sprung – Reboot Operating System (Linux) When a Thumbdrive is Removed

Use coupon code: "antiforensics" for 20% off!

sprung is a simple script that scans for a device ID and the serial number for a particular device. If the device is removed or malfunctions so that either the device ID or the serial number change or become unreadable, a forced system reset occurs using a Magic SysRq Key routine.

This can be done in many different ways. This is one.

Below we see the results of the command $ udevadm info /dev/sdb. sprung uses this command to pull serial number information from the device (thumbdrive) plugged into this system. This serial number is what we use to determine if the device is still accessible to the host operating system, or plugged into the computer and host operating system.

Furthermore, a check is made to see if the device itself is plugged into the computer by checking for the udevadm error output for the string “No such device” which is part of the error message produced to stderr when no device is found.

$ udevadm info /dev/sdb

...
E: ID_SERIAL=Lexar_USB_Flash_Drive_AAZK98GWCSAYYIV9-0:0
E: ID_SERIAL_SHORT=AAZK98GWCSAYYIV9
E: ID_VENDOR=Lexar
...

while continue_loop is True:
    device_info = subprocess.Popen(['/usr/bin/udevadm', 'info', self.device], stdout=subprocess.PIPE,
                                   stderr=subprocess.PIPE)
    if "No such device" in device_info.stderr.readline().decode():
        found = False

In the code below, a check is made to determine if the device that was plugged in has the same serial number as the device hardcoded into the script. If it does not match, the loop is exited and the device is rebooted using Magic SysRq Key sequence.

for line in device_info.stdout.readlines():
    line = line.decode()

    device_serial_number = re.search('(?<=ID_USB_SERIAL_SHORT=).*', line)

    if device_serial_number is not None:
        if device_serial_number.group(0) == self.serial_number:
            found = True
            continue_loop = True
        else:
            found = False

Device reboot via Magic SysRq Key.

    def panic(self):
        cmd = 'echo b > /proc/sysrq-trigger'
        subprocess.check_output(cmd, shell=True)

Within the main() function, hardcode your devices serial number and device ID. Run as root so that the Magic SysRq Key routine completes.

def main():
    device = Device("AAZK98GWCSAYYIV9", "/dev/sdb")  # <serial number>, <device ID>
    device.check_device()

Downloads

GitHub: sprung

git clone https://github.com/ultros/sprung