1

I'm reverse engineering some proprietary USB device interface userspace "glue" code on Windows. The code issues an IoCtl to the custom device class device driver, and gets back a WORD (2-byte value). If that word is above (unsigned) 0x0040, the userspace considers the device a high-speed device, otherwise it treats it as a full-speed device.

I'm trying to figure out whether there's any well-known value in Windows DDK or the USB standard that could be associated with this 0x0040 threshold. I've looked around and didn't see anything. Presumably, the actual value can be higher than that, i.e. say 0x0080 to mean "high speed". But obviously I'm not sure. Perhaps there's someone who'll see that value and immediately have an "a-ha, I know what that is!" moment :)

I haven't been peeking into the driver code yet, but that will be the next step if said 0x40 doesn't jump out at anyone :)

Kuba hasn't forgotten Monica
  • 95,931
  • 16
  • 151
  • 313

2 Answers2

1

If it's a private IOCTL then it's likely to be specific to your vendor/usb device/user mode driver.

You could have anything packed into that WORD e.g. like bitfields to indicate usb protocol, or low, high, superspeed indicators, whether port open, direction, etc.

The 0x40 (64)...."might" be indicating the packet size that is currently configured for the endpoint i.e. the size of the packets being used for the usb data communication, or the maximum possible packet size.

Low/high/full/super speed will allow/use different packet sizes.

Like most reverse engineering it's gonna be trial and error :).

If the driver you are using was based off of one of the Microsoft examples, then you might get some clues from there:

https://github.com/microsoft/Windows-driver-samples/tree/master/usb

https://github.com/microsoft/Windows-driver-samples/blob/master/usb/usbsamp/sys/private.h

e.g. your 64 is related to packet size.

#define MAX_FULL_SPEED_PACKET_SIZE   64
#define MAX_HIGH_SPEED_PACKET_SIZE   512
#define MAX_SUPER_SPEED_PACKET_SIZE  1024
#define MAX_STREAM_VALID_PACKET_SIZE   1024
#define REMOTE_WAKEUP_MASK 0x20

Maybe look at this to see if that IOCTL is documented for you:

http://www.ioctls.net/

Maybe this will help to understand packet sizes:

https://www.beyondlogic.org/usbnutshell/usb4.shtml

Colin Smith
  • 12,375
  • 4
  • 39
  • 47
1

Disclaimer: I'm not very familiar with the USB protocol myself.

There's a few places in USB where the '0x40' could be:

The libusb_speed enum uses '4' to represent the highest speed possible:

https://www.cs.unm.edu/~hjelmn/libusb_hotplug_api/group__dev.html#ga2959abf1184f87b2ce06fe90db6ce614

Also, the bmRequestType (that gets included in a USB packet) is 0x40 if you're sending an outgoing packet: https://www.beyondlogic.org/usbnutshell/usb6.shtml

(1 in the first bit, with all 0s, converts to 64 or 0x40)

Raleigh L.
  • 599
  • 2
  • 13
  • 18