[Libusb-devel] Question on next step of USB reverse engineering

[Douglas S. B. <db...@br...>]

Ok, thanks to this group I have been snoopying a USB-based robot. I see 
that when I plug the USB in under Windows with the proprietary device 
handler in place, 278 packets are sent back and forth (139 ups + 139 downs).

I suspect that there are some config data being set in that first 139 
packets. I have been able to do bulk reads and writes using libusb, but 
I'm not getting the correct data back (on the Input endpoint).

Here is a bit of the code to read/write under Linux:

printf("Reading...\n");
retval = usb_bulk_read(udev, 0x81, buff, 64, 50); //
printf("Retval = %d\n", retval);
print_buffer( buff, retval);

printf("Writing...\n");
retval = usb_bulk_write(udev, 0x02, buffer, 4, 50); // timeout
printf("Retval = %d\n", retval);

That works, except for not getting back the same values that we get 
under snoopy/Windows.

I think if I could figure out how to convert a 
VENDOR_DEVICE/CONTROL_TRANSFER into C code, then I can replicate the 139 
packets. Am I right to guess that I would do that with the 
usb_control_msg() function?

If so, maybe someone could help be turn sequences 140 and 141 (below) 
into such commands.

Any help would be much appreciated!

-Doug

----------------------------------------------------------------------------
140	out down	n/a	27.780	VENDOR_DEVICE	-	
URB Header (length: 80)
SequenceNumber: 140
Function: 0017 (VENDOR_DEVICE)
PipeHandle: 82696d40

SetupPacket:
0000: 00 00 00 00 00 00 00 00
bmRequestType: 00
   DIR: Host-To-Device
   TYPE: Standard
   RECIPIENT: Device
bRequest: 00
   GET_STATUS

No TransferBuffer
----------------------------------------------------------------------------
140	out up	n/a	27.780	CONTROL_TRANSFER	-	0x00000000
URB Header (length: 80)
SequenceNumber: 140
Function: 0008 (CONTROL_TRANSFER)
PipeHandle: 82696d40

SetupPacket:
0000: 40 00 00 00 00 00 00 00
bmRequestType: 40
   DIR: Host-To-Device
   TYPE: Vendor
   RECIPIENT: Device
bRequest: 00

No TransferBuffer
----------------------------------------------------------------------------
141	in down	n/a	27.800	VENDOR_DEVICE	-	
URB Header (length: 80)
SequenceNumber: 141
Function: 0017 (VENDOR_DEVICE)
PipeHandle: 82696d40

SetupPacket:
0000: 00 05 00 00 00 00 00 00
bmRequestType: 00
   DIR: Host-To-Device
   TYPE: Standard
   RECIPIENT: Device
bRequest: 05
   SET_ADDRESS

No TransferBuffer
----------------------------------------------------------------------------
141	in up	n/a	27.800	CONTROL_TRANSFER	01 60	0x00000000
URB Header (length: 80)
SequenceNumber: 141
Function: 0008 (CONTROL_TRANSFER)
PipeHandle: 82696d40

SetupPacket:
0000: c0 05 00 00 00 00 02 00
bmRequestType: c0
   DIR: Device-To-Host
   TYPE: Vendor
   RECIPIENT: Device
bRequest: 05

TransferBuffer: 0x00000002 (2) length
0000: 01 60
----------------------------------------------------------------------------


-- 
Douglas S. Blank,         Assistant Professor
db...@br...,            (610)526-6501
Bryn Mawr College,   Computer Science Program
101 North Merion Ave,       Park Science Bld.
Bryn Mawr, PA 19010  dangermouse.brynmawr.edu