Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: [Wireshark-users] How to re-assemble contents of a USB upload?

From: Svenn Are Bjerkem <svenn.bjerkem@xxxxxxxxxxxxxx>
Date: Sun, 19 Jun 2011 22:23:26 +0200
Hi,
I have recorded a session between a USB gadget using the ez-usb chip
and a winxp program running in a VirtualBox session. The purpose of
the recording is to extract the firmware which the winxp USB driver
uploads to the ez-usb chip after initial enumeration.

>From within wireshark I can follow the process step-by-step and find
the firmware being uploaded separated accross a series of USB URB out
packages. The firmware part is flagged as extra USB data from address
0x40 of each transaction from host to gadget. I could do the
extraction manually by selecting data manually and copying over to a
new file, but this is kind of error prone, and a way to reconstruct
the uploads by the means of a script is what I am looking for.

I have dumped the recording as a text file, and find that serious
parsing is needed to extract only the firmware data as the dump also
contains other decoded information relevant for the USB session, but
not for the firmware itself.

I understand that wireshark and its commandline tools have features
which can help me most of the way, maybe all the way, but it is a
complex matter to find the right use of a program from its man file,
and I thought maybe somebody on this list had already done something
like this or close to this and would be kind enough to help me out
with the right options for the right programs.

Kind regards,
-- 
Svenn