Just an update on using TraceView to log internal messages put out by usbhub3.sys when connecting a usb stick as an example.
Code:
HUBHTX_Get20PortChangeEvent: PORT_STATUS_ERROR / HubHwVerifierPortDeviceDisconnected event: PortConnectChange & CCS=0; portNum 1, prevPS 0x0101, curPS 0x0100, curPC 0x0001
HUBHTX_Get20PortChangeEvent: Called HubHwVerifierPortDeviceDisconnected
Device Context 0xFFFFD00E5F713110 - USB\VID_0951&PID_1646&REV_0100 - Port Path 1:4:1:0:0:0
DeviceHackFlags:0x8
Nothing earth shattering, but it does at least lead to a function in usbhub3.sys code in IDA when you also load the PDB from MS:
Code:
.text:00000001C0004218 HUBHTX_Get20PortChangeEvent proc near ; CODE XREF: HUBPSM20_EnablingInterruptsAndGettingPortEvent+14
.text:00000001C0004218 ; HUBPSM20_GettingPortChangeEventInSuspended+B
.text:00000001C0004218
....
.text:00000001C0004218 4C 8B DC mov r11, rsp
.text:00000001C000421B 49 89 5B 08 mov [r11+8], rbx
I'm using TraceView from an older WDK version but it seems to work OK. If you don't have it and don't want to install the full WDK, you can extract it from the iso (620MB) from here - GRMWDK_EN_7600_1\WDK\tracingtool_x64fre_cab001.cab
https://www.microsoft.com/en-ca/download/details.aspx?id=11800
...
I was going to ask you about the C220/C610 driver and wondered how it differed from the one you had. What defines "chipset support" when the general function of these drivers must be fairly similar?
Bookmarks