Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
A small library for firmware updates over USB with devices that support the DFU and DfuSe protocols. Specifically, pyfu-usb
supports listing DFU capable devices and downloading binary files to them.
dfu-util
dfu-util
is the popular host side tool for interacting with DFU/DfuSe devices. pyfu-usb
has only a small sliver the functionality contained in dfu-util
: Listing and downloading binary files. The reason you would use pyfu-usb
over dfu-util
is if you have a Python project that needs firmware update capabilities and don't want an external (non-Python) dependency.
pydfu.py
pydfu.py
is a tool in the OpenMV project that solves the exact problem described above, but it is only for DfuSe devices (e.g. STM32) and also hard codes a number of parameters including device address and max transfer size. It also appears to only work with .dfu
files, which require an extra conversion step. Since binary files can be directly generated by many embedded toolchains using them is simpler, although less portable.
The code in this package originates from pydfu.py
and the OpenMV license agreement has been copied into the repository. Along with refactoring the code and adding support for "classic" DFU devices, several modernizations were added:
rich
logging
instead of print
for output messagesblack
and linting with pylint
Even though this package may appear pure Python, by relying on pyusb
we rely on libusb
being installed. See the pyusb
docs for more details on platform support.
Install with pip
:
pip install pyfu-usb
List connected DFU devices:
pyfu-usb --list
Download a file to a DfuSe capable device, specifying a start address in hex:
pyfu-usb --download <filename> -a <start_address>
Download a file to a DFU capable device:
pyfu-usb --download <filename>
Use the --device
argument to specify the vid:pid
of the device in hex if multiple are connected. See the examples directory for more detailed examples.
The Makefile
contains workflow helpers for the development environment.
To setup the virtual environment:
make setup
To activate the virtual environment:
source .venv/bin/activate
To run pre-commit hooks (style, linting):
make pre_commit
To run unit tests:
make test
To build the wheel:
make wheel
To view code coverage metrics:
make coverage
To delete generated files:
make clean
Please see the documentation prior to contributing.
Licensed under the MIT license.
FAQs
Python USB firmware update library.
We found that pyfu-usb demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.