Linux File-Stor Gadget USB Device driver free download for windows — System — System Product Name

My goal is to convincingly emulate a well known brand of USB Flash Disk, using Raspberry Pi Zero (with or without Wifi).
For the sake of this example, I want to emulate a 4GB Sandisk Cruzer Edge, but generally speaking I want the ability to have full control of idVendor, idProduct, iProduct, iManufacturer, iSerial (and any other subtle variables of a USB flash disk)

I only want USB Mass Storage, not a composite device (with HID, or ethernet or serial or anything else)

My target USB Host devices range from: Linux AMD64, Linux MIPS, Linux ARM, Windows x86
I’ve activated dwc2, partitioned and formatted the file that is to be used as the storage & filesystem and loaded g_mass_storage. It is working fine from the perspective that it successfully mounts the Storage on all targets — I can connect and see the contents, add/delete files, eject and reconnect, seeing changes fine.

I use this to launch the USB Mass Storage gadget:

sudo modprobe g_mass_storage file=/home/pi/piusb_fat32.bin nofua=1 luns=1 ro=0 stall=0 removable=1 cdrom=0 idVendor=0x0781 idProduct=0x556e bcdDevice=0x0103 iManufacturer="SanDisk" iProduct="Cruzer Edge" iSerialNumber="990431108215FFF05368"

The problem is that the name of the device remains as Linux File-Stor Gadget. Under Linux & Windows respectively:

• Linux File-Stor Gadget 0414
• USBSTORDISK&VEN_LINUX&PROD_FILE-STOR_GADGET&REV_0414

When the pi is connected to Windows 10 1903 x86 laptop, I see two devices appear:

Get-WmiObject Win32_USBControllerDevice -ComputerName localhost -Impersonation Impersonate -Authentication PacketPrivacy | Foreach-Object { [Wmi]$_.Dependent } | Sort-Object PNPClass | ft Name, PNPClass, PNPDeviceID

Name                                  PNPClass      PNPDeviceID                                                                 
----                                  --------      -----------                                                                                         
Linux File-Stor Gadget USB Device     DiskDrive     USBSTORDISK&VEN_LINUX&PROD_FILE-STOR_GADGET&REV_0414990431108215FFF05368&0                
USB Mass Storage Device               USB           USBVID_0781&PID_556E990431108215FFF05368

Whereas with the real Sandisk USB Flash Disk:

Name                                  PNPClass      PNPDeviceID                                                              
----                                  --------      -----------                                                              
SanDisk Cruzer Edge USB Device        DiskDrive     USBSTORDISK&VEN_SANDISK&PROD_CRUZER_EDGE&REV_1.20200431108215FFF05367&0
USB Mass Storage Device               USB           USBVID_0781&PID_556B200431108215FFF05367                               

The «USB Mass Storage Device» has the correct VID, PID, SerialNumber, but the DiskDrive device does not.
Linux targets see the same two devices (see below for lsusb & dmesg examples)

From the source, It looks to me like the vendor=”Linux” and model=“File-Stor Gadget” is being set in the function fsg_common_set_inquiry_string in f_mass_storage.c
https://github.com/raspberrypi/linux/blob/rpi-4.19.y/drivers/usb/gadget/function/f_mass_storage.c

• I would like to know the best way to override that behaviour
  (preferably without having to recompile f_mass_storage module every
  time!)?
• Is there a way that the gadget could pass through iManufacturer,
  iProduct parameters to use as Vendor and Model?

The steps I used to create the Raspbian environment are:
Clean flash Rasbian onto SD card using Balena Etch

sudo su
echo "dtoverlay=dwc2" | sudo tee -a /boot/config.txt
echo "dwc2" | sudo tee -a /etc/modules  
echo "g_mass_storage" | sudo tee -a /etc/modules
sudo dd if=/dev/zero of=/home/pi/piusb_fat32.bin bs=1 count=0 seek=128M
sudo mkdosfs /home/pi/piusb_fat32.bin -n FAT32VOL11
reboot now

I have tried:

• On Windows, deleting the cached reg key for the device: HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlusbflagskeyname
  Where keyname is the concatenation of VID PID BCD_RELEASE_NUMBER
• Changing the serial number of the device each time I create the gadget, so eliminate caching as the cause.
• Reformatting the USB disk from Windows, as Fat32, with a different volume name (rather than using mkdosfs)
• Multiple versions of raspbian
  • 2021-09-26-raspbian-buster-lite (with & without running apt full-upgrade)
  • 2021-06-27-raspbian-stretch-lite (with & without running apt full-upgrade)
  • 2021-04-08-raspbian-stretch-lite (with & without running apt full-upgrade)

I’m certainly no USB or Linux expert, so this is what I have tried to piece together about how the Raspberry Pi USB ‘gadget’ Storage stack works. There are Five things of relevance:

• dwc2 module (does the OTG host/gadget flip dictated by OTG_SENSE)
• usb_f_mass_storage.ko module (Mass Storage Functions, handles the SCSI stuff to interface between USB & the file that acts as the storage for our USB disk)
• g_mass_storage.ko module (The Mass Storage Gadget)
• the file on the Pi that acts as the storage. this holds the filesystem and data that is read/writen to the emulated USB storage.
• The parameters that we pass to g_mass_storage module when loading it via modprobe

There is a very similar post here, but it hasn’t been active for more than 2 years now, and it didn’t solve my issue, so I’m re-posting here with more info:

And someone else had the same problem, unresolved from 2021:

—-On a Kali x86 Laptop: ———-

dmesg (output snipped to show relevant stuff)
[66925.017786] usb 1-4.3: New USB device found, idVendor=0781, idProduct=556e
[66925.017794] usb 1-4.3: New USB device strings: Mfr=3, Product=4, SerialNumber=5
[66925.017799] usb 1-4.3: Product: Cruzer Edge
[66925.017804] usb 1-4.3: Manufacturer: SanDisk
[66925.017808] usb 1-4.3: SerialNumber: 990431108215FFF05368
[66925.019129] usb-storage 1-4.3:1.0: USB Mass Storage device detected
[66925.019542] scsi host3: usb-storage 1-4.3:1.0
[66926.021250] scsi 3:0:0:0: Direct-Access     Linux    File-Stor Gadget 0414 PQ: 0 ANSI: 2
[66926.022471] sd 3:0:0:0: Attached scsi generic sg1 type 0
[66926.023505] sd 3:0:0:0: [sdb] 262144 512-byte logical blocks: (134 MB/128 MiB)
[66926.023729] sd 3:0:0:0: [sdb] Write Protect is off
[66926.023736] sd 3:0:0:0: [sdb] Mode Sense: 0f 00 00 00
[66926.023932] sd 3:0:0:0: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[66926.034208]  sdb:
[66926.035170] sd 3:0:0:0: [sdb] Attached SCSI removable disk

——lsusb of RPi from kali —

root@kali:~# lsusb -d 0781:556e -v

Bus 001 Device 031: ID 0781:556e SanDisk Corp.
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0        64
  idVendor           0x0781 SanDisk Corp.
  idProduct          0x556e
  bcdDevice            1.03
  iManufacturer           3 SanDisk
  iProduct                4 Cruzer Edge
  iSerial                 5 990431108215FFF05368
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           32
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0
    bmAttributes         0xc0
      Self Powered
    MaxPower                2mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk-Only
      iInterface              1 Mass Storage
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               1
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0000
  (Bus Powered)

——- Kali’s view of the USB Device from /sys/bus/usb —-

root@kali:~# cat /sys/bus/usb/devices/1-4.2/* 
cat: /sys/bus/usb/devices/1-4.2/ep_00: Is a directory
556e
0781
no
SanDisk
0
cat: /sys/bus/usb/devices/1-4.2/port: Is a directory
cat: /sys/bus/usb/devices/1-4.2/power: Is a directory
Cruzer Edge
0x0
unknown
cat: /sys/bus/usb/devices/1-4.2/remove: Permission denied
990431108215FFF05368
480
cat: /sys/bus/usb/devices/1-4.2/subsystem: Is a directory
MAJOR=189
MINOR=29
DEVNAME=bus/usb/001/030
DEVTYPE=usb_device
DRIVER=usb
PRODUCT=781/556e/103
TYPE=0/0/0
BUSNUM=001
DEVNUM=030
426
 2.00

———-How Kali see’s the RPi SCSI vendor & model strings ———

root@kali:~# cat /sys/bus/scsi/devices/target3:0:0/3:0:0:0/vendor
Linux
root@kali:~# cat /sys/bus/scsi/devices/target3:0:0/3:0:0:0/model
File-Stor Gadget

——— dmesg from Pi Zero after connecting to Windows ——————

[  409.446304] dwc2 20980000.usb: new device is high-speed
[  409.479146] dwc2 20980000.usb: new address 9
[  439.684939] dwc2 20980000.usb: new device is high-speed
[  439.717958] dwc2 20980000.usb: new address 10
[  439.748612] g_mass_storage gadget: high-speed config #1: Linux File-Backed Storage

Based on feedback from @Ephemeral (many thanks…). I have now tested using libcomposite and conclude it is the best answer.

The problem boils down to inquiry_string being unchangeable with g_mass_storage (unless you want to re-compile the module yourself with a different inquiry_string), but libcomposite gives full control of it, and many other parameters of the usb device.

One downside of libcomposite is that its not a one-liner to instantiate the gadget, it requires a bit more work.
But after the gadget is created, the inquiry_string can be changed on the fly, which is quite cool!
echo ‘ABCDEFGH123456789ABCDEFGWXYZ’ >> /sys/kernel/config/usb_gadget/gadget1/functions/mass_storage.usb0/lun.0/inquiry_string

inquirystring is tokenized by the host OS into: vendor(len 8) model(len 16) rev(len 4) which is what we see in Windows in PNPDeviceID as VEN_ PROD_ REV_

Name                                  PNPClass      PNPDeviceID                                                              
----                                  --------      -----------                                                              
SanDisk Cruzer Edge USB Device        DiskDrive     USBSTORDISK&VEN_SANDISK&PROD_CRUZER_EDGE&REV_1.20200431108215FFF05367&0

and in OpenWRT Linux as vendor, model, rev in:

/sys/class/block/sda/device/vendor
/sys/class/block/sda/device/model
/sys/class/block/sda/device/rev

or x86 Kali Linux as vendor, model, rev in:

/sys/bus/scsi/devices/target3:0:0/3:0:0:0/vendor
/sys/bus/scsi/devices/target3:0:0/3:0:0:0/model
/sys/bus/scsi/devices/target3:0:0/3:0:0:0/rev

I found this article quite useful to get a better understanding of the architecture of USB composite devices:
https://lwn.net/Articles/395712/

This is the full script I use now:

#!/bin/bash
# libcomposite USB mass storage device gadget for raspberry pi zero
# Call this script on Pi Zero startup by adding its full path to /etc/rc.local
# Assumes you have created the backing file for the storage device with something like this:
#  sudo dd if=/dev/zero of=/home/pi/piusb_fat32.bin bs=1 count=0 seek=128M
#  sudo mkdosfs /home/pi/piusb_fat32.bin -n FAT32VOL11

# And done these two steps once:
#  sudo echo "dtoverlay=dwc2" | sudo tee -a /boot/config.txt
#  sudo echo "dwc2" | sudo tee -a /etc/modules  

# Do some simple logging so we know the script is launching at startup
date | tee -a /home/pi/startup_script.log
echo Starting startup_script | tee -a /home/pi/startup_script.log

#Load the kernel module
modprobe libcomposite

#Gadget name (gadget1 is just an arbitrary name)
mkdir /sys/kernel/config/usb_gadget/gadget1
cd /sys/kernel/config/usb_gadget/gadget1

#hardware id
echo 0x0419 > bcdDevice
echo 0x0200 > bcdUSB
echo 0x0781 > idVendor # Sandisk
echo 0x556e > idProduct # Cruzer Edge

#device config
echo 0xEF > bDeviceClass
echo 0x02 > bDeviceSubClass
echo 0x01 > bDeviceProtocol
echo 0x08 > bMaxPacketSize0

#More stuff
mkdir strings/0x409
mkdir strings/0x407
cd strings/0x409
echo 'Sandisk' > manufacturer
echo 'Cruzer Edge' > product
echo 'Serial123456789' > serialnumber
cd ../../
cd strings/0x407
echo 'Sandisk' > manufacturer
echo 'Cruzer Edge' > product
echo 'Serial123456789' > serialnumber

cd ../../

mkdir functions/mass_storage.usb0

#Mass Storage 0 config settings
cd functions/mass_storage.usb0
echo 0 > stall
echo 1 > lun.0/removable
echo 0 > lun.0/ro
echo /home/pi/piusb_fat32.bin > lun.0/file
#Note, the next line is important. Host OS will tokenize it as: vendor(len 8)   model(len 16)   rev(len 4)
#Example here: vendor = ABCDEFGH  model = 123456789ABCDEFG  rev = WXYZ
echo 'ABCDEFGH123456789ABCDEFGWXYZ' > lun.0/inquiry_string
cd ../../

#OS Descriptor for Windows
cd os_desc
echo 1 > use
echo 0xcd > b_vendor_code
echo MSFT100 > qw_sign
cd ../

#Bus Hardware Config
mkdir configs/c.1
cd configs/c.1
echo 0x80 > bmAttributes
echo 100 > MaxPower
mkdir strings/0x409
echo "0" > strings/0x409/configuration
mkdir strings/0x407
echo "1" > strings/0x407/configuration
cd ../../
ln -s functions/mass_storage.usb0 configs/c.1
ln -s configs/c.1 os_desc

#Activate the gadget
ls /sys/class/udc > UDC

This is what it generates in dmesg on Kali x86:

[  279.856039] usb 1-4.4: new high-speed USB device number 8 using xhci_hcd
[  279.957788] usb 1-4.4: New USB device found, idVendor=0781, idProduct=556e
[  279.957796] usb 1-4.4: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  279.957801] usb 1-4.4: Product: Cruzer Edge
[  279.957805] usb 1-4.4: Manufacturer: Sandisk
[  279.957809] usb 1-4.4: SerialNumber: Serial123456789
[  279.978012] usb-storage 1-4.4:1.0: USB Mass Storage device detected
[  279.978128] scsi host3: usb-storage 1-4.4:1.0
[  279.978232] usbcore: registered new interface driver usb-storage
[  279.979998] usbcore: registered new interface driver uas
[  280.989354] scsi 3:0:0:0: Direct-Access     ABCDEFGH 123456789ABCDEFG WXYZ PQ: 0 ANSI: 2
[  280.990460] sd 3:0:0:0: Attached scsi generic sg1 type 0
[  280.990906] sd 3:0:0:0: [sdb] 262144 512-byte logical blocks: (134 MB/128 MiB)
[  280.991089] sd 3:0:0:0: [sdb] Write Protect is off
[  280.991095] sd 3:0:0:0: [sdb] Mode Sense: 0f 00 00 00
[  280.991271] sd 3:0:0:0: [sdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
[  280.999942]  sdb: sdb1
[  281.001878] sd 3:0:0:0: [sdb] Attached SCSI removable disk

And lsusb -vv on kali x86:

root@kali:~# lsusb -vv -d 0781:556e

Bus 001 Device 008: ID 0781:556e SanDisk Corp.
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass          239 Miscellaneous Device
  bDeviceSubClass         2 ?
  bDeviceProtocol         1 Interface Association
  bMaxPacketSize0        64
  idVendor           0x0781 SanDisk Corp.
  idProduct          0x556e
  bcdDevice            4.19
  iManufacturer           1 Sandisk
  iProduct                2 Cruzer Edge
  iSerial                 3 Serial123456789
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           32
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          4 0
    bmAttributes         0x80
      (Bus Powered)
    MaxPower              100mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk-Only
      iInterface              5 Mass Storage
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               1
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass          239 Miscellaneous Device
  bDeviceSubClass         2 ?
  bDeviceProtocol         1 Interface Association
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0000
  (Bus Powered)