Libusb-v1 (linux) && URB_CONTROL_VENDOR_OR_CLASS_REQUEST - Page 1
Forum section: electronics / general

author: DiTBho
author_rank: Super Contributor
timestamp: June 12, 2022, 11:47:43 pm
content: I am reverse engineering a USB device on a Windows XP machine with USBtrace-v3And on the USB-packet sniffer I see a lot of transfers like thisCode:URB_FUNCTION_VENDOR_DEVICELength: 0x50USBD Status: USBD_STATUS_UNKNOWN (0x8861FC88)TransferFlags: 0x0 ( USBD_TRANSFER_DIRECTION_OUT )TransferBufferLength: 0x26TransferBuffer: 0xBA50F904TransferBufferMDL: 0x0UrbLink: 0x0RequestTypeReservedBits: 0x0Request: 0xA0Value: 0x240AIndex: 0x0** Data **C1 0A C1 0B C1 0C 01 14 00 01 11 00 C1 09 01 0A 00 02 15 00 00 C1 0D 02 0B 00 00 01 17 00 ...(host to device, send FPGA firmware, max 64 byte per packet)URB_FUNCTION_VENDOR_DEVICE means_URB_CONTROL_VENDOR_OR_CLASS_REQUEST, which uses a special structure to issue a vendor or class-specific command to a device, interface, endpoint, or other device-defined target.Code:struct _URB_CONTROL_VENDOR_OR_CLASS_REQUEST{struct _URB_HEADER Hdr;PVOID Reserved;ULONG TransferFlags;ULONG TransferBufferLength;PVOID TransferBuffer;PMDL TransferBufferMDL;struct _URB *UrbLink;struct _URB_HCD_AREA hca;UCHAR RequestTypeReservedBits;UCHAR Request;USHORT Value;USHORT Index;USHORT Reserved1;};(I see this struct reported by USBsnif v3)On Linux, with libusb I only have these functions/** USB SYNCHRONOUS I/O* ====================** int libusb_control_transfer* int libusb_bulk_transfer* int libusb_interrupt_transfer*/Once programmed by the Windows XP driver, I can uselibusb_control_transferto monitor the device, and it works great, unfortunately it seems the USB-target can only receive the FPGA firmware via URB_CONTROL_VENDOR_OR_CLASS_REQUEST, and I don't know how to replicate it.Any hints?

author: SiliconWizard
author_rank: Super Contributor
timestamp: June 12, 2022, 11:50:45 pm
content: Would the device happen to use a Cypress FX1 or FX2 for USB interfacing?

author: DiTBho
author_rank: Super Contributor
timestamp: June 12, 2022, 11:53:34 pm
content: I forgot to tell:- I plug the USB-device into a Window-XP laptop- the Windows XP laptop sends the firmware to the FPGA- The USB-device gets programmed- The USB-device is powered by a 5V adapter- so you can unplug and move to a Linux laptop without loosing its setupI am already able to monitor its USB protocol in run mode by issuing specific packets created with libusb_control_transfer.

author: DiTBho
author_rank: Super Contributor
timestamp: June 12, 2022, 11:54:41 pm
content: Quote from: SiliconWizard on June 12, 2022, 11:50:45 pmit's something weird, based onInfineon-CY7C68013A

author: SiliconWizard
author_rank: Super Contributor
timestamp: June 13, 2022, 01:00:52 am
content: Quote from: DiTBho on June 12, 2022, 11:54:41 pmIt's not weird. Infineon bought Cypress. But this part is indeed a Cypress FX2LP as I suspected.

author: gslick
author_rank: Frequent Contributor
timestamp: June 13, 2022, 02:46:50 am
content: Quote from: DiTBho on June 12, 2022, 11:47:43 pmIn Windows these URB Functions all use the _URB_CONTROL_VENDOR_OR_CLASS_REQUEST data structure:URB_FUNCTION_VENDOR_DEVICEURB_FUNCTION_VENDOR_INTERFACEURB_FUNCTION_VENDOR_ENDPOINTURB_FUNCTION_VENDOR_OTHERURB_FUNCTION_CLASS_DEVICEURB_FUNCTION_CLASS_INTERFACEURB_FUNCTION_CLASS_ENDPOINTURB_FUNCTION_CLASS_OTHERThe only difference between these URB function is the values of the Type and Recipient bit fields that get set in the bmRequestType of the Control transfer Setup packet.Code:Universal Serial Bus Specification Revision 2.09.3 USB Device RequestsTable 9-2. Format of Setup DatabmRequestType:D7:Data transfer direction0 = Host-to-device1 = Device-to-hostD6...5: Type0 = Standard1 = Class2 = Vendor3 = ReservedD4...0: Recipient0 = Device1 = Interface2 = Endpoint3 = OtherIf the libusb_control_transfer() function lets you specify whatever value you want for the bmRequestType byte of a Control transfer Setup packet, then you can map those URB Functions listed above from your packet sniffing trace into libusb_control_transfer() function calls with the appropriate bmRequestType Type and Recipient bit fields.For example, URB_FUNCTION_VENDOR_DEVICE:bmRequestType: D6...5 Type = 2 (Vendor); D4...0: Recipient = 0 (Device)For USBD_TRANSFER_DIRECTION_OUT:bmRequestType: D7: 0For USBD_TRANSFER_DIRECTION_IN:bmRequestType: D7: 1I have never used libusb and know nothing about it. 10 years ago I used to know almost everything there was to know about Windows USB device drivers when that was my day job for 15 years. I've forgotten a lot of it by now.