[RCTF2019]printer详解（python脚本、USB协议精解、TSLP2文档阅读）

一个非常好的网站，可以学习USB协议：

USB中文网

拿到文件发现是USB数据，第一反应用脚本提取：

aaaaaaaaccccaahdgeeefefdgeegegeegcccbaabfefghifeebbbddcfccdaadeeeeefijlmmpponkifcaaaechgiihhheecdcbabbabbbdefehhjlmkida

没什么数据，WP也看的不明不白，菜鸟决定小小的研究一番USB协议，不想看可以跳着看。

USB流量分析

首先我们要知道USB描述符，还要知道它的功能

1. 首先观察到No.1-No.463通信地址为6

   

   URB_INTERRUPT in，也就是中断数据流传输的IN传输，表示从USB设备读取数据：

   

   中断传输一般用于小批量的和非连续的数据传输，通俗的来说就是用于数据量小的数据不连续的但实时性高的场合的一种传输方式，主要应用于人机交互设备中的USB鼠标和USB键盘等。

   我们可以看到Wireshark捕获到USB设备向host传送的数据，我们看到数据部分只有8字节，说明传输模式是低速模式。

   

   根据USB键盘协议，8字节完全可以表示键盘上的全部符号，这里就是键盘流量；而鼠标流量是四个字节，这里网上的文章比较多。

2. 从No.464开始，USB设备的地址变为7，我们看到前三个数据包：

   

   • GET DESCRIPTOR表示主机在获取USB设备的特定描述符 ，特定描述符包括：

     

   • 那么这里就是在获取设备的配置描述符

3. No.467 - No.468

   

   • SET CONFIGURATION表示主机要设置设备的配置描述符

     
     

   • 也就是说主机获得设备工作状态后，这一步是对设备的模式设置。

4. 接下来再获取的是设备描述符和字符串描述符

   

   设备描述符内容：

   

   

   字符串描述符：因为对是数字的设备标识来说，USB开发人员很好记忆，但是对于使用USB设备的人来说很不友好，USB规范中定义了字符串描述符，即使用人类的自然语言来描述设备的功能，生产厂家，生产序列号等：

   

5. No.475 - No.476 是USB传输模式中的控制传输，这个模式主要应用于设备的枚举过程（如读取设备描述符，设置地址，设置配置等）和对数据准确性要求较高的场合

   

   具体内容：

   

   • MFG：可能是manufacture的缩写，考研背过哈哈：生产、产生

   • BARCODE：二维码

   • CMD

   • TSPL2：一套通用的标签打印指令

   • MDL：（百科）MDL是MicroStation的“应用引擎(Application Engine)”，MDL可以直接在MicroStation中运行并且表现为MicroStation本身的一部分。许多MicroStation的命令都可以在MDL中应用。

   • 3B-363B：必应直接搜到这个打印机型号驱动

     

   • CLS不知道是什么：

     

   • 确定了主机正在通过USB连接一台标签打印机，打印机采用TSPL2指令集，地址为7

6. 下面还是USB地址为6的通信数据

   • 一直在重复获取该设备的字符串标识符和一些信息：

     

     

   • 罗技的USB接收器

7. 中间是还是键盘的一系列数据

8. 接下来是打印机与主机的通信

   

   批量传输一般用于批量的和非实时的数据传输，通俗的来说就是用于数据量大但对时间要求又不高的场合的一种传输方式，类似用于USB打印机和USB扫描仪等等。

   • 

     设置了纸张大小：47.5mm * 80.1mm

     • GAP：槽深后面
     • direction 0,0：方向
     • reference：标记、编号
     • offest 0：偏移量
     • peel off：剥离
     • cutter off：裁刀离位
     • partial_cutter off：不懂。。

   • 

     下面的我给复制了出来，前面是打印设置，下面搜一下就是TSPL2，必应找到了TSPL2指令集的PDF：

     

文档阅读

1. 前面的配置看懂了，官方文档yyds！

   

   • GAP：两个标签之间的距离
   • direction 0,0：第一个0是打印方向这里是倒置的，第二个0说明打印镜像（具体参考文档）
   • reference：标签打印的顶点相对位置（具体参考文档）
   • offest ：额外的送纸长度
   • peel off：关掉自剥离
   • cutter off：关闭裁刀

2. 后面也看懂了：

   set tear on：标签打印会在撕脱位置停止

   BITMAP：

   

   举例：

   

   对应的物理存储格式：

   

   BAR
   

   

3. 把数据分离出来

   BITMAP 138,75,26,48 ,1

   • x,y : 138,75

   • width : 26Byte

   • height : 48dot

   • ffffffffffffffffffffffffffffffff00ffffffffffffffffffffffffffffffffffffffffffffffffffc3ffffffffffffffffffffffffffffffffffffffffffffffffffe7ffffffffffffffffffffffffffffffffffffffffffffffffffe7ffffffffffffffffffffffffffffffffffffffffffffffffffe7ffffffffffffffffffffffffffffffffffffffffffffffffffe7ffffffffffffffffffffffffffffffffffffffffffffffffffe7ffe3fffe1ffffffffff807c03c603fc07c07e0007f7ff01f8067ff007ff803fc07c03fff1ff1f04f8ff1ff1fff1fff3ffcff1f27fc7f1ff3e1ff1ff9ffff1ff1fc1fcff8ff1fff1fff3ffefe3f87f8ff9feff8ff1ff9ffff8ff1fc3fc7fcff1fff1fff1ffefc7fc7f9ff8fdffc7f1ff9ffff8ff1fc7fe3fc7f1fff1fff1ffefcffe7f1ff8f9ffc3f1ff9ffffc7f1fc7fe3fe3f1fff1fff0ffef8ffe7f1ff0fbffe3f1ff9ffffc7f1fc7fe3fe3f1fff1fff0ffef8ffe7e1ff8f3ffe3f1ff9ffffe3f1fc7fe3ff1f1fff1fff47fef8ffe7e3ff9f7ffe1f1ff9ffffe3f1fc7ff3ff8e1fff1fff47fef9ffe7e3ffffffff1f1ff9fffff1f1fc7ff3ff8c1fff1fff63fef9ffe7f1ffffffff1f1ff9fffff1f1fc7ff3ffc11fff1fff63fef9ffe7f1ffffffff1f1ff9fffff1f1fc7fe3ffe31fff1fff71fef9ffe7f1ffffffff1f1ff9fffff8f1fc7fe3ffe71fff1fff71fef8ffe7f8ffffffff0f1ff9fffff8f1fc7fe3ffcf1fff1fff78fef8ffe7fcffffffff0f1ff9fffffc61fc7fe7ff9f1fff1fff78fef8ffc7fe3fffffff0f1ff9fffffc41fc7fc7ff3f1fff1fff7c7efcffc7ff83ffffff0f9ff1fffffe11fc3f8fff7f1fff1fff7c7efc7fa7ff87ffffff0f9fe9fffffe31fc1f1ffe7f1fff1fff7e3efe3e67fe3fffffff1f8f99ffffff31fc403fe01f1fff1fff7e3eff80e0fc7fffffff1fc039fffffe71fc79ffffff1fff1fff7f1efff3eff8ffffffff1ff0f9fffffef1fc7fffffff1fff1fff7f0efffffff8ffffffff1ffff9fffffcf1fc7fffffff1fff1fff7f8efffffff8fffffffe1ffff9fffff9f1fc7fffffff1fff1fff7f86fffffff8ff9f7ffe3ffff9fffffbf1fc7fffffff1fff1fff7fc6fffffff8ff0f3ffe3ffff9fffff7f1fc7fffffff1fff1fff7fc2fffffff8ff8fbffc7ffff9ffffe7f1fc7fffffff1fff1fff7fe2fffffff8ff8f9ffc7ffff9ffffcff1fc7fffffff1fff1fff7ff0fffffffcff9f9ff8fffff9ffff8ff1fc7fffffff1fff1fff7ff0fffffffc7f9f8ff1fffff9ffff0ff0fc3fffffff1fff0ffe7ff8fffffffe1e7f83e3fffff8fffc03c03c0fffffff03e000780ff83fffffff80fff80ffffff83ffffffffdffffffff3ffffffffffffffffffffffffffffffffbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
     

   BITMAP 130,579,29,32,1:

   • x,y : 130,579

   • width : 29Byte

   • height : 32dot

   • ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc7fffffffffffffffffffffffffffffffffffffffffffffffffffffffe38fffffffffffffffffffffffffffffffffffffffffffffffffffffffdff7ffffffffffffffffffffffffffffffffffffffffffffffffffffff9ff3ffffffffffffffffffffffffffffffffffffffffffffffffffffff9ff3fffffffffffff9ffefbffc7ffffffe1fff8fffffffc3ffffffffff9ff3ff8ffffffffff0ffefbff39ff007f9c7fe72ffffff3c3fc07fffff87e78463f803ff01f0ffe7bfefefff7ff3f3f9f8fffffeff3ffbffffffc01fa3f9ffbfffe7f9ffe71fcfe7ff7ff7f9f9fcfffffeffbffbfffffffc07e7f9ffbfffe7ffffc71f9ff3ff7feff9f3fcfffffeffbffbffffffffe7e7f8ffbfffe7ffffd75f9ff3ff7ffffcf3fcfffffe7ffffbffffffffe7e7f9ffbfffe7ffffd35f9ff3ff7ffffcf3fcfffffe3ffffbfffffff80fe7f9ffbfffe7ffffd2cf9ff3ff7ffffcf3fcffffff07fffbfffffff7cfe7f3ffbfffe7ffffb2cf9ff3ff7fe000f3fcffffffc1fffbffffffe7e7e7c7ffbfffe7ffffbacf9ff3ff7fe7fcf3fcfffffff87ffbffffffe7e7e03fffbfffe7ffffb9ef9ff3ff7fe7fcf3fcfffffffe7ffbffffffefe7e7ffffbfffe7ffffb9e79ff3ff7fe7f9f3fcfffffeff3ffbffffffefe7e7f9ffbfffe7ffff79e7cfe7ff7ff3f9f9f8fffffeff3ffbffffffe7e7f7f1ffbfffe7f1ff79e7efcfff7ff3f3f9f0fffffe7f7ffbffffff27eff3f3ffbfffe7f0fe38e3f39fff7ffce7fc04fffffe1cfff9ffffff019ff9e7ffbfffe7f1fffffffc7fff7fff1fffbcfffffee3fff87fffffbe7ffe1fffbffe00ffffffffffffff7ffffffffcffffffffffffffffffffffffffffbfffe7ffffffffffffff7ffffffffcffffffffffffffffffffffffffffbfffe7ffffffffffffff7ffffffffcffffffffffffffffffffffffffffbfffe7ffffffffffffff7ffffffffcffffffffffffffffffffffffffffbfe7e7ffffffffffffff7ffffffffcfffffffffff3ffffffffffffffffbfe7efffffffffffffff7ffffffffcfffffffffff1ffffffffffffffffbfe7cfffffffffffffff03fffffffc3ffffffffff1ffffffffffffffff81f03fffffffffffffff3ffffffffcfffffffffffbffffffffffffffff9ffffff
     

   BAR：

   • 	BAR 348, 439, 2, 96
         BAR 292, 535, 56, 2
         BAR 300, 495, 48, 2
         BAR 260, 447, 2, 88
         BAR 204, 447, 56, 2
         BAR 176, 447, 2, 96
         BAR 116, 455, 2, 82
         BAR 120, 479, 56, 2
         BAR 44, 535, 48, 2
         BAR 92, 455, 2, 80
         BAR 20, 455, 72, 2
         BAR 21, 455, 2, 40
         BAR 21, 495, 24, 2
         BAR 45, 479, 2, 16
         BAR 36, 479, 16, 2
         BAR 284, 391, 40, 2
         BAR 324, 343, 2, 48
         BAR 324, 287, 2, 32
         BAR 276, 287, 48, 2
         BAR 52, 311, 48, 2
         BAR 284, 239, 48, 2
         BAR 308, 183, 2, 56
         BAR 148, 239, 48, 2
         BAR 196, 191, 2, 48
         BAR 148, 191, 48, 2
         BAR 68, 191, 48, 2
         BAR 76, 151, 40, 2
         BAR 76, 119, 2, 32
         BAR 76, 55, 2, 32
         BAR 76, 55, 48, 2
         BAR 112, 535, 64, 2
         BAR 320, 343, 16, 2
         BAR 320, 319, 16, 2
         BAR 336, 319, 2, 24
         BAR 56, 120, 24, 2
         BAR 56, 87, 24, 2
         BAR 56, 88, 2, 32
         BAR 224, 247, 32, 2
         BAR 256, 215, 2, 32
         BAR 224, 215, 32, 2
         BAR 224, 184, 2, 32
         BAR 224, 191, 32, 2
         BAR 272, 311, 2, 56
         BAR 216, 367, 56, 2
         BAR 216, 319, 2, 48
         BAR 240, 318, 2, 49
         BAR 184, 351, 2, 16
         BAR 168, 351, 16, 2
         BAR 168, 311, 2, 40
         BAR 152, 351, 16, 2
         BAR 152, 351, 2, 16
     

python脚本

可以写脚本了：

import numpy as np
from PIL import Image
import re

def STPL2_bitmap_draw(pixels,map,x,y,width,height):
    bits = ""
    for c in map1:
        bits += bin(int(c,16))[2:].zfill(4)
    for i in range(len(bits)):
        if bits[i]=='0':
            pixels[x+i%(width*8), y+i//(width*8)] = 0


def STPL2_barcode_draw(pixels,barcode):
    for line in barcode.strip().split('\n'):
        dt = list(map(int, re.findall('\d+',line)))
        for i in range(dt[2]):
            for j in range(dt[3]):
                pixels[dt[0]+i,dt[1]+j] = 0


if __name__ == "__main__":
    img = Image.new('1', (1000,1000), 255)  # mode=1 位图
    pixels = img.load() # 返回一个用于读取和修改像素的像素访问对象
    print(type(pixels[100,100]))

    map1 = "ffffffffffffffffffffffffffffffff00ffffffffffffffffffffffffffffffffffffffffffffffffffc3ffffffffffffffffffffffffffffffffffffffffffffffffffe7ffffffffffffffffffffffffffffffffffffffffffffffffffe7ffffffffffffffffffffffffffffffffffffffffffffffffffe7ffffffffffffffffffffffffffffffffffffffffffffffffffe7ffffffffffffffffffffffffffffffffffffffffffffffffffe7ffe3fffe1ffffffffff807c03c603fc07c07e0007f7ff01f8067ff007ff803fc07c03fff1ff1f04f8ff1ff1fff1fff3ffcff1f27fc7f1ff3e1ff1ff9ffff1ff1fc1fcff8ff1fff1fff3ffefe3f87f8ff9feff8ff1ff9ffff8ff1fc3fc7fcff1fff1fff1ffefc7fc7f9ff8fdffc7f1ff9ffff8ff1fc7fe3fc7f1fff1fff1ffefcffe7f1ff8f9ffc3f1ff9ffffc7f1fc7fe3fe3f1fff1fff0ffef8ffe7f1ff0fbffe3f1ff9ffffc7f1fc7fe3fe3f1fff1fff0ffef8ffe7e1ff8f3ffe3f1ff9ffffe3f1fc7fe3ff1f1fff1fff47fef8ffe7e3ff9f7ffe1f1ff9ffffe3f1fc7ff3ff8e1fff1fff47fef9ffe7e3ffffffff1f1ff9fffff1f1fc7ff3ff8c1fff1fff63fef9ffe7f1ffffffff1f1ff9fffff1f1fc7ff3ffc11fff1fff63fef9ffe7f1ffffffff1f1ff9fffff1f1fc7fe3ffe31fff1fff71fef9ffe7f1ffffffff1f1ff9fffff8f1fc7fe3ffe71fff1fff71fef8ffe7f8ffffffff0f1ff9fffff8f1fc7fe3ffcf1fff1fff78fef8ffe7fcffffffff0f1ff9fffffc61fc7fe7ff9f1fff1fff78fef8ffc7fe3fffffff0f1ff9fffffc41fc7fc7ff3f1fff1fff7c7efcffc7ff83ffffff0f9ff1fffffe11fc3f8fff7f1fff1fff7c7efc7fa7ff87ffffff0f9fe9fffffe31fc1f1ffe7f1fff1fff7e3efe3e67fe3fffffff1f8f99ffffff31fc403fe01f1fff1fff7e3eff80e0fc7fffffff1fc039fffffe71fc79ffffff1fff1fff7f1efff3eff8ffffffff1ff0f9fffffef1fc7fffffff1fff1fff7f0efffffff8ffffffff1ffff9fffffcf1fc7fffffff1fff1fff7f8efffffff8fffffffe1ffff9fffff9f1fc7fffffff1fff1fff7f86fffffff8ff9f7ffe3ffff9fffffbf1fc7fffffff1fff1fff7fc6fffffff8ff0f3ffe3ffff9fffff7f1fc7fffffff1fff1fff7fc2fffffff8ff8fbffc7ffff9ffffe7f1fc7fffffff1fff1fff7fe2fffffff8ff8f9ffc7ffff9ffffcff1fc7fffffff1fff1fff7ff0fffffffcff9f9ff8fffff9ffff8ff1fc7fffffff1fff1fff7ff0fffffffc7f9f8ff1fffff9ffff0ff0fc3fffffff1fff0ffe7ff8fffffffe1e7f83e3fffff8fffc03c03c0fffffff03e000780ff83fffffff80fff80ffffff83ffffffffdffffffff3ffffffffffffffffffffffffffffffffbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"
    map2 = "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc7fffffffffffffffffffffffffffffffffffffffffffffffffffffffe38fffffffffffffffffffffffffffffffffffffffffffffffffffffffdff7ffffffffffffffffffffffffffffffffffffffffffffffffffffff9ff3ffffffffffffffffffffffffffffffffffffffffffffffffffffff9ff3fffffffffffff9ffefbffc7ffffffe1fff8fffffffc3ffffffffff9ff3ff8ffffffffff0ffefbff39ff007f9c7fe72ffffff3c3fc07fffff87e78463f803ff01f0ffe7bfefefff7ff3f3f9f8fffffeff3ffbffffffc01fa3f9ffbfffe7f9ffe71fcfe7ff7ff7f9f9fcfffffeffbffbfffffffc07e7f9ffbfffe7ffffc71f9ff3ff7feff9f3fcfffffeffbffbffffffffe7e7f8ffbfffe7ffffd75f9ff3ff7ffffcf3fcfffffe7ffffbffffffffe7e7f9ffbfffe7ffffd35f9ff3ff7ffffcf3fcfffffe3ffffbfffffff80fe7f9ffbfffe7ffffd2cf9ff3ff7ffffcf3fcffffff07fffbfffffff7cfe7f3ffbfffe7ffffb2cf9ff3ff7fe000f3fcffffffc1fffbffffffe7e7e7c7ffbfffe7ffffbacf9ff3ff7fe7fcf3fcfffffff87ffbffffffe7e7e03fffbfffe7ffffb9ef9ff3ff7fe7fcf3fcfffffffe7ffbffffffefe7e7ffffbfffe7ffffb9e79ff3ff7fe7f9f3fcfffffeff3ffbffffffefe7e7f9ffbfffe7ffff79e7cfe7ff7ff3f9f9f8fffffeff3ffbffffffe7e7f7f1ffbfffe7f1ff79e7efcfff7ff3f3f9f0fffffe7f7ffbffffff27eff3f3ffbfffe7f0fe38e3f39fff7ffce7fc04fffffe1cfff9ffffff019ff9e7ffbfffe7f1fffffffc7fff7fff1fffbcfffffee3fff87fffffbe7ffe1fffbffe00ffffffffffffff7ffffffffcffffffffffffffffffffffffffffbfffe7ffffffffffffff7ffffffffcffffffffffffffffffffffffffffbfffe7ffffffffffffff7ffffffffcffffffffffffffffffffffffffffbfffe7ffffffffffffff7ffffffffcffffffffffffffffffffffffffffbfe7e7ffffffffffffff7ffffffffcfffffffffff3ffffffffffffffffbfe7efffffffffffffff7ffffffffcfffffffffff1ffffffffffffffffbfe7cfffffffffffffff03fffffffc3ffffffffff1ffffffffffffffff81f03fffffffffffffff3ffffffffcfffffffffffbffffffffffffffff9ffffff"
    
    barcode = """
    BAR 348, 439, 2, 96
    BAR 292, 535, 56, 2
    BAR 300, 495, 48, 2
    BAR 260, 447, 2, 88
    BAR 204, 447, 56, 2
    BAR 176, 447, 2, 96
    BAR 116, 455, 2, 82
    BAR 120, 479, 56, 2
    BAR 44, 535, 48, 2
    BAR 92, 455, 2, 80
    BAR 20, 455, 72, 2
    BAR 21, 455, 2, 40
    BAR 21, 495, 24, 2
    BAR 45, 479, 2, 16
    BAR 36, 479, 16, 2
    BAR 284, 391, 40, 2
    BAR 324, 343, 2, 48
    BAR 324, 287, 2, 32
    BAR 276, 287, 48, 2
    BAR 52, 311, 48, 2
    BAR 284, 239, 48, 2
    BAR 308, 183, 2, 56
    BAR 148, 239, 48, 2
    BAR 196, 191, 2, 48
    BAR 148, 191, 48, 2
    BAR 68, 191, 48, 2
    BAR 76, 151, 40, 2
    BAR 76, 119, 2, 32
    BAR 76, 55, 2, 32
    BAR 76, 55, 48, 2
    BAR 112, 535, 64, 2
    BAR 320, 343, 16, 2
    BAR 320, 319, 16, 2
    BAR 336, 319, 2, 24
    BAR 56, 120, 24, 2
    BAR 56, 87, 24, 2
    BAR 56, 88, 2, 32
    BAR 224, 247, 32, 2
    BAR 256, 215, 2, 32
    BAR 224, 215, 32, 2
    BAR 224, 184, 2, 32
    BAR 224, 191, 32, 2
    BAR 272, 311, 2, 56
    BAR 216, 367, 56, 2
    BAR 216, 319, 2, 48
    BAR 240, 318, 2, 49
    BAR 184, 351, 2, 16
    BAR 168, 351, 16, 2
    BAR 168, 311, 2, 40
    BAR 152, 351, 16, 2
    BAR 152, 351, 2, 16"""

    # 画map1,map2的图像
    STPL2_bitmap_draw(pixels,map1,138,75,26,48)
    STPL2_bitmap_draw(pixels,map2,130,579,29,32)

    # 画barcode
    STPL2_barcode_draw(pixels,barcode)

    img = img.transpose(Image.ROTATE_180)   # 上下颠倒图像
    img.save('flag.bmp')    # 保存图片

得到：

flag

flag{my_tsc_hc3pnikdk}