On USB Driver Coding #7


In the previous post we have seen how to completely Dump an URB but as you should remember exists a particular structure _URB_CONTROL_TRANSFER, that USB client drivers sets up to transfer data to or from a control pipe. So we need to implement two external Dump Functions, DumpPipeHandle and DumpTransferBuffer.

void DumpPipeHandle(
in struct Buffer *b,const char *s,
in USBD_PIPE_HANDLE inPipeHandle
unsigned char ep;

if (GetEndpointInfo(inPipeHandle,&ep))
KPrintf(b,”%s = %p [endpoint 0x%x]\n”,s,inPipeHandle,ep);
KPrintf(b,”%s = %p\n”,s,inPipeHandle);

As you should remember it’s necessary for any PipeHandle to know the Endpoint. This can be accomplished by tracing the USBD_PIPE_HANDLE for each Endpoint (the number of Endpoints is declared at our choise (use for example MAXEP = 50).

Now is time to rip the TransferBuffer with DumpTransferBuffer:

void DumpTransferBuffer(
struct Buffer *b,
PUCHAR pBuffer,
PMDL pMdl,
ULONG uBufferSize,
in BOOLEAN bPrintHeader,
ULONG uBufferOffset = 0


else if(pMdl)
PUCHAR pMDLBuf = (PUCHAR)MmGetSystemAddressForMdlSafe(pMdl,NormalPagePriority);

Here ends the USB Coding Series (source code I’ve used is taken from SniffUSB 2.0), but surely i’ll come back with other arguments related to USB..

See you to the next post.. 🙂

One Response to On USB Driver Coding #7

  1. Alex says:

    Hi dude! I’m quite surprised somebody really decided to make such a review of a USB lower filter-driver. I’m doing the same just now (except it’s in russian) and have some particular questions about it.
    First of all i don’t understand, why you don’t use the FilterDispatchAny routine in your DriverEntry function, but still have it for some reasons. In the sources i have (it’s Benoit’s driver-filter, http://benoit.papillault.free.fr/index.php.en ) this routine is actually used (for every major function, except IRP_MJ_PNP and IRP_MJ_POWER).
    The second thing i didn’t get is about the DispatchPnP routine. IRP_MJ_PNP is actually set to be handled by the FilterDispatchPnP routine, but FilterDispatchAny has the branch to handle IRP_MJ_PNP too. Why???
    Next, I didn’t get it, where my driver actually is??? It’s said to be lower-filter and installed as lower-filter, but sources say FDO appears to be our LOWER device, so the truth is that my driver is UPPER-filter driver. How is it possible? May be my understanding of WMD is inaccurate?
    And finally, WHY IN THE WORLD we have to hook FDO dispatch tables just because of 2 IRP function codes??? Why can we not handle them by our FiDO?

    P.S. Thanks a lot for your work. I think many people would appreciate and find it useful.

    P.P.S. Can you suggest some literature or links about the topic?

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: