Saleae Logic Pro Protocol Reverse Engineering#

Reverse engineering the Saleae Logic Pro MSO USB wire protocol for building an open-source compatible client.

Status#

Protocol is fully documented. A complete clean-room Rust implementation exists at eisbaw/saleae_logic_reversed with hardware-validated command opcodes, XOR obfuscation, FPGA registers, and capture format.

This repo contains our independent RE process documentation and supplementary findings from static analysis of Logic 2 v2.4.40 (macOS ARM64).

Key Documents#

File	Description
`WIRE_PROTOCOL.md`	Complete wire protocol spec — consolidated from saleae_logic_reversed + our analysis
`COMMAND_IDS.md`	Graph server internal command IDs (Layer 2 JSON RPC, NOT USB opcodes)
`PROCESS_LOG.md`	Full methodology log: tools, challenges, lessons learned across 7 phases
`README.md`	This file

Frida Scripts#

Script	Purpose
`fake_device_v3.js`	Hook DriveRequest/PopResponse JSON RPC layer
`hook_send.js`	Hook SendRequest at binary protocol layer
`hook_serialization.js`	Hook memcpy for packet construction monitoring
`memory_scan.js`	Scan loaded dylib memory for protocol constants
`quick_extract.js`	Lightweight DriveRequest logger
`extract_protocol.js`	Comprehensive protocol extraction (strings + xrefs)
`hook_drive_request.js`	Original DriveRequest hook (superseded by v3)
`fake_device_v2.js`	JSON RPC hook with known addresses (superseded by v3)

Architecture Discovery#

The Saleae Logic 2 software has two distinct protocol layers:

┌─────────────────────────────────────────────────────┐
│  Electron UI (React/TypeScript)                      │
│  ↓ gRPC / IPC                                        │
│  Graph Server (C++ libgraph_server_shared.dylib)     │
│  ↓ JSON RPC (DriveRequest/PopResponse)               │ ← Layer 2 (our decompilation)
│  MsoDeviceInterface → OsxUsbDevice                   │
│  ↓ USB Bulk EP1                                      │
│  Cypress FX3 Microcontroller                         │ ← Layer 1 (saleae_logic_reversed)
│  ↓ GPIF                                              │
│  FPGA (Lattice ECP5) → ADC → Sample Data on EP2     │
└─────────────────────────────────────────────────────┘

Layer 1 (USB): Single-byte opcodes (0x01, 0x02, 0x7D-0x8B). This is what you need for a compatible client. Fully documented in WIRE_PROTOCOL.md.

Layer 2 (JSON RPC): Internal graph server commands with numeric IDs (0x02-0xE9). Only relevant if modifying Logic 2 itself. Documented in COMMAND_IDS.md.

Reference Implementation#

git clone https://github.com/eisbaw/saleae_logic_reversed.git

Key files in that repo:

crates/saleae-proto/src/ep1_opcodes.rs — USB opcode constants
crates/saleae-proto/src/obfuscation.rs — XOR encryption (Pro devices)
crates/saleae-driver/src/ep1.rs — EP1 command channel
doc/protocol/ — full protocol documentation (hardware-validated)
re/ — Ghidra projects, USB pcaps, RE tools

Configure Feed