Hello.
I want to send Io request from windows system thread to the FTDI device .
I know, that I must create IRP and send it to FTDI device stack;
pIrp = IoAllocateIrp( StackSize, ChargeQuota);
IoCallDriver(DeviceObject, pIrp);
I know, that FTDI use winusb.sys, as a function driver.
In his INF file FTDI includes FTDI inf file of WinUsb.
Now I don't know how to get device object. When I plug device to USB, WinObj appends this string in his GLOBAL?? list:
USB#VID_0403&PID_601E&MI_00#6&1102676b&1&0000#{2afdd907-dfa5-4d07-ba68-fc608637f28a}
Is this a device neme? If it is device name, how to use it inside IoCallDriver.
IoCallDriver(L"USB#VID_0403&PID_601E&MI_00#6&1102676b&1&0000#{2afdd907-dfa5-4d07-ba68-fc608637f28a}", ...
We have also device interface GUID - {2AFDD907-DFA5-4D07-BA68-FC608637F28A}
May be use this value, to get a device object? But how?
How to get pointer to device object by device name?
I think,that stack size for IoAllocateIrp I can take from pDeviceObject.
Thanks in advance.
Well. I have a system thread created by NDIS filter driver. How can I send queries from that thread to USB device, if I have a inf( ormation) file from installaton packet for that device
That driver does not expect to get requests from kernel-mode. Thus, you have to pretend to be a user-mode application. You can use IoGetDeviceObjectPointer to get a FILE_OBJECT and a DEVICE_OBJECT. Then, you can use the FILE_OBJECT to make ZwWriteFile or ZwDeviceIoControl calls, or you can use the DEVICE_OBJECT to send IRP_MJ_WRITE or IRP_MJ_DEVICE_CONTROL IRPs.
However, there is much you don't know about that interface. How will you select your configuration or your interface? How will you tell it which endpoint you want to access? None of that is documented (at least I think so).
Thank you, dear Mr. Tim. Your advice is invaluable.
The FTDI administrators have promised to send me a design guide for the FT600/1 driver under a non-disclosure agreement.
I don't know what it will be, but perhaps it will be useful.
Hello everybody. Is it possible to write filter driver for USB hub,capture all requests from winusb to usbhub, analize all requests initiated by FTDI user code, and write usb client driver, that will send the same requests to usbhub, so to pretend to be a user-mode application as said Mr.Tim.
Or may be there are already such a tool for capturing requests addressed to USB hub.
If it is possible, can I initiate such a requests not inside own usb client driver, but inside system thread created by NDIS filter driver, and submit them to USB hub using IoCallDriver() function. Thanks.
What you're asking is, "can I reverse engineer the FTDI USB protocols?" I thought they were going to send you a design guide under NDA.
You don't really want to intercept the URB traffic between WinUSB and usbccgp, because there's no good way for you to inject URBs at that point without writing your own client driver.
A more practical (although still difficult) path would be to write an UPPER filter to WinUSB, so you intercept the requests being sent from the user-mode library. You'd still have to do careful logging so you can map exactly which WinUSB inputs map to which user-mode requests.
This still doesn't tell you anything about how they handle error conditions. The FT601 is a somewhat finicky chip; if things are presented in exactly the right way, it pouts and stops transferring.
Yes, at first they promised, yesterday refused, according new rules. They get a new rules for sharing docs ralated with kernel mode. And I think, that docs is not belongs to him, becouse they use winusb, so that driver development guide is about both of them, windows and ftdi
Hello everybody.
- I read somewhere in OSR, that WinUSB can be used as filter. But I couldn't find anything about it. What is it?
- HHD USB Monitor sets us a upper filter driver for USB hub(or controller), and another instance as an upper filter driver for usbccgp. How can I intercept(using HHD USB Monitor) only transfers from winusb to usbccgp?
Thank You.
-
Microsoft talked about that in the very early days. I don't know that anyone ever made it work, and I'm not sure it's still supported.
-
I'm not sure what you're asking. That's exactly what HHD does. When you install the product, it installs both a filter driver and a user-mode application that allows you to choose which devices you want to monitor.
I'm a big fan of the HHD monitor; I subscribed for many years. It only failed me once; I had a USB Audio Class MIDI device that simply did not work when the HHD filter was in the stack. I never figured out why. Gamma rays, I suppose.
There are other alternatives. Wireshark with USBPcap has the ability to monitor USB traffic, without cost. I only encountered it once, but it did seem to work. Also, the Microsoft USB stack itself has ETW (Event Tracing for Windows) events for every URB that passes through. You can use either the Microsoft Network Monitor or logman to look at the results. I have used this several times, although it is rather user-hostile and is extremely low-level.
And once again, I want to emphasize that this may not give you what you want. If you do capture the URBs, and do manage to figure out how to associate a set of URBs with a particular user-mode action, to duplicate that request stream, you would have to BE the function driver for that device. You would have to write a driver to replace WinUSB. That's a lot of work.
Thank you, Mr. Tim. I understand.
Regarding your second question, I'll say this:
On my computer, the device stack for our FTDI superSpeed-FIFO bridge looks like this:
WINUSB,hhddmsusb,usbccgp,hhddmsusb,USBPcap,ASPI,USBHUB3
Therefore, the HHD monitor installs two instances. One above usbccgp, and the other above USB hub. I think, this means it can capture URB traffic between WINUSB and usbccgp, as well as between usbccgp and USBHUB3. I was only interested in the traffic between WINUSB and usbccgp. I asked how to prevent the USB monitor from displaying the second instance and only show the traffic between WINUSB and usbccgp.
If I understand wrong, please tell me what my mistake is.
Their software will manage the two instances. It's trying to show you USB traffic, not just intercepted URBs. Have you actually looked at what the application is showing you?
I see that you also have USBPcap.sys in there, which means you are running TWO USB monitors (probably HHD and Wireshark). That's dangerous.
Not yet. I think it will show me USB traffic, like Wireshark for USB, which I've used many times.
Got it, thanks.
I realized I can see traffic between WinUSB and usbccgp as URB packets.
Although they are similar, USBPcap is installed as a single instance,over hub.
Mr. Tim. What's the difference between USB traffic and intercepted URB messages?
I think intercepted URB messages consist of USB traffic(packets enclosed in URB structures) plus some URB control messages that don't reach the physical port.
Sorry and thank You.
Really, you should know this kind of thing. URBs are the USB equivalent of an IRP. (In fact, they are carried in an IRP -- IRP_MJ_DEVICE_INTERNAL_CONTROL). All of the communication going into the USB stack (at least at the usbccgp or usbhub level) is done using URBs. Some of the URBs are bulk, interrupt, or isochronous transfer requests that will result in packets on the USB wire. Many of the administrative URBs end up as control endpoint requests as well.
Thank You Mr.Tim. Thank You.