I'm currently enduring a bout with insomnia -- the sun is rising around 0430 nowadays, and I haven't got around to putting heavier curtains in the bedroom.
Anyway, I decided to poke at the software updater for the EFi-X USB secure pen drive. I reckoned that would put me to sleep in short order.
I specifically looked at the 32-bit Windows driver that facilitates firmware updates. Until the driver is associated with the device, the EFi-X looks like a mass storage device (as one would expect). I didn't do anything fancy ... just ran strings on efix.dll.
The output looked extremely familiar. An excerpt:
EFiX Devices, Version %d.%d.%d.%d
couldn't allocate memory for endpoint extra descriptors
invalid descriptor length of %d
skipped %d class/vendor specific endpoint descriptors
skipping descriptor 0x%X
bbbbwb
bbbbwbbb
unexpected descriptor 0x%X, expecting endpoint descriptor, type 0x%X
ran out of descriptors parsing
couldn't allocate memory for ifp->endpoint
too many endpoints
... so I grabbed libusb-win32-src-0.1.12.1 from sourceforge.net and looked for matching strings.
Bingo:
monkey:src wileyc$ pwd
/Users/wileyc/Desktop/libusb-win32-src-0.1.12.1/src
monkey:src wileyc$ grep "couldn't allocate memory for endpoint extra descriptors"
descriptors.c: fprintf(stderr, "couldn't allocate memory for endpoint extra descriptors\n");
monkey:src wileyc$ grep "invalid descriptor length of %d"
descriptors.c: fprintf(stderr, "invalid descriptor length of %d\n", header.bLength);
descriptors.c: fprintf(stderr, "invalid descriptor length of %d\n", header.bLength);
descriptors.c: fprintf(stderr, "invalid descriptor length of %d\n", header.bLength);
monkey:src wileyc$ grep "unexpected descriptor 0x%X, expecting endpoint descriptor, type 0x%X"
descriptors.c: fprintf(stderr, "unexpected descriptor 0x%X, expecting endpoint descriptor, type 0x%X\n",
monkey:src wileyc$ grep "couldn't allocate memory for ifp->endpoint"
descriptors.c: fprintf(stderr, "couldn't allocate memory for ifp->endpoint\n");
... and so forth. Try it yourself. Nearly everything in the strings output can be found verbatim in the libusb source.
The EFi-X Windows 32-bit driver is derived from libusb-win32. It appears that all references to libusb in the code have been replaced with "EFiX". Further, the driver does not ship with a copy of the LGPL (in violation of section one), a description of modifications (in violation of section two), or the source code (in violation of section three).
In summary, EFi-X contains code covered under the Lesser GNU Public License -- and violates the terms of that license.
