USBPcap抓包格式说明

USBPcap是一个开源的USB数据包抓取工具。本文旨在说明USBPcap抓取的USB数据包的数据格式。

基本数据类型

USBPcap程序中使用到了一些基本的数据类型，如下：

UCHAR   - 8 bit unsigned value
USHORT  - 16 bit unsigned value
UINT32  - 32 bit unsigned value
UINT64  - 64 bit unsigned value
ULONG   - 64 bit unsigned value
USBD_STATUS - 32 bit unsigned value

需要注意的是，USB传输的数据都是小端序的，对于多字节数据，需要从右往左读取。

基础数据包头

USB数据包的传输类型有：控制传输、中断传输、同步传输、批量传输。

对于不同的传输类型，USBPcap有不同的数据包头与之对应；但这些数据包头中包含共同的基本数据包头。下面是基础数据包头的定义：

#pragma pack(1)
typedef struct
{
    USHORT       headerLen; /* This header length */
    UINT64       irpId;     /* I/O Request packet ID */
    USBD_STATUS  status;    /* USB status code (on return from host controller) */
    USHORT       function;  /* URB Function */
    UCHAR        info;      /* I/O Request info */

    USHORT       bus;       /* bus (RootHub) number */
    USHORT       device;    /* device address */
    UCHAR        endpoint;  /* endpoint number and transfer direction */
    UCHAR        transfer;  /* transfer type */

    UINT32       dataLength;/* Data length */
} USBPCAP_BUFFER_PACKET_HEADER, *PUSBPCAP_BUFFER_PACKET_HEADER;

传输类型数据包头（transfer-specific header）

所有的传输类型数据包头都继承了基础数据包头，并处于传输类型数据包头的起始位置；接下来是传输类型特有的存储在数据包头里的数据（如果有的话）；最后是传输的数据。

传输类型定义如下：

#define USBPCAP_TRANSFER_ISOCHRONOUS    0    /* 同步传输 */
#define USBPCAP_TRANSFER_INTERRUPT      1    /* 中断传输 */
#define USBPCAP_TRANSFER_CONTROL        2    /* 控制传输 */
#define USBPCAP_TRANSFER_BULK           3    /* 批量传输 */

下面来看下这些不同传输类型的USBPcap数据包头的定义。

同步传输数据包头（USBPCAP_TRANSFER_ISOCHRONOUS）

对应于同步传输的数据包头的数据类型为USBPCAP_BUFFER_ISOCH_HEADER，定义如下：

/* Note about isochronous packets:
 *   packet[x].length, packet[x].status and errorCount are only relevant
 *   when USBPCAP_INFO_PDO_TO_FDO is set
 *
 *   packet[x].length is not used for isochronous OUT transfers.
 *
 * Buffer data is attached to:
 *   * for isochronous OUT transactions (write to device)
 *       Requests (USBPCAP_INFO_PDO_TO_FDO is not set)
 *   * for isochronous IN transactions (read from device)
 *       Responses (USBPCAP_INFO_PDO_TO_FDO is set)
 */
#pragma pack(1)
typedef struct
{
    ULONG        offset;
    ULONG        length;
    USBD_STATUS  status;
} USBPCAP_BUFFER_ISO_PACKET, *PUSBPCAP_BUFFER_ISO_PACKET;

#pragma pack(1)
typedef struct
{
    USBPCAP_BUFFER_PACKET_HEADER  header;
    ULONG                         startFrame;
    ULONG                         numberOfPackets;
    ULONG                         errorCount;
    USBPCAP_BUFFER_ISO_PACKET     packet[1];
} USBPCAP_BUFFER_ISOCH_HEADER, *PUSBPCAP_BUFFER_ISOCH_HEADER;

中断传输数据包头（USBPCAP_TRANSFER_INTERRUPT）

对应于中断传输的数据包头的数据类型恰恰为USBPCAP_BUFFER_PACKET_HEADER，没有额外字段。

控制传输数据包头（USBPCAP_TRANSFER_CONTROL）

对应于控制传输的数据包头的数据类型为USBPCAP_BUFFER_CONTROL_HEADER，定义如下：

/* USBPcap versions before 1.5.0.0 recorded control transactions as two
 * or three pcap packets:
 *   * USBPCAP_CONTROL_STAGE_SETUP with 8 bytes USB SETUP data
 *   * Optional USBPCAP_CONTROL_STAGE_DATA with either DATA OUT or IN
 *   * USBPCAP_CONTROL_STAGE_STATUS without data on IRP completion
 *
 * Such capture was considered unnecessary complex. Due to that, since
 * USBPcap 1.5.0.0, the control transactions are recorded as two packets:
 *   * USBPCAP_CONTROL_STAGE_SETUP with 8 bytes USB SETUP data and
 *     optional DATA OUT
 *   * USBPCAP_CONTROL_STAGE_COMPLETE without payload or with the DATA IN
 *
 * The merit behind this change was that Wireshark dissector, since the
 * very first time when Wireshark understood USBPcap format, was really
 * expecting the USBPCAP_CONTROL_STAGE_SETUP to contain SETUP + DATA OUT.
 * Even if Wireshark version doesn't recognize USBPCAP_CONTROL_STAGE_COMPLETE
 * it will still process the payload correctly.
 */
#define USBPCAP_CONTROL_STAGE_SETUP    0
#define USBPCAP_CONTROL_STAGE_DATA     1
#define USBPCAP_CONTROL_STAGE_STATUS   2
#define USBPCAP_CONTROL_STAGE_COMPLETE 3

#pragma pack(1)
typedef struct
{
    USBPCAP_BUFFER_PACKET_HEADER  header;
    UCHAR                         stage;　　/* Determines the control transfer stage */
} USBPCAP_BUFFER_CONTROL_HEADER, *PUSBPCAP_BUFFER_CONTROL_HEADER;

批量传输数据包头（USBPCAP_TRANSFER_BULK）

对应于批量传输的数据包头的数据类型恰恰为USBPCAP_BUFFER_PACKET_HEADER，没有额外字段。

原文地址：https://desowin.org/usbpcap/captureformat.html