Emulating a HID Device

I've been hacking around with some Atmel microcontrollers and I thought I've give this project a try. Due to circumstances out of my control, taking a pedometer to work is not possible as it is not permitted on site. However, this pedometer is directly related to a health fund that gets money from my employer based on how active you are. I've already done something like this:

Yes, it get the job done, but at the expense of time... So, now I am going one step further. Using either a Pro Trinket or Teensy (images below), I was planning on faking things out. Instead of plugging this into my computer

I'll plug this in! :)

The next step was to setup setup the boards to emulate the USB HID device. For the Pro Trinket, I used VUSB and for the Teensy, I used LUFA. The VUSB API was a bit more involved and took a bit longer to get working as documentation seems sparse from my searches. Using Dean's LUFA library, it was very easy to setup and get configured. Since the Pro Trinket uses a slightly less sophisticated microprocessor (ATmega 328p), there is no USB support in that chip. However, Teensy's chip is the ATmega 32U4 which does have USB support and can use the LUFA stack. Either way, I thought I'd give both a shot.

After getting both configured, if I run the 3rd party software provided by Virgin Healthmiles, it now thinks I've plugged in the "real" pedometer. First step done! Drink a few beers and celebrate!

The next step is where I am currently stuck... Decoding their USB protocol. I have uploaded data many times using the real pedometer and captured the USB communication. Here is some sample data.

I've tried sending back the data I captured (using wireshark), but no dice. So they have some smarts built in, but I can't pinpoint it just yet. To complicate things more, the 3rd party software only supports Windows and Mac. Mac has good tools, but nothing to capture USB! I've tried to setup a VM on my linux box, but wine does not support all win32 API's the 3rd party software is calling. So I am writing the code on linux, uploading with avrdude and testing on Windows. Fun times.... Perhaps I should bit the bullet and install the development environment on windows. talk about humbug!

So.... my question for some of you readers out there. What are some common techniques used for this? What are things I can try to decode the data? My serial number seems to be encoded in the data, but I have yet to figure it out as things are either encrypted or on the bit fields and not at the byte boundaries. Any one have advice/suggestions as I'm all ears! Even better.... anyone want to join me with this project?!

avr-gcc adafruit trinket example

I've been interested in learning more about programming microcontrollers and saw that Adafruit has a low cost board (called trinket) that is very convenient since it can be programmed over USB. When I first got my hands on this, I was making sketches for it using the Arduino IDE, but wanted to dive in at a lower level and be able to write C code and reprogram the Attiny85 chip that is on board. There are many different ways to do this, but here is the way I went about doing it.

Install the following packages

sudo apt-get update
sudo apt-get install gcc-avr gdb-avr binutils-avr avr-libc avrdude

You should now have an environment that you can compile and link code for Atmel microprocessors. The last package (avrdude) is what we will use to program the chip. Here is an example of how to blink the LED on pin 1 of the trinket (the red LED).

// blink.c
#include <avr/io.h>
#include <util/delay.h>

// prototype
void wait_sec(int seconds);

int main (void)
{
   // direction register
   DDRB |= 0x03; // pin 0 and pin1 as output
   while(1)
   {
      PORTB |= 0x02; // LED ON
      wait_sec(1); // sleep
      PORTB &= 0x01; // LED OFF
      wait_sec(1); // sleep
   }
   return 0;
}

// sleeps the specified amount of seconds
void wait_sec(int seconds)
{
   int i;
   for(i=0; i<seconds; i++)
      _delay_ms(1000);
}

You can compile the code with avr-gcc. At the time of writing this post, I'm using avr-gcc version 4.7.2. For this contrived example, I will not create a makefile, but it's usually good practice to do so.

avr-gcc -I. -I. -g -mmcu=attiny85 -DF_CPU=8000000UL -Os -fpack-struct -fshort-enums -funsigned-bitfields -funsigned-char -Wall -Wstrict-prototypes -Wa,-ahlms=blink.lst -c blink.c -o blink.o
avr-gcc -Wl,-Map,myproject.out.map -mmcu=attiny85 -lm  -o myproject.out blink.o 
avr-objcopy -j .text                    \
  -j .data                       \
  -O ihex myproject.out myproject.hex
avr-objcopy -j .eeprom                  \
  --change-section-lma .eeprom=0 \
  -O ihex myproject.out myproject.ee.hex
avr-objcopy: --change-section-lma .eeprom=0x0000000000000000 never used

If things went smoothly, you should now have a file called myproject.hex. This is the binary we will program the chip with using avrdude. To program the trinket, press the reset button so the red LED blinks which signifies it's in bootloader mode. Execute the following to upload and program the chip.

sudo avrdude -c usbtiny -p attiny85 -U flash:w:myproject.hex

avrdude: AVR device initialized and ready to accept instructions

Reading | ################################################## | 100% 0.00s

avrdude: Device signature = 0x1e930b
avrdude: reading input file "myproject.hex"
avrdude: input file myproject.hex auto detected as Intel Hex
avrdude: writing flash (116 bytes):

Writing | ############################                       | 55% 0.03savrdude: 6 retries during SPI command
Writing | ################################################## | 100% 0.07s



avrdude: 116 bytes of flash written
avrdude: verifying flash memory against myproject.hex:
avrdude: load data flash data from input file myproject.hex:
avrdude: input file myproject.hex auto detected as Intel Hex
avrdude: input file myproject.hex contains 116 bytes
avrdude: reading on-chip flash data:

Reading | ################################################## | 100% 0.01s



avrdude: verifying ...
avrdude: 116 bytes of flash verified

avrdude: safemode: Fuses OK

avrdude done.  Thank you.

Once the chip is programmed, you should see the blink code running.