v0.3.7

Less noise on a live host; interactive report picker

Testing a plain mouse or keyboard on a Pi that has other things running was
over-reporting. Tightened it without weakening real detection (a HID device on
an unknown cable still flags HIGH — that's the BadUSB signature, and
CableProbe can't tell your real keyboard from an implant):

• "did not revert" heads-up now counts only real device kinds. Kernel log
  lines (which only ever accumulate) and processes no longer inflate it — a
  keyboard test said "10 things did not revert", now it says the truth.
• advice only says "a USB hub appeared" for an actual new hub, not for the
  device count going up by one when you plug something in.
• kernel_log defaults to notable lines (enumeration failures, gadget
  driver classes). The routine "New USB device found / Product: / input: X
  as …" chatter is now behind probes.kernel_log_verbose — the
  usb / input / usb_descriptors probes already carry it, structured.
• input merges the several HID collections of one USB device (keyboard +
  consumer-control + system-control) into a single observation.
• process drops sleep / flock plumbing and CableProbe's own helper
  subprocesses.

cableprobe report with no path

Now lists the saved reports — numbered, newest first, with session name, date
and severity — and asks which one to open.

pipx upgrade cableprobe

v0.3.6

Plain-language "What this means" box

The console summary now ends with a "What this means" box that reads the
session for someone who isn't a USB/kernel specialist:

• an overall verdict keyed to severity — from "Treat this cable as hostile
  hardware" down to "CableProbe did not observe anything notable", always with
  the reminder that a clean result is "nothing happened this time", not
  "nothing can happen"
• one plain sentence per thing it saw: a BadUSB keyboard, network redirection,
  a storage payload, a hidden serial channel, covert audio/video, the cable's
  own Wi-Fi, PCIe/DMA, an unexpected driver, a hidden hub, …
• a heads-up when something didn't go away after you unplugged the cable

Shows as a coloured box in the terminal, and as a plain === WHAT THIS MEANS ===
block under -v, when rich is unavailable, and in cableprobe report.

pipx upgrade cableprobe

v0.3.5

Much less false-positive noise

A bare, safe cable and an ordinary USB keyboard were both producing dozens of
spurious phase-differences and findings. Fixed the noise sources without
weakening real detection (a BadUSB keyboard still flags HIGH):

• listeners — drops LISTEN sockets on ephemeral-range ports (≥ the
  kernel's ip_local_port_range low bound, default 32768). RPC, mDNS and IDE
  remote-helper sockets churn these constantly, and no implant binds a backdoor
  to a port that changes on every restart. Rule new-listener-on-connect
  lowered medium → low.
• process — skips kernel threads (kworker/*, ksoftirqd/*, … — children
  of kthreadd), which the kernel spawns, renames and reaps nonstop.
• input — the udev input subsystem lists every device twice (the logical
  inputN node and its eventN / mouseN child); CableProbe now keeps only
  the logical one, removing duplicate findings.
• rules — new not_contains attribute condition; the generic HID rule no
  longer double-reports a keyboard or pointer that already matched its own
  higher-severity rule.

On the reporter's keyboard run this cut 59 phase-differences → ~18 and 26
findings → ~9, all still about the keyboard.

pipx upgrade cableprobe

v0.3.4

Progress bar during a run

cableprobe run now shows a progress bar for each of the three phases —
description, bar, percent, elapsed/total s, and estimated time remaining.
Each phase's bar fills to 100% and stays on screen, so a completed session
shows all three at a glance.

  baseline  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100%   30/30s 0:00:00
  test      ━━━━━━━━━━━━━━━━━━━━╸               58%    52/90s 0:00:38

• -v / -vv keeps the old plain [phase] 12.0/30s (40%) lines so the bar
  doesn't fight with log output
• Works with --auto; degrades cleanly when stdout isn't a terminal

pipx upgrade cableprobe

v0.3.3

Clarify: any USB cable, not just USB-C

CableProbe watches how the host reacts to a cable, not the plug, so a USB-A
implant cable (the original O.MG form factor) is fully in scope. Documentation
and --help now say "USB-C or USB-A, charge-only or data", with a note that
connector type does not matter (use a passive adapter if you need one).

The usbc_pd probe stays USB-C specific — it reads /sys/class/typec and skips
cleanly on a USB-A-only host.

Doc / help text only; no behaviour change. pipx upgrade cableprobe.

v0.3.2

Fix: sudo cableprobe when installed with pipx

sudo resets PATH, so a pipx / pip install --user install of cableprobe
(in ~/.local/bin) gave sudo: cableprobe: command not found. The not-root
warning now detects this and prints commands that actually work:

• sudo <absolute-path-to-cableprobe> …
• sudo env "PATH=$PATH" cableprobe …
• sudo ./scripts/install.sh for a permanent /usr/local/bin symlink (the
  recommended setup for a test rig)

When cableprobe is already on root's PATH it still prints the plain
sudo cableprobe ….

Installers pull the new probes' tools

scripts/install.sh and the pi-gen recipe now apt install iw (for
wifi_scan) and pciutils alongside usbutils / util-linux.

Docs

README gains a "command not found" troubleshooting note and flags
scripts/install.sh as the recommended rig install.

Upgrade: pipx upgrade cableprobe (or pipx install "cableprobe==0.3.2")

v0.3.1

Two new probes

Probe	Observes
wifi_scan	Wi-Fi access points in range — several cable implants carry a radio and run their own AP for out-of-band control. Active iw / nmcli scan at each phase boundary (never per-tick); flags APs strong enough (≥ −55 dBm) to plausibly be in the connector. Never associates.
keystroke_cadence	Key-press timing per input device — the key code of every event is discarded, so it only ever learns when keys were pressed, not which. Flags superhuman speed or machine-perfect regularity as injection. Disable with probes.capture_keystroke_timing: false.

New rules: keystroke-injection-detected (critical), strong-wifi-ap-appeared-on-connect (high), plus lower-confidence variants. 20 probes, 38 rules total.

CLI: root check

cableprobe run now detects when it is not running as root, prints the exact sudo command, and — in interactive mode — asks whether to continue anyway (kernel-log, udev-attribute, USB-descriptor, keystroke-timing and raw-socket probes see much less or are skipped without privileges). --auto warns and proceeds. cableprobe check flags it too.

Quieter probe skipping

Probes whose kernel interface is absent (no Type-C class, no /sys/bus/pci, no Wi-Fi) are now dropped up front and shown as a single dim skipped: … line rather than a yellow Probe warnings block — an absent interface is expected, not a failure. New metadata.probes_unavailable field in the report.

Also

• cableprobe --version now reflects the installed package version (was pinned at 0.1.0)
• Test suite 57 → 124

Install / upgrade: pipx install "cableprobe==0.3.1" (or pip install --upgrade cableprobe)

v0.1.2

Eleven new observation probes

CableProbe now inspects far more of the host's reaction to an unknown cable.
All probes are observation-only and skip cleanly when the kernel interface
isn't present.

Probe	Observes
serial	TTY / USB-serial devices (CDC-ACM, FTDI, cp210x) — covert command channels
audio / video	USB audio-class and UVC camera devices — covert capture
usb_descriptors	Per-interface USB descriptors from sysfs; catches composite implants and descriptor morphing
usb_topology	USB hub / port tree — hidden hubs stacking interfaces behind one connector
usbc_pd	USB-C / Power Delivery roles and alt modes — data-role swaps, DisplayPort/Thunderbolt entry
kernel_modules	Gadget drivers auto-loading on connect (rndis_host, cdc_ncm, usb_storage, …)
mounts	Automounted removable media
pci	PCI + Thunderbolt devices — USB4 PCIe-tunnel / DMA surface
routing	Default route and DNS resolvers — gateway / resolver hijack
listeners	New TCP listening sockets

• 17 new detection rules, including critical rules for PCIe tunnelling and route/DNS hijack
• Default probe set expanded from 7 to 18 (all still opt-out via config)
• Project home page: https://www.cableprobe.com
• 83 tests (was 57)

Install / upgrade: pipx install "cableprobe==0.1.2" (or pip install --upgrade cableprobe)

v0.1.0

First release of CableProbe — an open-source defensive USB cable analysis tool for Linux.

CableProbe observes, records and reports what a host does across a baseline / test / post-test session while an unknown USB-C cable is connected, then runs YAML-configurable detection rules over the phase deltas.

Install:
pipx install cableprobe

See the README for usage and the disposable Raspberry Pi image recipe.