvb, offset, 0, command_data->crc32);
606 crc_tree = proto_item_add_subtree(crc_item, ett_adb_crc);
607 proto_item_set_generated(crc_item);
608 }
609
610 if (command_data && command_data->completed_in_frame != frame_number) {
611 sub_item = proto_tree_add_uint(main_tree, hf_completed_in_frame, tvb, offset, 0, command_data->completed_in_frame);
612 proto_item_set_generated(sub_item);
613 }
614
615
616 if (tvb_captured_length_remaining(tvb, offset) > 0 && (!is_command || data_length > 0)) {
617 guint32 crc = 0;
618 guint32 i_offset;
619
620 /* First pass: store message payload (usually a single packet, but
621 * potentially multiple fragments). */
622 if (!pinfo->fd->visited && command_data && command_data->reassemble_data_length < command_data->data_length) {
623 guint chunklen = tvb_captured_length_remaining(tvb, offset);
624 if (chunklen > command_data->data_length - command_data->reassemble_data_length) {
625 chunklen = command_data->data_length - command_data->reassemble_data_length;
626 /* This should never happen, but when it does, then either we
627 * have a malicious application OR we failed to correctly match
628 * this payload with a message header. */
629 command_data->reassemble_error_in_frame = frame_number;
630 }
631
632 tvb_memcpy(tvb, command_data->reassemble_data + command_data->reassemble_data_length, offset, chunklen);
633 command_data->reassemble_data_length += chunklen;
634
635 if (command_data->reassemble_data_length >= command_data->data_length)
636 command_data->completed_in_frame = frame_number;
637 }
638
639 if (frame_number == command_data->reassemble_error_in_frame) {
640 /* data reassembly error was detected in the first pass. */
641 proto_tree_add_expert(main_tree, pinfo, &ei_invalid_data, tvb, offset, -1);
642 }
643
644 if ((!pinfo->fd->visited && command_data && command_data->reassemble_data_length < command_data->data_length) || data_length > (guint32) tvb_captured_length_remaining(tvb, offset)) { /* need reassemble */
645 proto_tree_add_item(main_tree, hf_data_fragment, tvb, offset, -1, ENC_NA);
646 col_append_str(pinfo->cinfo, COL_INFO, "Data Fragment");
647 offset = tvb_captured_length(tvb);
648
649 if (service_data && command_data && command_data->reassemble_data_length >= command_data->data_length && frame_number == command_data->completed_in_frame) {
650 tvbuff_t *next_tvb;
651 adb_service_data_t adb_service_data;
652
653 next_tvb = tvb_new_child_real_data(tvb, command_data->reassemble_data, command_data->reassemble_data_length, command_data->reassemble_data_length);
654 add_new_data_source(pinfo, next_tvb, "ADB Reassembled Data");
655
656 adb_service_data.service = service_data->service;
657 adb_service_data.direction = direction;
658
659 adb_service_data.session_key_length = 3;
660 adb_service_data.session_key = (guint32 *) wmem_alloc(pinfo->pool, adb_service_data.session_key_length * sizeof(guint32));
661 adb_service_data.session_key[0] = interface_id;
662
663 if (proto == proto_usb) {
664 adb_service_data.session_key[1] = usb_conv_info->bus_id;
665 adb_service_data.session_key[2] = usb_conv_info->device_address;
666 } else { /* tcp */
667 if (direction == P2P_DIR_SENT) {
668 adb_service_data.session_key[1] = pinfo->srcport;
669 adb_service_data.session_key[2] = pinfo->destport;
670 } else {
671 adb_service_data.session_key[1] = pinfo->destport;
672 adb_service_data.session_key[2] = pinfo->srcport;
673 }
674 }
675
676 call_dissector_with_data(adb_service_handle, next_tvb, pinfo, tree, &adb_service_data);
677 }
678 } else { /* full message */
679 for (i_offset = 0; i_offset < data_length; ++i_offset)
680 crc += tvb_get_guint8(tvb, offset + i_offset);
681
682 if (crc32 > 0 && crc32 != crc)
683 proto_tree_add_expert(crc_tree, pinfo, &ei_invalid_crc, tvb, offset, -1);
684
685 if (is_service) {
686 proto_tree_add_item(main_tree, hf_service, tvb, offset, -1, ENC_ASCII | ENC_NA);
687 if (!pinfo->fd->visited && service_data) {
688 service_data->service = (gchar *) tvb_get_stringz_enc(wmem_file_scope(), tvb, offset, NULL, ENC_ASCII);
689 }
690 col_append_fstr(pinfo->cinfo, COL_INFO, "Service: %s", tvb_get_stringz_enc(pinfo->pool, tvb, offset, NULL, ENC_ASCII));
691 offset = tvb_captured_length(tvb);
692 } else if (command_data && command_data->command == A_CNXN) {
693 const guint8 *info;
694
695 /*
696 * Format: "<systemtype>:<serialno>:<banner>".
697 * Previously adb used "device::ro.product.name=...;...;\0" as
698 * human-readable banner, but since platform/system/core commit
699 * 1792c23cb8 (2015-05-18) it is a ";"-separated feature list.
700 */
701
702 proto_tree_add_item_ret_string(main_tree, hf_connection_info, tvb, offset, -1, ENC_ASCII | ENC_NA, pinfo->pool, &info);
703 col_append_fstr(pinfo->cinfo, COL_INFO, "Connection Info: %s", info);
704 offset = tvb_captured_length(tvb);
705 } else {
706 col_append_str(pinfo->cinfo, COL_INFO, "Data");
707
708 /* Decode service payload */
709 if (service_data) {
710 tvbuff_t *next_tvb;
711 adb_service_data_t adb_service_data;
712
713 adb_service_data.service = service_data->service;
714 adb_service_data.direction = direction;
715
716 adb_service_data.session_key_length = 3;
717 adb_service_data.session_key = (guint32 *) wmem_alloc(pinfo->pool, adb_service_data.session_key_length * sizeof(guint32));
718 adb_service_data.session_key[0] = interface_id;
719
720 if (proto == proto_usb) {
721 adb_service_data.session_key[1] = usb_conv_info->bus_id;
722 adb_service_data.session_key[2] = usb_conv_info->device_address;
723 } else { /* tcp */
724 if (direction == P2P_DIR_SENT) {
725 adb_service_data.session_key[1] = pinfo->srcport;
726 adb_service_data.session_key[2] = pinfo->destport;
727 } else {
728 adb_service_data.session_key[1] = pinfo->destport;
729 adb_service_data.session_key[2] = pinfo->srcport;
730 }
731 }
732
733 next_tvb = tvb_new_subset_length_caplen(tvb, offset, tvb_captured_length_remaining(tvb, offset), tvb_captured_length_remaining(tvb, offset));
734 call_dissector_with_data(adb_service_handle, next_tvb, pinfo, tree, &adb_service_data);
735
736 } else {
737 proto_item *data_item;
738 gchar *data_str;
739
740 data_item = proto_tree_add_item(main_tree, hf_data, tvb, offset, data_length, ENC_NA);
741 data_str = tvb_format_text(pinfo->pool, tvb, offset, data_length);
742 proto_item_append_text(data_item, ": %s", data_str);
743 col_append_fstr(pinfo->cinfo, COL_INFO, " Raw: %s", data_str);
744 }
745
746 offset = tvb_captured_length(tvb);
747 }
748 }
749 }
750
751 return offset;
752 }
753
754 void
proto_register_adb(void)755 proto_register_adb(void)
756 {
757 module_t *module;
758 expert_module_t *expert_module;
759
760 static hf_register_info hf[] = {
761 { &hf_command,
762 { "Command", "adb.command",
763 FT_UINT32, BASE_HEX, VALS(command_vals), 0x00,
764 NULL, HFILL }
765 },
766 { &hf_argument_0,
767 { "Argument 0", "adb.argument.0",
768 FT_UINT32, BASE_HEX, NULL, 0x00,
769 NULL, HFILL }
770 },
771 { &hf_argument_1,
772 { "Argument 0", "adb.argument.1",
773 FT_UINT32, BASE_HEX, NULL, 0x00,
774 NULL, HFILL }
775 },
776 { &hf_data_length,
777 { "Data Length", "adb.data_length",
778 FT_UINT32, BASE_DEC, NULL, 0x00,
779 NULL, HFILL }
780 },
781 { &hf_data_crc32,
782 { "Data CRC32", "adb.data_crc32",
783 FT_UINT32, BASE_HEX, NULL, 0x00,
784 NULL, HFILL }
785 },
786 { &hf_magic,
787 { "Magic", "adb.magic",
788 FT_UINT32, BASE_HEX, VALS(magic_vals), 0x00,
789 NULL, HFILL }
790 },
791 { &hf_version,
792 { "Version", "adb.version",
793 FT_UINT32, BASE_HEX, NULL, 0x00,
794 NULL, HFILL }
795 },
796 { &hf_max_data,
797 { "Max Data", "adb.max_data",
798 FT_UINT32, BASE_DEC, NULL, 0x00,
799 NULL, HFILL }
800 },
801 { &hf_auth_type,
802 { "Type", "adb.auth_type",
803 FT_UINT32, BASE_HEX, VALS(auth_type_vals), 0x00,
804 NULL, HFILL }
805 },
806 { &hf_online,
807 { "Online", "adb.online",
808 FT_BOOLEAN, 32, TFS(&tfs_no_yes), 0x00,
809 NULL, HFILL }
810 },
811 { &hf_sequence,
812 { "Sequence", "adb.sequence",
813 FT_UINT32, BASE_DEC, NULL, 0x00,
814 NULL, HFILL }
815 },
816 { &hf_zero,
817 { "Zero", "adb.zero",
818 FT_UINT32, BASE_HEX, NULL, 0x00,
819 NULL, HFILL }
820 },
821 { &hf_local_id,
822 { "Local ID", "adb.local_id",
823 FT_UINT32, BASE_DEC, NULL, 0x00,
824 NULL, HFILL }
825 },
826 { &hf_remote_id,
827 { "Remote ID", "adb.remote_id",
828 FT_UINT32, BASE_DEC, NULL, 0x00,
829 NULL, HFILL }
830 },
831 { &hf_data,
832 { "Data", "adb.data",
833 FT_NONE, BASE_NONE, NULL, 0x00,
834 NULL, HFILL }
835 },
836 { &hf_service,
837 { "Service", "adb.service",
838 FT_STRING, BASE_NONE, NULL, 0x00,
839 NULL, HFILL }
840 },
841 { &hf_data_fragment,
842 { "Data Fragment", "adb.data_fragment",
843 FT_NONE, BASE_NONE, NULL, 0x00,
844 NULL, HFILL }
845 },
846 { &hf_service_start_in_frame,
847 { "Service Start in Frame", "adb.service_start_in_frame",
848 FT_FRAMENUM, BASE_NONE, NULL, 0x00,
849 NULL, HFILL }
850 },
851 { &hf_close_local_in_frame,
852 { "Local Service Close in Frame", "adb.close_local_in_frame",
853 FT_FRAMENUM, BASE_NONE, NULL, 0x00,
854 NULL, HFILL }
855 },
856 { &hf_close_remote_in_frame,
857 { "Remote Service Close in Frame", "adb.close_remote_in_frame",
858 FT_FRAMENUM, BASE_NONE, NULL, 0x00,
859 NULL, HFILL }
860 },
861 { &hf_command_in_frame,
862 { "Command in Frame", "adb.command_in_frame",
863 FT_FRAMENUM, BASE_NONE, NULL, 0x00,
864 NULL, HFILL }
865 },
866 { &hf_completed_in_frame,
867 { "Completed in Frame", "adb.completed_in_frame",
868 FT_FRAMENUM, BASE_NONE, NULL, 0x00,
869 NULL, HFILL }
870 },
871 { &hf_connection_info,
872 { "Info", "adb.connection_info",
873 FT_STRING, STR_ASCII, NULL, 0x00,
874 NULL, HFILL }
875 }
876 };
877
878 static gint *ett[] = {
879 &ett_adb,
880 &ett_adb_arg0,
881 &ett_adb_arg1,
882 &ett_adb_crc,
883 &ett_adb_magic
884 };
885
886 static ei_register_info ei[] = {
887 { &ei_invalid_magic, { "adb.expert.invalid_magic", PI_PROTOCOL, PI_WARN, "Invalid Magic", EXPFILL }},
888 { &ei_invalid_crc, { "adb.expert.crc_error", PI_PROTOCOL, PI_ERROR, "CRC32 Error", EXPFILL }},
889 { &ei_invalid_data, { "adb.expert.data_error", PI_PROTOCOL, PI_ERROR, "Mismatch between message payload size and data length", EXPFILL }},
890 };
891
892 command_info = wmem_tree_new_autoreset(wmem_epan_scope(), wmem_file_scope());
893 service_info = wmem_tree_new_autoreset(wmem_epan_scope(), wmem_file_scope());
894
895 proto_adb = proto_register_protocol("Android Debug Bridge", "ADB", "adb");
896 adb_handle = register_dissector("adb", dissect_adb, proto_adb);
897
898 proto_register_field_array(proto_adb, hf, array_length(hf));
899 proto_register_subtree_array(ett, array_length(ett));
900 expert_module = expert_register_protocol(proto_adb);
901 expert_register_field_array(expert_module, ei, array_length(ei));
902
903 module = prefs_register_protocol(proto_adb, NULL);
904 prefs_register_static_text_preference(module, "version",
905 "ADB protocol version is compatible prior to: adb 1.0.31",
906 "Version of protocol supported by this dissector.");
907 }
908
909 void
proto_reg_handoff_adb(void)910 proto_reg_handoff_adb(void)
911 {
912 adb_service_handle = find_dissector_add_dependency("adb_service", proto_adb);
913
914 dissector_add_for_decode_as_with_preference("tcp.port", adb_handle);
915 dissector_add_for_decode_as("usb.device", adb_handle);
916 dissector_add_for_decode_as("usb.product", adb_handle);
917 dissector_add_for_decode_as("usb.protocol", adb_handle);
918
919 proto_tcp = proto_get_id_by_filter_name("tcp");
920 proto_usb = proto_get_id_by_filter_name("usb");
921 }
922
923 /*
924 * Editor modelines - https://www.wireshark.org/tools/modelines.html
925 *
926 * Local variables:
927 * c-basic-offset: 4
928 * tab-width: 8
929 * indent-tabs-mode: nil
930 * End:
931 *
932 * vi: set shiftwidth=4 tabstop=8 expandtab:
933 * :indentSize=4:tabSize=8:noTabs=true:
934 */
935