Sniff USB traffic on a mac? - macos

Is there a way to sniff the USB port on a Mac? I've looked at libusb and #usblib but I can't find anything that works on the Mac.

I found a way, you'll need Wireshark's nightly build (I am using V2.5.0rc0). After you install it, you'll need to bring up the USB "interface":
sudo ifconfig XHC20 up
And after that you can use wireshark to sniff all the traffic in the XHC20 interface. When you finish, remember to turn the interface down:
sudo ifconfig XHC20 down
Source: aud-ios.

Beware when installing IOUSBFamily log. It has not been updated in a few years. The OS X versions must match or else all usb devices including builtin touchpad/keyboard could not work. If that does happen you must reload the proper kext manually from recovery:
https://discussions.apple.com/message/20152486#20152486
Here is the steps to reload from recovery:
I had the same issue after installing USB Prober from a wrong OS version on my machine. It installed without any warnings but it turned out that this includes IOSUSBFamily.kext kernel module that's not going to work on my machine and this disabled all the USB devices (which includes laptop's own keyboard and trackpad).
Here's how I fixed it, but please be extremely careful not to break your machine:
1) Hold CTRL+R and turn on your machine, this will boot into the "Recovery mode"
2) Open Terminal
3) Find out where is your original IOUSBFamily kernel extension and the one on the Macintosh HD are. Mine were here:
Original: /System/Library/Extensions/IOUSBFamily.kext
New one (broken): /Volumes/Macintosh\ HD/System/Library/Extensions/IOUSBFamily.kext
4) Move the broken module away:
$ mkdir /Volumes/Macintosh\ HD/Users/recovery-backup
$ mv /Volumes/Macintosh\ HD/System/Library/Extensions/IOUSBFamily.kext /Volumes/Macintosh\ HD/Users/recovery-backup
5) Copy back the original:
$ cp -a /System/Library/Extensions/IOUSBFamily.kext /Volumes/Macintosh\ HD/System/Library/Extensions/IOUSBFamily.kext
Reboot and it should be fixed.

You can use IOUSBFamily log. If you are on OSX 10.8.2, you'd probably want to try USB Prober included in Hardware IO Tools for Xcode, February 2012 (Apple Developer account required for both links), since the latest version of IOUSBFamily is for OSX 10.9.4.
Even now (in 2018) there are no newer releases than for 10.9.4, and they don't work in newer macOS releases.

Related

sshfs hangs terminal on brand new Mac M1

Brand new Mac (OS 12.0.1, M1 chipset) sshfs and Fuse installed from https://osxfuse.github.io. I do:
sudo sshfs -d mayacc#myhost.com:/home/myacc ~/mnt
The terminal hangs, can't ^C the process.
It works fine on my Intel Mac.
Any ideas what I've done wrong?
The hang is because the user mode component of SSHfs (the one the driver in the kernel calls out) hangs, and because the driver is blocked your process is stuck in an uninterruptible state (wherein it won't respond to signals, which your ^C is (SIGINT)).
It's not necessarily an Intel vs. M1 issue. It might be as simple as a connectivity issue between your M1 and (your)host.com. (there's very little info in your question to deduce what the problem is, but I'd suggest check the full stack, from basic ping, through TCP 22, through ssh keys in your ~/.ssh folder)

macOS Catalina kernel debug

Anyone did Catalina kernel debug? I tried to copy the development edition of kernel from KDK folder(Catalina 536) to /System/Library/Kernels in the VMWare fusion target VM (Catalina beta8) according their readme file, anyhow that folder is readonly, you cannot copy any file there,
anyone has the solution?
One possible way is that reboot into recovery mode, but with VMWare fusion VM, it seems both latest version (Beta 8) and one vmx download from internet are not working, I tried both Cmd-R and 'reboot recovery' with nram settings.
Remoutning the root file system using
$ mount -u -w /
Worked for me to be able to copy the new kernel over. However my laptop is still slowly booting the debug kernel so I have not been able to verify end to end kernel debugging yet.

/dev/kvm not found on mac

So I've been working with android studio 2.0 beta on my Mac and AVD was working fine.
But then I notice that android studio can't launch AVD now. It says /dev/kvm not found. enable VT-x in your bios security settings, ensure that your linux distro has working kvm module.
The thing is: I didn't touch bios settings at all. Possible causes :
VMWare - I was playing with virtual machines and configuring new networks for vm's just before I noticed the error.
CleanMyMac - I also used this app to clean the system
other causes are possible, but I never entered BIOS or touched system settings
The solutions on resolving this issue I found all refer to Linux, rather than Mac. How would I fix this?
EDIT:
I reinstalled OS X (without formatting hard drive). That didn't work.
Here is the solution that worked me.
Well, Android Studio need HAXM to run emulator.
The issue is that the HAXM drivers doesn’t support the beta version of Mac Os High Serria yet.
The driver works but with a little bit of additional command.
First, you will need to disable the Security Protection on kext. The drivers is not sign for this version.
From https://apple.stackexchange.com/a/269777:
Get into Recovery Mode by restarting and holding down ⌘+R until Apple logo appears.
In the top menu click Utilities > Terminal.
In the Terminal window type and press Enter:
csrutil enable --without kext
Then restart the Mac.
Then you can install HAXM from:
Download the driver from here https://software.intel.com/en-us/android/articles/intel-hardware-accelerated-execution-manager/ and unzip it.
Open a terminal and go to the directory of the driver :
cd Downloads/haxm-macosx_v6_2_0
# edit the file and look for 10.12
nano silent_install.sh
CTRL + W
10.12
Add 10.13 after 10.12, and save the file ( CTRL+X, Y, ENTER)
Run it:
./silent_install.sh
To be sure it works:
sudo kextload -bundle-id com.intel.kext.intelhaxm
Now your emulator should work !
Just remove the previous HAXM and install IntelHAXM_6.0.3.dmg in haxm-macosx_v6_0_3.zip
here is download link haxm-macosx_v6_0_3.zip
its work for me!
/dev/kvm not found on mac.
Follow the steps. You can solve your problem.
Step1: Download Intel HAXM from software.intel.com.
Step2: Extract and Open the file name like “IntelHAXM_6.2.1.dmg”.
Step3: Double click on “IntelHAXM_6.2.1.mpkg” to Install manually.
Step4: Read and Install carefully.
Step5: When you receive Security warning for new extension goto system preferences and Click “Allow” button.
Step6: That’s it. Now you can run the emulator.
(Note : Incase you get same error again. Please Re-Install the
“IntelHAXM_6.2.1.mpkg” Once again. That’s really fix your problem.)
Happy coding... :-)
Enter your VM settings and then search for virtualization engine :
Check the virtualize Intel VT-x/EPT or AMD-RVI option.
This should resolve the problem.
Your MacOS need to enable Intel VT-x
Reference:
enable Intel VT-x

Mac OS X 10.10 disable USB ports

Can anyone tell me how to disable all usb-ports on OSX 10.10 (Yosemite)?
We've got a large number of iMacs setup, where we don't want the user to be able to control/use USB ports.
In previous OSX versions, the command was
cd /System/Library/Extensions
mv IOUSBMassStorageClass.kext/ IOUSBMassStorageClass.kext.bup
But this no longer works under Yosemite?
Eventually found a solution, i now use
cd /System/Library/Extensions/
sudo kextunload IOUSBMassStorageClass.kext
and after that all usbs are disabled.

Invoke Mac Kernel Panic?

So i am lookin for some source code to crash the mac kernel. I found crashme for debain linux but that does not work for the mac kernel. So i was wondering if anyone knows where i can find a command-line utility or some source code to invoke the mac kernel panic? This would be a huge help, thanks.
Apple has a tech note about how to do this.
The short way to do it is with this command, sudo dtrace -w -n "BEGIN{ panic();}", run from the terminal.
Update 2020: As noted by Wei Shen in the comments, you'll need to disable SIP to make this work in modern versons of macOS.
I recently updated crashme to work on Mac OS X Lion. You will need to download the source code from http://crashme.codeplex.com/ and compile it using Xcode command line tools. More details are in a answer to question 5085136. But note that crashme hasn't found any immediate kernel panics on the Mac yet. However, after running crashme on the native MacBook Pro, and running it in VirtualBox VM's on the same machine, one in an x86 PC-BSD and another in an x64 Centos, my Lion Kernel became unhappy enough that it threw a kernel panic a few minutes later as I was editing a file using the native Emacs. So crashme may have stumbled upon a kernel bug.
Go in terminal and type "killall kernel_task" it should force the computer into a panic without downloading any software. Just make sure you have everything saved before you try :D
although this requires a password it works every time
sudo halt

Resources