Aristo Chen
Aristo Chen is an embedded Linux engineer with a strong interest in low-level systems
programming and open-source development.
usb-proxy is a personal open-source project he built to deepen his understanding of the
Linux USB stack from the ground up. The project combines the Linux kernel's raw-gadget
driver, libusb, and a Lua scripting engine to create a transparent USB man-in-the-middle
proxy that runs on hardware such as a Raspberry Pi. It has gathered over 250
stars and 40 forks on GitHub.
Beyond usb-proxy, he actively contributes to upstream open-source projects in the
embedded Linux ecosystem, including U-Boot and the Linux kernel, with a focus on
bootloader enablement and hardware bringup.
議程
The USB protocol is everywhere: keyboards, webcams, storage devices, embedded hardware
test fixtures. Yet most developers treat it as a black box. What if you could sit
transparently between a USB host and device, observe every packet, and selectively
modify, drop, or inject traffic using nothing but open-source software running on a
Raspberry Pi?
This talk walks through the design and implementation of
usb-proxy, an open-source USB
man-in-the-middle proxy built on the Linux kernel's raw-gadget driver and libusb.
What is usb-proxy?
usb-proxy positions a Linux machine with a USB OTG port between a real USB device and
its host. The host sees a synthetic device reconstructed in real time via raw-gadget,
while the real device is accessed through libusb on the other side. All traffic flows
through the proxy, where it can be logged, modified, or dropped using JSON-based rules.
The Injection Rule Engine
injection.json defines per-endpoint rules for control, interrupt, and bulk transfers.
Each rule can modify, ignore, or stall a matched packet. Three levels of transform are
supported and can be combined within a single rule, in order of increasing flexibility:
- Pattern replacement: matches fixed hex byte sequences and substitutes them.
Ideal for simple, fixed substitutions such as swapping mouse button bytes. - Declarative operations: applies arithmetic transforms in order on byte offsets,
such as negating a movement axis or scaling cursor speed, without any scripting. - Lua scripting: for logic that cannot be expressed declaratively, a rule can point
to a Lua script. Each script maintains its own state across packets, enabling
conditionals, loops, and stateful transforms like dead zones or speed caps.
What Will Be Coverd
- How the Linux USB stack is layered: UDC driver, gadget framework, and userspace
- How
raw-gadgetandlibusbwork together to build a transparent C++ proxy - The injection rule engine in action with a live demo
Talk Outline
| Section | Time |
|---|---|
| USB protocol and motivation | 5 min |
| raw-gadget + libusb architecture deep-dive | 10 min |
| Injection rule engine: live demo on how to modify and inject USB packets | 10 min |
| QA | 5 min |
Source: https://github.com/AristoChen/usb-proxy (Apache-2.0 license)