driverentry.cpp

USB sniffer for windows

						sprintf(TempBuff,
							"\tInterface[%d]: Pipes[%lu] : PipeHandle\t\t\t\t= 0x%p\n",
							i, p, pInterface->Pipes[p].PipeHandle);
						FillRollingBuffer(TempBuff);
						sprintf(TempBuff,
							"\tInterface[%d]: Pipes[%lu] : MaxTransferSize\t= 0x%08x\n",
							i, p, pInterface->Pipes[p].MaximumTransferSize);
						FillRollingBuffer(TempBuff);
						sprintf(TempBuff,
							"\tInterface[%d]: Pipes[%lu] : PipeFlags\t\t\t\t= 0x%02x\n",
							i, p, pInterface->Pipes[p].PipeFlags);
						FillRollingBuffer(TempBuff);

						AddEndpointInfo(pInterface->Pipes[p].PipeHandle,
							pInterface->Pipes[p].EndpointAddress);
					}
				}

				pInterface = (PUSBD_INTERFACE_INFORMATION) (((UCHAR*)pInterface) + pInterface->Length);
			}
		}
		break;

	case URB_FUNCTION_SELECT_INTERFACE:
		{
			struct _URB_SELECT_INTERFACE  *pSelectInterface = (struct _URB_SELECT_INTERFACE *) pUrb;

			sprintf(TempBuff,"-- URB_FUNCTION_SELECT_INTERFACE:\n");
			FillRollingBuffer(TempBuff);
			if(pSelectInterface->Hdr.Length < sizeof(struct _URB_SELECT_INTERFACE))
				sprintf(TempBuff,
					"!!! Hdr.Length is wrong! (is: %d, should be at least: %d)\n",
					pSelectInterface->Hdr.Length, 
					sizeof(struct _URB_SELECT_INTERFACE));
			FillRollingBuffer(TempBuff);
			sprintf(TempBuff,"\tConfigurationHandle\t\t\t= 0x%08x\n",
				pSelectInterface->ConfigurationHandle);
			FillRollingBuffer(TempBuff);

			PUSBD_INTERFACE_INFORMATION pInterface = &pSelectInterface->Interface;
			
			sprintf(TempBuff,
				"\tInterface: Length\t\t\t\t= %d\n", 
				pInterface->Length);
			FillRollingBuffer(TempBuff);
			sprintf(TempBuff,
				"\tInterface: InterfaceNumber\t\t= %d\n", 
				pInterface->InterfaceNumber);
			FillRollingBuffer(TempBuff);
			sprintf(TempBuff,
				"\tInterface: AlternateSetting\t= %d\n", 
				pInterface->AlternateSetting);
			FillRollingBuffer(TempBuff);
			sprintf(TempBuff,
				"\tInterface: Class\t\t\t\t= 0x%02x\n", 
				pInterface->Class);
			FillRollingBuffer(TempBuff);
			sprintf(TempBuff,
				"\tInterface: SubClass\t\t\t= 0x%02x\n",
				pInterface->SubClass);
			FillRollingBuffer(TempBuff);
			sprintf(TempBuff,
				"\tInterface: Protocol\t\t\t= 0x%02x\n",
				pInterface->Protocol);
			FillRollingBuffer(TempBuff);
			sprintf(TempBuff,
				"\tInterface: InterfaceHandle\t= %p\n",
				pInterface->InterfaceHandle);
			FillRollingBuffer(TempBuff);
			sprintf(TempBuff,
				"\tInterface: NumberOfPipes\t\t= %d\n",
				pInterface->NumberOfPipes);
			FillRollingBuffer(TempBuff);
			if(bReturnedFromHCD)
			{
				ULONG uNumPipes = pInterface->NumberOfPipes;
				if(uNumPipes > 0x1f)
				{
					sprintf(TempBuff,
						"*** error: uNumPipes is too large (%d), resetting to 1\n",
						uNumPipes);
					FillRollingBuffer(TempBuff);
					uNumPipes = 1;
				}
				for(ULONG p = 0; p< uNumPipes; p++)
				{
					sprintf(TempBuff,
						"\tInterface: Pipes[%lu] : MaximumPacketSize = 0x%04x\n", 
						p, pInterface->Pipes[p].MaximumPacketSize);
					FillRollingBuffer(TempBuff);
					sprintf(TempBuff,
						"\tInterface: Pipes[%lu] : EndpointAddress\t= 0x%02x\n",
						p, pInterface->Pipes[p].EndpointAddress);
					FillRollingBuffer(TempBuff);
					sprintf(TempBuff,
						"\tInterface: Pipes[%lu] : Interval\t\t\t= 0x%02x\n",
						p, pInterface->Pipes[p].Interval);
					FillRollingBuffer(TempBuff);
					sprintf(TempBuff,
						"\tInterface: Pipes[%lu] : PipeType\t\t\t= 0x%02x (%s)\n",
						p, pInterface->Pipes[p].PipeType,
						pInterface->Pipes[p].PipeType == UsbdPipeTypeControl ? "UsbdPipeTypeControl" :
						pInterface->Pipes[p].PipeType == UsbdPipeTypeIsochronous ? "UsbdPipeTypeIsochronous" :
						pInterface->Pipes[p].PipeType == UsbdPipeTypeBulk ? "UsbdPipeTypeBulk" :
						pInterface->Pipes[p].PipeType == UsbdPipeTypeInterrupt ? "UsbdPipeTypeInterrupt" : "!!! INVALID !!!");
						FillRollingBuffer(TempBuff);
					sprintf(TempBuff,
						"\tInterface: Pipes[%lu] : PipeHandle\t\t\t= 0x%p\n",
						p, pInterface->Pipes[p].PipeHandle);
					FillRollingBuffer(TempBuff);
					sprintf(TempBuff,
						"\tInterface: Pipes[%lu] : MaxTransferSize\t= 0x%08x\n",
						p, pInterface->Pipes[p].MaximumTransferSize);
					FillRollingBuffer(TempBuff);
					sprintf(TempBuff,
						"\tInterface: Pipes[%lu] : PipeFlags\t\t\t= 0x%02x\n",
						p, pInterface->Pipes[p].PipeFlags);
					FillRollingBuffer(TempBuff);

					AddEndpointInfo(pInterface->Pipes[p].PipeHandle,
						pInterface->Pipes[p].EndpointAddress);
				}
			}
		}
		break;
	case URB_FUNCTION_ABORT_PIPE:
		{
			struct _URB_PIPE_REQUEST   *pAbortPipe = (struct _URB_PIPE_REQUEST *) pUrb;

			sprintf(TempBuff,"-- URB_FUNCTION_ABORT_PIPE:\n");
			FillRollingBuffer(TempBuff);
			if(pAbortPipe->Hdr.Length < sizeof(struct _URB_PIPE_REQUEST))
			{
				sprintf(TempBuff,
					"!!! Hdr.Length is wrong! (is: %d, should be at least: %d)\n",
					pAbortPipe->Hdr.Length, sizeof(struct _URB_PIPE_REQUEST));
				FillRollingBuffer(TempBuff);
			}	

			if(!bReturnedFromHCD)
				DumpPipeHandle("  PipeHandle",pAbortPipe->PipeHandle);
		}
		break;
	case URB_FUNCTION_TAKE_FRAME_LENGTH_CONTROL:
		{
			struct _URB_FRAME_LENGTH_CONTROL *pFrameLengthControl = (struct _URB_FRAME_LENGTH_CONTROL *) pUrb;

			sprintf(TempBuff,
				"-- URB_FUNCTION_TAKE_FRAME_LENGTH_CONTROL:\n");
			FillRollingBuffer(TempBuff);
			if(pFrameLengthControl->Hdr.Length < sizeof(struct _URB_FRAME_LENGTH_CONTROL))
			{
				sprintf(TempBuff,
					"!!! Hdr.Length is wrong! (is: %d, should be at least: %d)\n", 
					pFrameLengthControl->Hdr.Length, 
					sizeof(struct _URB_FRAME_LENGTH_CONTROL));
				FillRollingBuffer(TempBuff);
			}

			sprintf(TempBuff,"  (no parameters)\n");
			FillRollingBuffer(TempBuff);
		}
		break;
	case URB_FUNCTION_RELEASE_FRAME_LENGTH_CONTROL:
		{
			struct _URB_FRAME_LENGTH_CONTROL *pFrameLengthControl = (struct _URB_FRAME_LENGTH_CONTROL *) pUrb;

			sprintf(TempBuff,
				"-- URB_FUNCTION_RELEASE_FRAME_LENGTH_CONTROL:\n");
			FillRollingBuffer(TempBuff);
			if(pFrameLengthControl->Hdr.Length < sizeof(struct _URB_FRAME_LENGTH_CONTROL))
			{
				sprintf(TempBuff,
					"!!! Hdr.Length is wrong! (is: %d, should be at least: %d)\n", 
					pFrameLengthControl->Hdr.Length, sizeof(struct _URB_FRAME_LENGTH_CONTROL));
				FillRollingBuffer(TempBuff);
			}

			sprintf(TempBuff,"  (no parameters)\n");
			FillRollingBuffer(TempBuff);
		}
		break;
	case URB_FUNCTION_GET_FRAME_LENGTH:
		{
			struct _URB_GET_FRAME_LENGTH   *pGetFrameLength = (struct _URB_GET_FRAME_LENGTH *) pUrb;

			sprintf(TempBuff,"-- URB_FUNCTION_GET_FRAME_LENGTH:\n");
			FillRollingBuffer(TempBuff);
			if(pGetFrameLength->Hdr.Length < sizeof(struct _URB_GET_FRAME_LENGTH))
			{
				sprintf(TempBuff,
					"!!! Hdr.Length is wrong! (is: %d, should be at least: %d)\n",
					pGetFrameLength->Hdr.Length, 
					sizeof(struct _URB_GET_FRAME_LENGTH));
				FillRollingBuffer(TempBuff);
			}

			if(bReturnedFromHCD)
			{
				sprintf(TempBuff,
					"\tFrameLength = %08x\n", 
					pGetFrameLength->FrameLength);
				FillRollingBuffer(TempBuff);
				sprintf(TempBuff,
					"\tFrameNumber = %08x\n", 
					pGetFrameLength->FrameNumber);
				FillRollingBuffer(TempBuff);
			}
		}
		break;
	case URB_FUNCTION_SET_FRAME_LENGTH:
		{
			struct _URB_SET_FRAME_LENGTH   *pSetFrameLength = (struct _URB_SET_FRAME_LENGTH *) pUrb;

			sprintf(TempBuff,
				"-- URB_FUNCTION_SET_FRAME_LENGTH:\n");
			FillRollingBuffer(TempBuff);
			if(pSetFrameLength->Hdr.Length < sizeof(struct _URB_SET_FRAME_LENGTH))
			{
				sprintf(TempBuff,
					"!!! Hdr.Length is wrong! (is: %d, should be at least: %d)\n",
					pSetFrameLength->Hdr.Length, 
					sizeof(struct _URB_SET_FRAME_LENGTH));
				FillRollingBuffer(TempBuff);
			}

			if(!bReturnedFromHCD)
			{
				sprintf(TempBuff,
					"  FrameLengthDelta = %08x\n", 
					pSetFrameLength->FrameLengthDelta);
				FillRollingBuffer(TempBuff);
			}
		}
		break;
	case URB_FUNCTION_GET_CURRENT_FRAME_NUMBER:
		{
			struct _URB_GET_CURRENT_FRAME_NUMBER   *pGetCurrentFrameNumber = (struct _URB_GET_CURRENT_FRAME_NUMBER *) pUrb;

			sprintf(TempBuff,
				"-- URB_FUNCTION_GET_CURRENT_FRAME_NUMBER:\n");
			FillRollingBuffer(TempBuff);
			if(pGetCurrentFrameNumber->Hdr.Length < sizeof(struct _URB_GET_CURRENT_FRAME_NUMBER))
			{
				sprintf(TempBuff,
					"!!! Hdr.Length is wrong! (is: %d, should be at least: %d)\n",
					pGetCurrentFrameNumber->Hdr.Length,
					sizeof(struct _URB_GET_CURRENT_FRAME_NUMBER));
				FillRollingBuffer(TempBuff);
			}

			if(bReturnedFromHCD)
			{
				sprintf(TempBuff,
					"  FrameNumber = %08x\n", 
					pGetCurrentFrameNumber->FrameNumber);
				FillRollingBuffer(TempBuff);
			}
		}
		break;
	case URB_FUNCTION_CONTROL_TRANSFER:
		{
			struct _URB_CONTROL_TRANSFER   *pControlTransfer = (struct _URB_CONTROL_TRANSFER *) pUrb;

			sprintf(TempBuff,"-- URB_FUNCTION_CONTROL_TRANSFER:\n");
			FillRollingBuffer(TempBuff);
			if(pControlTransfer->Hdr.Length < sizeof(struct _URB_CONTROL_TRANSFER))
			{
				sprintf(TempBuff,
					"!!! Hdr.Length is wrong! (is: %d, should be at least: %d)\n",
					pControlTransfer->Hdr.Length, 
					sizeof(struct _URB_CONTROL_TRANSFER));
				FillRollingBuffer(TempBuff);
			}

			BOOLEAN bReadFromDevice = (BOOLEAN)(pControlTransfer->TransferFlags & USBD_TRANSFER_DIRECTION_IN);
			DumpPipeHandle("\tPipeHandle\t\t",pControlTransfer->PipeHandle);
			sprintf(TempBuff,
				"\tTransferFlags\t\t= %08x (%s, %sUSBD_SHORT_TRANSFER_OK)\n",
				pControlTransfer->TransferFlags,
				bReadFromDevice ? "USBD_TRANSFER_DIRECTION_IN" : "USBD_TRANSFER_DIRECTION_OUT",
				pControlTransfer->TransferFlags & USBD_SHORT_TRANSFER_OK ? "":"~");
			FillRollingBuffer(TempBuff);
			DumpTransferBuffer((PUCHAR)pControlTransfer->TransferBuffer, pControlTransfer->TransferBufferMDL, pControlTransfer->TransferBufferLength, TRUE);
			if(((!bReadFromDevice) && (!bReturnedFromHCD)) || (bReadFromDevice && bReturnedFromHCD))
			{
				DumpTransferBuffer((PUCHAR)pControlTransfer->TransferBuffer, pControlTransfer->TransferBufferMDL, pControlTransfer->TransferBufferLength, FALSE);
			}

			sprintf(TempBuff,"\tUrbLink\t\t\t= %08x\n",
				pControlTransfer->UrbLink);
			FillRollingBuffer(TempBuff);
			sprintf(TempBuff,"\tSetupPacket\t\t\t:");
			FillRollingBuffer(TempBuff);

			for(int b=0; b<sizeof(pControlTransfer->SetupPacket); b++)
			{
				sprintf(TempBuff," %02x", 
					pControlTransfer->SetupPacket[b]);
				FillRollingBuffer(TempBuff);
			}
			sprintf(TempBuff,"\n");
			FillRollingBuffer(TempBuff);
			if(pControlTransfer->UrbLink)
			{
				sprintf(TempBuff,"---> Linked URB:\n");
				FillRollingBuffer(TempBuff);
				DumpURB(pControlTransfer->UrbLink, bReturnedFromHCD);
				sprintf(TempBuff,"---< Linked URB\n");
				FillRollingBuffer(TempBuff);
			}
		}
		break;
	case URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER:
		{
			struct _URB_BULK_OR_INTERRUPT_TRANSFER *pBulkOrInterruptTransfer = (struct _URB_BULK_OR_INTERRUPT_TRANSFER *) pUrb;

			sprintf(TempBuff,
				"-- URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER:\n");
			FillRollingBuffer(TempBuff);
			if(pBulkOrInterruptTransfer->Hdr.Length < sizeof(struct _URB_BULK_OR_INTERRUPT_TRANSFER ))
			{
				sprintf(TempBuff,
					"!!! Hdr.Length is wrong! (is: %d, should be at least: %d)\n",
					pBulkOrInterruptTransfer->Hdr.Length, 
					sizeof(struct _URB_BULK_OR_INTERRUPT_TRANSFER));
				FillRollingBuffer(TempBuff);
			}

			BOOLEAN bReadFromDevice = (BOOLEAN)(pBulkOrInterruptTransfer->TransferFlags & USBD_TRANSFER_DIRECTION_IN);
			DumpPipeHandle("  PipeHandle          ",pBulkOrInterruptTransfer->PipeHandle);
			sprintf(TempBuff,
				"  TransferFlags        = %08x (%s, %sUSBD_SHORT_TRANSFER_OK)\n",
				pBulkOrInterruptTransfer->TransferFlags,
				bReadFromDevice ? "USBD_TRANSFER_DIRECTION_IN" : "USBD_TRANSFER_DIRECTION_OUT",
				pBulkOrInterruptTransfer->TransferFlags & USBD_SHORT_TRANSFER_OK ? "":"~");
			FillRollingBuffer(TempBuff);
			DumpTransferBuffer((PUCHAR)pBulkOrInterruptTransfer->TransferBuffer, pBulkOrInterruptTransfer->TransferBufferMDL, pBulkOrInterruptTransfer->TransferBufferLength, TRUE);
			if(((!bReadFromDevice) && (!bReturnedFromHCD)) || (bReadFromDevice && bReturnedFromHCD))
			{
				DumpTransferBuffer((PUCHAR)pBulkOrInterruptTransfer->TransferBuffer, pBulkOrInterruptTransfer->TransferBufferMDL, pBulkOrInterruptTransfer->TransferBufferLength, FALSE);
			}

			sprintf(TempBuff,"  UrbLink              = %08x\n",
				pBulkOrInterruptTransfer->UrbLink);
			FillRollingBuffer(TempBuff);
			if(pBulkOrInterruptTransfer->UrbLink)
			{
				sprintf(TempBuff,"---> Linked URB:\n");
				FillRollingBuffer(TempBuff);
				DumpURB(pBulkOrInterruptTransfer->UrbLink, bReturnedFromHCD);
				sprintf(TempBuff,"---< Linked URB\n");
				FillRollingBuffer(TempBuff);
			}
		}
		break;
	case URB_FUNCTION_ISOCH_TRANSFER:
		{
			struct _URB_ISOCH_TRANSFER *pIsochTransfer = (struct _URB_ISOCH_TRANSFER *) pUrb;

			sprintf(TempBuff,"-- URB_FUNCTION_ISOCH_TRANSFER:\n");
			FillRollingBuffer(TempBuff);
			if(pIsochTransfer->Hdr.Length < sizeof(struct _URB_ISOCH_TRANSFER ))
			{
				sprintf(TempBuff,
					"!!! Hdr.Length is wrong! (is: %d, should be at least: %d)\n",
					pIsochTransfer->Hdr.Length, 
					sizeof(struct _URB_ISOCH_TRANSFER));
				FillRollingBuffer(TempBuff);
			}

			BOOLEAN bReadFromDevice = (BOOLEAN)(pIsochTransfer->TransferFlags & USBD_TRANSFER_DIRECTION_IN);
			DumpPipeHandle("  PipeHandle          ",pIsochTransfer->PipeHandle);
			sprintf(TempBuff,
				"\tTransferFlags\t\t\t= %08x (%s, %sUSBD_SHORT_TRANSFER_OK%s\n",
				pIsochTransfer->TransferFlags,
				bReadFromDevice ? "USBD_TRANSFER_DIRECTION_IN" : "USBD_TRANSFER_DIRECTION_OUT",
				pIsochTransfer->TransferFlags & USBD_SHORT_TRANSFER_OK ? "":"~",
				pIsochTransfer->TransferFlags & USBD_START_ISO_TRANSFER_ASAP ? ", USBD_START_ISO_TRANSFER_ASAP" : "");
			FillRollingBuffer(TempBuff);
			DumpTransferBuffer((PUCHAR)pIsochTransfer->TransferBuffer, pIsochTransfer->TransferBufferMDL, pIsochTransfer->TransferBufferLength, TRUE);
			if(((!bReadFromDevice) && (!bReturnedFromHCD)) || (bReadFromDevice && bReturnedFromHCD))
			{
				DumpTransferBuffer((PUCHAR)pIsochTransfer->TransferBuffer, pIsochTransfer->TransferBufferMDL, pIsochTransfer->TransferBufferLength, FALSE);
			}
			else
			{
				sprintf(TempBuff,"bReadFromDevice = %x\nbReturnedFromHCD=%x",
					bReadFromDevice, bReturnedFromHCD);
			FillRollingBuffer(TempBuff);
			
			}