USBHound驱动开发笔记
UVC摄像头BUSHOUND抓包与UBSHOUND抓包所在的层次
2022-08-15
250
0
USBHOUND为USBCCGP.SYS的下层过滤驱动程序。
当上层USBVIDEO.SYS下发UVC特定类请求时，设备栈如下：
# Child-SP RetAddr Call Site
00 ffffcc81`0f567d40 fffff801`0c701ce8 USBHound!UsbUrbFilter+0x56 [F:\USBHound\USBHound\usb.c @ 293]
01 ffffcc81`0f567db0 fffff801`0c703285 USBHound!FilterDispatchIo+0x1a8 [F:\USBHound\USBHound\filter.c @ 83]
02 ffffcc81`0f567e20 fffff801`07b1169e USBHound!DispatchIo+0x35 [F:\USBHound\USBHound\usbzh.c @ 72]
03 ffffcc81`0f567e60 fffff801`07b114d4 usbccgp!DispatchPdoUrb+0x16e
04 ffffcc81`0f567f80 fffff801`07b111b1 usbccgp!DispatchPdoInternalDeviceControl+0x84
05 ffffcc81`0f567fe0 fffff801`052e27c9 usbccgp!USBC_Dispatch+0x1b1
06 ffffcc81`0f5680a0 fffff801`052e2ead bhound7+0x27c9
07 ffffcc81`0f5680d0 fffff801`052e288f bhound7+0x2ead
08 ffffcc81`0f568100 fffff801`075b456f bhound7+0x288f
09 ffffcc81`0f568130 fffff801`075b471f usbvideo!USBVideoCallUSBD+0xd7
0a ffffcc81`0f5681d0 fffff801`075b484c usbvideo!SubmitUSBVideoClassRequest+0xf7
0b ffffcc81`0f568210 fffff801`075badc2 usbvideo!GetSetInterfaceControl+0xec
0c ffffcc81`0f5682a0 fffff801`075bc326 usbvideo!NegotiateVideoStreamParameters+0xa6
0d ffffcc81`0f568300 fffff801`09315911 usbvideo!USBVideoPinCreate+0x566
0e ffffcc81`0f5683d0 fffff801`093306f7 ks!KspCreate+0x131
0f ffffcc81`0f568430 fffff801`09333f0b ks!CKsPin::Init+0x5db
10 ffffcc81`0f568520 fffff801`0932a8c6 ks!KspCreatePin+0x107
11 ffffcc81`0f5685a0 fffff801`09313047 ks!CKsFilter::DispatchCreatePin+0x136
12 ffffcc81`0f568610 fffff801`09312e99 ks!DispatchCreate+0x147
13 ffffcc81`0f568670 fffff801`0d701523 ks!CKsDevice::DispatchCreate+0xc9
14 ffffcc81`0f5686c0 fffff801`10cac9ff ksthunk!CKernelFilterDevice::DispatchIrp+0x16b
15 ffffcc81`0f568720 fffff801`10c4bacb nt!IopParseDevice+0x168f
16 ffffcc81`0f568910 fffff801`10cc01bf nt!IopParseFile+0xc7
17 ffffcc81`0f568980 fffff801`10cf499d nt!ObpLookupObjectName+0x8af
18 ffffcc81`0f568b50 fffff801`10d14bb0 nt!ObOpenObjectByNameEx+0x1dd
19 ffffcc81`0f568c90 fffff801`10d14339 nt!IopCreateFile+0x860
1a ffffcc81`0f568d40 fffff801`10985703 nt!NtCreateFile+0x79
1b ffffcc81`0f568dd0 00007ffc`155d65b4 nt!KiSystemServiceCopyEnd+0x13
HID人机交互QQ群：564808376
UAC音频QQ群：218581009
UVC相机QQ群：331552032
BOT&UASP大容量存储QQ群：258159197
STC-USB单片机QQ群：315457461
USB技术交流QQ群2:580684376
USB技术交流QQ群：952873936
