[Acer Iconia A500] eppeP:
Using Windows Driver Kit 7.1.0 and largely based on the examples in How to Access a USB Device by Using WinUSB Functions this works with the driver provided in Acer's download.

It should be cleaned up a bit, but I have had enough of windows for today.

#include "stdafx.h"

#include <windows.h>
#include <stdio.h>
#include <tchar.h>
#include <strsafe.h>

#include <winusb.h>
#include <Usb100.h>
#include <Setupapi.h>

// Linked libraries
#pragma comment (lib , "setupapi.lib" )
#pragma comment (lib , "winusb.lib" )

BOOL GetDeviceHandle (GUID guidDeviceInterface, PHANDLE hDeviceHandle)
{
if (guidDeviceInterface==GUID_NULL)
{
return FALSE;
}

BOOL bResult = TRUE;
HDEVINFO hDeviceInfo;
SP_DEVINFO_DATA DeviceInfoData;

SP_DEVICE_INTERFACE_DATA deviceInterfaceData;
PSP_DEVICE_INTERFACE_DETAIL_DATA pInterfaceDetailData = NULL;

ULONG requiredLength=0;
LPTSTR lpDevicePath = NULL;
DWORD index = 0;

// Get information about all the installed devices for the specified
// device interface class.
hDeviceInfo = SetupDiGetClassDevs(&guidDeviceInterface, NULL, NULL, DIGCF_PRESENT | DIGCF_DEVICEINTERFACE);
if (hDeviceInfo == INVALID_HANDLE_VALUE)
{
// ERROR
printf("Error SetupDiGetClassDevs: %d.\n", GetLastError());
goto done;
}

//Enumerate all the device interfaces in the device information set.
DeviceInfoData.cbSize = sizeof(SP_DEVINFO_DATA);

for (index = 0; SetupDiEnumDeviceInfo(hDeviceInfo, index, &DeviceInfoData); index++)
{
//Reset for this iteration
if (lpDevicePath)
{
LocalFree(lpDevicePath);
}
if (pInterfaceDetailData)
{
LocalFree(pInterfaceDetailData);
}

deviceInterfaceData.cbSize = sizeof(SP_INTERFACE_DEVICE_DATA);

//Get information about the device interface.
bResult = SetupDiEnumDeviceInterfaces(hDeviceInfo, &DeviceInfoData, &guidDeviceInterface, 0, &deviceInterfaceData);

// Check if last item
if (GetLastError () == ERROR_NO_MORE_ITEMS)
{
break;
}

//Check for some other error
if (!bResult)
{
printf("Error SetupDiEnumDeviceInterfaces: %d.\n", GetLastError());
goto done;
}

//Interface data is returned in SP_DEVICE_INTERFACE_DETAIL_DATA
//which we need to allocate, so we have to call this function twice.
//First to get the size so that we know how much to allocate
//Second, the actual call with the allocated buffer

bResult = SetupDiGetDeviceInterfaceDetail(hDeviceInfo, &deviceInterfaceData, NULL, 0, &requiredLength, NULL);
//Check for some other error
if (!bResult)
{
if ((ERROR_INSUFFICIENT_BUFFER==GetLastError()) && (requiredLength>0))
{
//we got the size, allocate buffer
pInterfaceDetailData = (PSP_DEVICE_INTERFACE_DETAIL_DATA)LocalAlloc(LPTR, requiredLength);

if (!pInterfaceDetailData)
{
// ERROR
printf("Error allocating memory for the device detail buffer.\n");
goto done;
}
}
else
{
printf("Error SetupDiEnumDeviceInterfaces: %d.\n", GetLastError());
goto done;
}
}

//get the interface detailed data
pInterfaceDetailData->cbSize = sizeof(SP_DEVICE_INTERFACE_DETAIL_DATA);

//Now call it with the correct size and allocated buffer
bResult = SetupDiGetDeviceInterfaceDetail(
hDeviceInfo,
&deviceInterfaceData,
pInterfaceDetailData,
requiredLength,
NULL,
&DeviceInfoData);

//Check for some other error
if (!bResult)
{
printf("Error SetupDiGetDeviceInterfaceDetail: %d.\n", GetLastError());
goto done;
}

//copy device path
size_t nLength = wcslen (pInterfaceDetailData->DevicePath) + 1;
lpDevicePath = (TCHAR *) LocalAlloc (LPTR, nLength * sizeof(TCHAR));
StringCchCopy(lpDevicePath, nLength, pInterfaceDetailData->DevicePath);
lpDevicePath[nLength-1] = 0;

printf("Device path: %s\n", lpDevicePath);
}

if (!lpDevicePath)
{
//Error.
printf("Error %d.\n", GetLastError());
goto done;
}

//Open the device
*hDeviceHandle = CreateFile (
lpDevicePath,
GENERIC_READ | GENERIC_WRITE,
FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL,
OPEN_EXISTING,
FILE_FLAG_OVERLAPPED,
NULL);

if (*hDeviceHandle == INVALID_HANDLE_VALUE)
{
//Error.
printf("Error %d.\n", GetLastError());
goto done;
}

done:
LocalFree(lpDevicePath);
LocalFree(pInterfaceDetailData);
bResult = SetupDiDestroyDeviceInfoList(hDeviceInfo);

return (*hDeviceHandle != INVALID_HANDLE_VALUE);
}

int _tmain(int argc, _TCHAR* argv[])
{
HANDLE hDeviceHandle = INVALID_HANDLE_VALUE;
WINUSB_INTERFACE_HANDLE hWinUSBHandle = INVALID_HANDLE_VALUE;

//Acer Picasso USB Boot-recovery driver GUID
static const GUID APX_DRIVER = { 0xEAD8C4F6, 0x6102, 0x45c7, { 0xAA,0x66, 0x36, 0xE6, 0xD7, 0x20, 0x46, 0x00 } };

if(GetDeviceHandle(APX_DRIVER, &hDeviceHandle))
{
printf("Got device handle.\n");
if(WinUsb_Initialize(hDeviceHandle, &hWinUSBHandle))
{
printf("Got WinUSB handle.\n");

//Set timeout to 1s, default is wait forever...
ULONG theUsbReadTimeout = 1000;
WinUsb_SetPipePolicy(hWinUSBHandle, 0x81, PIPE_TRANSFER_TIMEOUT, sizeof(theUsbReadTimeout), &theUsbReadTimeout);

printf("Attempting to read UID...\n");
ULONG cbRead = 0;
UCHAR theUID[8];
if(WinUsb_ReadPipe(hWinUSBHandle, 0x81, theUID, 8, &cbRead, 0))
{
printf("UID: 0x%08X%08X\n", *((int*)theUID+1), *((int*)theUID+0));
}
else
{
printf("Failed to read UID.\n");
}
}
else
{
printf("WinUsb_Initialize Error %d.", GetLastError());
}
}
else
{
printf("Failed to get device handle: %d\n", GetLastError());
}
if(hDeviceHandle != INVALID_HANDLE_VALUE)
CloseHandle(hDeviceHandle);
if(hWinUSBHandle != INVALID_HANDLE_VALUE)
WinUsb_Free(hWinUSBHandle);
fgetc(stdin);
return 0;
}

Edit:

I made it into a dll with a C# GUI, the code is in the apxuid_winusb directory in the apxuid repository.

A snapshot can be found here.