第三十六篇-WinUSB调试实例

seo靠我 2023-09-23 11:40:33

有人问，前面的博文，分别列出了USB xHCI, USB3 HUB, UCX01000的符号有什么用？

答案是，虽然我们不能看到MICROSOFT 的源代码，但通过这些符号，可以帮助我们调试USB子系统SEO靠我。

下面给出一例：

做USB设备驱动这些年，用过Cypress的USB3.0驱动，改过Philips USB1.1, Cypress USB2.0的驱动代码，开发了基于Microsoft USBSampSEO靠我的USB IP测试软件包。

最近，又借助WinUSB来完成一个音视频设备项目。

使用WinUSB的优点是显而易见的，可以将设备驱动软件开发的时间与精力专注于产品的特色处（例如这个项目中的视频方面），而由WSEO靠我inUSB提供了稳定的USB相关功能。

先列出WinUSB的符号：

0: kd> lm vm winusb

start end module nameSEO靠我

fffff800`caab5000 fffff800`caace000 WinUSB (pdb symbols) c:\e\symcache\winusb.pdb\661SEO靠我781CAB404408B9E1DAE81C370764D1\winusb.pdb

Loaded symbol image file: WinUSB.sys

Image path: WinUSB.sys

ISEO靠我mage name: WinUSB.sys

Timestamp: Thu Aug 22 19:37:55 2013 (5215F813)

CheckSum: 0001CA4CSEO靠我

ImageSize: 00019000

Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4

0: kd> x winusb!*SEO靠我

fffff800`caac3f40 WinUSB!WdfDriverGlobals =

fffff800`caab6b10 WinUSB!WPP_RECORDER_SF_did ()

fffff800`cSEO靠我aac20c0 WinUSB!_imp_ExAcquireFastMutexUnsafe =

fffff800`caaca320 WinUSB! ?? ::NNGAKEGL::`string ()

fffSEO靠我ff800`caab65dc WinUSB!WppClassicProviderCallback ()

fffff800`caaca490 WinUSB! ?? ::NNGAKEGL::`string SEO靠我()

fffff800`caab84b0 WinUSB!WinUsb_GetPipePolicy ()

fffff800`caac9e70 WinUSB!WinUSB_SelectConfiguratioSEO靠我n ()

fffff800`caab6a44 WinUSB!WPP_RECORDER_SF_di ()

fffff800`caaba0e4 WinUSB!WinUSB_IncrementKeepAliveSEO靠我Count ()

fffff800`caac3008 WinUSB!_security_cookie_complement =

fffff800`caac60f8 WinUSB!WppTraceCallbSEO靠我ack ()

fffff800`caac2038 WinUSB!_imp_WdfVersionUnbindClass =

fffff800`caab9a70 WinUSB!WinUSB_ExchangeVSEO靠我ersion ()

fffff800`caabfa94 WinUSB!WinUSB_ChildIsochTransferComplete ()

fffff800`caabe05c WinUSB!WinUSSEO靠我B_EvtWriteIoResume ()

fffff800`caac2170 WinUSB!_imp_RtlInitUnicodeString =

fffff800`caac01d0 WinUSB!WiSEO靠我nUSB_IsochPurgeComplete ()

fffff800`caac14d4 WinUSB!WinUSB_SetupIsochUrb ()

fffff800`caabbb04 WinUSB!WSEO靠我inUSB_ReadPipeCompletion ()

fffff800`caac88e8 WinUSB!WinUSB_SetDeviceInterfaceProperties ()

fffff800`cSEO靠我aac3170 WinUSB!__KMDF_TYPE_INIT_END =

fffff800`caac1ec0 WinUSB! ?? ::FNODOBFM::`string ()

fffff800`caaSEO靠我c7e20 WinUSB!WinUSB_PrepareHardware ()

fffff800`caaba194 WinUSB!WPP_RECORDER_SF_dDdd ()

fffff800`caacbSEO靠我3c8 WinUSB!_IMPORT_DESCRIPTOR_HAL =

fffff800`caab98f4 WinUSB!WinUSB_QueryDeviceInformation ()

fffff800SEO靠我`caac23b0 WinUSB!WPP_272e0b4692370df708b7a2b9a6c27a83_Traceguids =

fffff800`caabd510 WinUSB!WinUSB_WrSEO靠我itePipeCompletion ()

fffff800`caac1f00 WinUSB! ?? ::FNODOBFM::`string ()

fffff800`caac20a8 WinUSB!_impSEO靠我__wcsnicmp =

fffff800`caac2070 WinUSB!WppRecorder_NULL_THUNK_DATA =

fffff800`caac1784 WinUSB!FxStubDrSEO靠我iverMiniportUnload ()

fffff800`caabc5a8 WinUSB!WinUSB_RawIoRead ()

fffff800`caac2160 WinUSB!_imp_MmGetSEO靠我SystemRoutineAddress =

fffff800`caacb404 WinUSB!_IMPORT_DESCRIPTOR_WDFLDR =

fffff800`caac7274 WinUSB!WSEO靠我inUSB_Create ()

fffff800`caac2110 WinUSB!_imp_KeInitializeSpinLock =

fffff800`caabab88 WinUSB!WinUSB_SSEO靠我etInterface ()

fffff800`caac23c0 WinUSB!WPP_7e587b8b4c5e1652d25e8f85ef570329_Traceguids =

fffff800`caaSEO靠我c22c8 WinUSB!DEVPKEY_Winusb_Device_VID =

fffff800`caabcbc4 WinUSB!WinUSB_SubmitRead ()

fffff800`caac20SEO靠我20 WinUSB!_imp_USBD_ParseDescriptors =

fffff800`caac8840 WinUSB!WinUSB_QueryStop ()

fffff800`caac20c8 SEO靠我WinUSB!_imp_KeWaitForSingleObject =

fffff800`caac2168 WinUSB!_imp_KeReleaseSpinLock =

fffff800`caaba5bSEO靠我c WinUSB!WinUSB_InitPipe ()

fffff800`caac22b0 WinUSB!DEVPKEY_Winusb_Device_PID =

fffff800`caabdfa8 WinSEO靠我USB!WinUSB_EvtWriteIoStop ()

fffff800`caaca2a0 WinUSB! ?? ::NNGAKEGL::`string ()

fffff800`caac8130 WinSEO靠我USB!WinUSB_SelfManagedIoInit ()

fffff800`caac41d0 WinUSB!g_pIoSetActivityIdIrp =

fffff800`caac0d10 WinSEO靠我USB!WinUSB_InitializeParentRequest ()

fffff800`caac2018 WinUSB!_imp_USBD_ParseConfigurationDescriptorSEO靠我Ex =

fffff800`caabe2cc WinUSB!WinUSB_InitIsochPipe ()

fffff800`caaca240 WinUSB! ?? ::NNGAKEGL::`stringSEO靠我 ()

fffff800`caac2390 WinUSB!WPP_d8eea9561f2d10664565e8078ca0c91c_Traceguids =

fffff800`caac1a80 WinUSSEO靠我B!memcpy ()

fffff800`caab6d4c WinUSB!WinUSB_DeviceControl ()

fffff800`caab6ccc WinUSB!WinUSB_QueueStatSEO靠我eChangeComplete ()

fffff800`caab9144 WinUSB!WinUSB_SetPowerPolicy ()

fffff800`caac77b4 WinUSB!WinUSB_GSEO靠我etRegParams ()

fffff800`caac3190 WinUSB!pfnWppGetVersion =

fffff800`caaca570 WinUSB! ?? ::NNGAKEGL::`sSEO靠我tring ()

fffff800`caac1f30 WinUSB! ?? ::FNODOBFM::`string ()

fffff800`caaba434 WinUSB!WinUSB_FreePipe SEO靠我()

fffff800`caac9098 WinUSB!WinUSB_ResetPipe ()

fffff800`caac1a80 WinUSB!memmove ()

fffff800`caabe474 WSEO靠我inUSB!WinUSB_IsochBufferDeviceControl ()

fffff800`caabc2ec WinUSB!WinUSB_ReadPipe ()

fffff800`caabd2d0SEO靠我 WinUSB!WinUSB_CancelRead ()

fffff800`caac2148 WinUSB!_imp_RtlCopyUnicodeString =

fffff800`caaca2d0 WiSEO靠我nUSB! ?? ::NNGAKEGL::`string ()

fffff800`caac19f8 WinUSB!_GSHandlerCheckCommon ()

fffff800`caabe5bc WiSEO靠我nUSB!WinUSB_FreeIsochPipe ()

fffff800`caac9d0c WinUSB!WinUSB_GetConfigurationDescriptor ()

fffff800`caSEO靠我ac4180 WinUSB!WPP_MAIN_CB =

fffff800`caacb2e0 WinUSB! ?? ::PBOPGDP::`string ()

fffff800`caab8050 WinUSSEO靠我B!WinUSB_SetPipePolicy ()

fffff800`caac0e74 WinUSB!WinUSB_SubmitChildIsochTransfer ()

fffff800`caac205SEO靠我0 WinUSB!WDFLDR_NULL_THUNK_DATA =

fffff800`caac2140 WinUSB!_imp_ExReleaseFastMutexUnsafe =

fffff800`cSEO靠我aac64f8 WinUSB!WinUSB_AddDevice ()

fffff800`caac9868 WinUSB!WinUSB_ResetPort ()

fffff800`caac8e7c WinUSEO靠我SB!WinUsb_IsUpperFilterPresent ()

fffff800`caac3140 WinUSB!__KMDF_CLASS_BIND_START =

fffff800`caac2078SEO靠我 WinUSB!_imp_ExAllocatePoolWithTag =

fffff800`caaca4e0 WinUSB! ?? ::NNGAKEGL::`string ()

fffff800`caacSEO靠我20d8 WinUSB!_imp_IoBuildPartialMdl =

fffff800`caac31b0 WinUSB!pfnWppQueryTraceInformation =

fffff800`cSEO靠我aac1308 WinUSB!WinUSB_SubmitIsochTransfer ()

fffff800`caacb3f0 WinUSB!_IMPORT_DESCRIPTOR_WppRecorder SEO靠我=

fffff800`caac2258 WinUSB!DEVPKEY_Device_Service =

fffff800`caac17b8 WinUSB!FxDriverEntryWorker ()

fffSEO靠我ff800`caabc9fc WinUSB!WinUSB_CreateActivityIdSubRequest ()

fffff800`caab7bd8 WinUSB!WinUSB_SelectAltSSEO靠我etting ()

fffff800`caac2128 WinUSB!_imp_ExFreePool =

fffff800`caac9a84 WinUSB!WinUSB_CyclePort ()

fffffSEO靠我800`caac2130 WinUSB!_imp_KeLeaveCriticalRegion =

fffff800`caaca380 WinUSB! ?? ::NNGAKEGL::`string ()

fSEO靠我ffff800`caac19d8 WinUSB!_GSHandlerCheck ()

fffff800`caaca0b0 WinUSB!WinUSB_ResetDevice ()

fffff800`caaSEO靠我c2138 WinUSB!_imp_IoAllocateMdl =

fffff800`caac30d8 WinUSB!WDF_WORKITEM_CONTEXT_TYPE_INFO =

fffff800`cSEO靠我aac22e0 WinUSB!DEVPKEY_Winusb_Device_SubClass =

fffff800`caac3010 WinUSB!WDF_ISOCH_REQUEST_CONTEXT_TYSEO靠我PE_INFO =

fffff800`caac3198 WinUSB!pfnEtwRegisterClassicProvider =

fffff800`caac2310 WinUSB!DEVPKEY_WiSEO靠我nusb_Device_Class =

fffff800`caac2120 WinUSB!_imp_RtlGetVersion =

fffff800`caac41f8 WinUSB!__PchSym_ =SEO靠我

fffff800`caabf450 WinUSB!WinUSB_IsochQueueReadyNotification ()

fffff800`caac2370 WinUSB!WPP_01fecbf68SEO靠我877b6edf8ae50552383ce55_Traceguids =

fffff800`caac41d8 WinUSB!g_pIoGetActivityIdIrp =

fffff800`caac202SEO靠我8 WinUSB!USBD_NULL_THUNK_DATA =

fffff800`caab9424 WinUSB!WinUsb_GetPowerPolicy ()

fffff800`caac41f0 WSEO靠我inUSB!g_pIoDecrementKeepAliveCount =

fffff800`caaca300 WinUSB! ?? ::NNGAKEGL::`string ()

fffff800`caacSEO靠我31a0 WinUSB!pfnEtwUnregister =

fffff800`caac2340 WinUSB!TestGuid =

fffff800`caab660c WinUSB!RtlStringCSEO靠我bPrintfW ()

fffff800`caab7e90 WinUSB!WinUsb_GetAltSetting ()

fffff800`caac2040 WinUSB!_imp_WdfVersionUSEO靠我nbind =

fffff800`caabe914 WinUSB!WinUSB_RegisterIsochBuffer ()

fffff800`caaca1a0 WinUSB! ?? ::NNGAKEGLSEO靠我::`string ()

fffff800`caac2088 WinUSB!_imp_IoGetDevicePropertyData =

fffff800`caaca590 WinUSB! ?? ::NNSEO靠我GAKEGL::`string ()

fffff800`caac2000 WinUSB!_guard_check_icall_fptr =

fffff800`caaba350 WinUSB!WPP_RECSEO靠我ORDER_SF_dqq ()

fffff800`caac22f8 WinUSB!DEVPKEY_Winusb_Device_Custom_Interface_GUIDs =

fffff800`caac8SEO靠我0c0 WinUSB!WinUSB_ReleaseHardware ()

fffff800`caab64c4 WinUSB!WPP_RECORDER_SF_qq ()

fffff800`caac2030 SEO靠我WinUSB!_imp_WdfVersionBind =

fffff800`caac74bc WinUSB!WinUSB_Cleanup ()

fffff800`caaba290 WinUSB!WPP_RSEO靠我ECORDER_SF_dq ()

fffff800`caabae54 WinUSB!WinUSB_IsInterruptOrBulkInPipe ()

fffff800`caabdbf0 WinUSB!WSEO靠我inUSB_SubmitWrite ()

fffff800`caaca3c0 WinUSB! ?? ::NNGAKEGL::`string ()

fffff800`caabf114 WinUSB!WinUSEO靠我SB_AllocateIsochChildRequests ()

fffff800`caabe1a4 WinUSB!WPP_RECORDER_SF_qlldd ()

fffff800`caacb310 WSEO靠我inUSB! ?? ::PBOPGDP::`string ()

fffff800`caac3100 WinUSB!WPP_GLOBAL_Control =

fffff800`caac30b0 WinUSBSEO靠我!WDF_ISOCH_REQUEST_WITH_CHILD_CONTEXT_TYPE_INFO =

fffff800`caac20d0 WinUSB!_imp_IoSetDeviceInterfacePSEO靠我ropertyData =

fffff800`caabf35c WinUSB!WinUSB_DispatchIsochRequests ()

fffff800`caac7cd8 WinUSB!WinUSBSEO靠我_UpdateSqmInfo ()

fffff800`caab7808 WinUSB!WinUSB_GetDescriptor ()

fffff800`caab8bb8 WinUSB!WinUSB_ConSEO靠我trolTransfer ()

fffff800`caab6000 WinUSB!WPP_RECORDER_SF_ ()

fffff800`caac23a0 WinUSB!WPP_665a2041265cSEO靠我71ae73ac0046da341ef0_Traceguids =

fffff800`caabf7bc WinUSB!WinUSB_ParentIsochRequestCancel ()

fffff800SEO靠我`caabe7c4 WinUSB!WinUSB_RegisterIsochBufferCancel ()

fffff800`caac19b0 WinUSB!_security_check_cookie SEO靠我()

fffff800`caab62b8 WinUSB!WPP_RECORDER_SF_q ()

fffff800`caab61c8 WinUSB!WPP_RECORDER_SF_l ()

fffff800SEO靠我`caab61c8 WinUSB!WPP_RECORDER_SF_D ()

fffff800`caab61c8 WinUSB!WPP_RECORDER_SF_d ()

fffff800`caac31c0 SEO靠我WinUSB!WdfFunctions =

fffff800`caac20e8 WinUSB!_imp_ExInterlockedInsertTailList =

fffff800`caacb3b4 WiSEO靠我nUSB!_IMPORT_DESCRIPTOR_ntoskrnl =

fffff800`caac646c WinUSB!WinUSB_Unload ()

fffff800`caac2328 WinUSB!SEO靠我DEVPKEY_DeviceInterface_Restricted =

fffff800`caab7694 WinUSB!WinUSB_SerialDeviceControl ()

fffff800`cSEO靠我aacb340 WinUSB! ?? ::PBOPGDP::`string ()

fffff800`caac2058 WinUSB!_imp_WppAutoLogStart =

fffff800`caabSEO靠我9e70 WinUSB!WinUSB_StartDeviceControlQueues ()

fffff800`caac63e0 WinUSB!WppCleanupKm ()

fffff800`caabeSEO靠我f94 WinUSB!WinUSB_UnmapIsochBuffer ()

fffff800`caac3038 WinUSB!WDF_ISOCH_BUFFER_CONTEXT_TYPE_INFO =

ffSEO靠我fff800`caac2068 WinUSB!_imp_WppAutoLogStop =

fffff800`caaca160 WinUSB! ?? ::NNGAKEGL::`string ()

fffffSEO靠我800`caac23f0 WinUSB!load_config_used =

fffff800`caac175c WinUSB!FxStubDriverUnload ()

fffff800`caac318SEO靠我4 WinUSB!ExDefaultNonPagedPoolType =

fffff800`caac1f60 WinUSB! ?? ::FNODOBFM::`string ()

fffff800`caabSEO靠我f8a0 WinUSB!WinUSB_IsochTransferComplete ()

fffff800`caac3150 WinUSB!__KMDF_CLASS_BIND_END =

fffff800`SEO靠我caabfe10 WinUSB!WinUSB_ForwardIsochRequest ()

fffff800`caabafb4 WinUSB!WinUSB_ErrorWorkItem ()

fffff80SEO靠我0`caac8280 WinUSB!WinUSB_DeviceCleanup ()

fffff800`caac86c0 WinUSB!WinUSB_D0Exit ()

fffff800`caaca560 SEO靠我WinUSB! ?? ::NNGAKEGL::`string ()

fffff800`caac2350 WinUSB!WPP_9e5919c5a70c38eced6e3b7996693684_TraceSEO靠我guids =

fffff800`caac41e8 WinUSB!g_pIoIncrementKeepAliveCount =

fffff800`caac7414 WinUSB!WinUSB_Close SEO靠我()

fffff800`caac2280 WinUSB!DEVPKEY_Winusb_Device_Protocol =

fffff800`caac2118 WinUSB!_imp_KeInitializSEO靠我eEvent =

fffff800`caaca1e0 WinUSB! ?? ::NNGAKEGL::`string ()

fffff800`caaca460 WinUSB! ?? ::NNGAKEGL::SEO靠我`string ()

fffff800`caac1a60 WinUSB!guard_check_icall_nop ()

fffff800`caac2298 WinUSB!DEVPKEY_Device_USEO靠我pperFilters =

fffff800`caac9c24 WinUSB!WinUSB_GetDeviceDescriptor ()

fffff800`caac2108 WinUSB!_imp_RtlSEO靠我GUIDFromString =

fffff800`caab9ba8 WinUSB!WinUSB_InternalDeviceControl ()

fffff800`caac6000 WinUSB!WppSEO靠我LoadTracingSupport ()

fffff800`caac2150 WinUSB!_imp_IoWMIRegistrationControl =

fffff800`caac16cc WinUSSEO靠我B!FxStubDriverUnloadCommon ()

fffff800`caac3060 WinUSB!WDF_DEVICE_EXTENSION_TYPE_INFO =

fffff800`caab8SEO靠我a7c WinUSB!WinUSB_ControlTransferCompletion ()

fffff800`caabb90c WinUSB!WinUSB_RawIoReadCompletion ()SEO靠我

fffff800`caaca400 WinUSB! ?? ::NNGAKEGL::`string ()

fffff800`caabb3d8 WinUSB!WinUSB_HandlePipeError (SEO靠我)

fffff800`caac3160 WinUSB!__KMDF_TYPE_INIT_START =

fffff800`caac20b8 WinUSB!_imp_KeAcquireSpinLockRaiSEO靠我seToDpc =

fffff800`caac2008 WinUSB!_imp_KeQueryPerformanceCounter =

fffff800`caab9684 WinUSB!WinUSB_ReSEO靠我setDefaults ()

fffff800`caaca430 WinUSB! ?? ::NNGAKEGL::`string ()

fffff800`caac178c WinUSB!FxDriverEnSEO靠我try ()

fffff800`caac2360 WinUSB!WPP_ThisDir_CTLGUID_WinUSB =

fffff800`caac3000 WinUSB!_security_cookieSEO靠我 =

fffff800`caabe0c0 WinUSB!WPP_RECORDER_SF_qDD ()

fffff800`caac20f8 WinUSB!_imp_ExInterlockedInsertHeSEO靠我adList =

fffff800`caabb6f4 WinUSB!WPP_RECORDER_SF_dDd ()

fffff800`caab6688 WinUSB!WPP_RECORDER_SF_DDD SEO靠我()

fffff800`caab6764 WinUSB!WPP_RECORDER_SF_DDd ()

fffff800`caab695c WinUSB!WPP_RECORDER_SF_ddd ()

ffffSEO靠我f800`caacb380 WinUSB! ?? ::PBOPGDP::`string ()

fffff800`caabb82c WinUSB!WPP_RECORDER_SF_dDi ()

fffff80SEO靠我0`caac0c5c WinUSB!WinUSB_FreeChildIsochRequest ()

fffff800`caaca180 WinUSB! ?? ::NNGAKEGL::`string ()SEO靠我

fffff800`caac2158 WinUSB!_imp_RtlCompareMemory =

fffff800`caac41e0 WinUSB!g_pIoGetInitiatorProcess =

fSEO靠我ffff800`caab60c0 WinUSB!WPP_RECORDER_SF_Sd ()

fffff800`caab63a8 WinUSB!WPP_RECORDER_SF_qd ()

fffff800`SEO靠我caab6848 WinUSB!WPP_RECORDER_SF_dD ()

fffff800`caab6848 WinUSB!WPP_RECORDER_SF_Dd ()

fffff800`caab6848SEO靠我 WinUSB!WPP_RECORDER_SF_dd ()

fffff800`caab6c04 WinUSB!WPP_RECORDER_SF_id ()

fffff800`caac20f0 WinUSB!SEO靠我_imp_ExInterlockedRemoveHeadList =

fffff800`caaba13c WinUSB!WinUSB_DecrementKeepAliveCount ()

fffff800SEO靠我`caac20a0 WinUSB!_imp_RtlQueryRegistryValues =

fffff800`caac3088 WinUSB!WDF_TRANSFER_CONTEXT_TYPE_INFSEO靠我O =

fffff800`caac2098 WinUSB!_imp__vsnwprintf =

fffff800`caac20e0 WinUSB!_imp_IoFreeMdl =

fffff800`caacSEO靠我b27c WinUSB!_security_init_cookie ()

fffff800`caabf4c8 WinUSB!WinUSB_CancelChildRequests ()

fffff800`cSEO靠我aac83c8 WinUSB!WinUSB_D0Entry ()

fffff800`caac3188 WinUSB!WPPTraceSuite =

fffff800`caac20b0 WinUSB!_imSEO靠我p_KeSetEvent =

fffff800`caacb2b0 WinUSB! ?? ::PBOPGDP::`string ()

fffff800`caac9388 WinUSB!WinUSB_AborSEO靠我tPipe ()

fffff800`caabd45c WinUSB!WinUSB_EvtRawIoStop ()

fffff800`caac3180 WinUSB!ExDefaultMdlProtectiSEO靠我on =

fffff800`caac19d0 WinUSB!_report_gsfailure ()

fffff800`caabb5f4 WinUSB!WinUsb_GetCurrentFrameNumbSEO靠我er ()

fffff800`caac2060 WinUSB!_imp_WppAutoLogTrace =

fffff800`caab9f58 WinUSB!WinUSB_StopDeviceControSEO靠我lQueues ()

fffff800`caac2048 WinUSB!_imp_WdfVersionBindClass =

fffff800`caac2178 WinUSB!ntoskrnl_NULLSEO靠我_THUNK_DATA =

fffff800`caac2080 WinUSB!_imp_ExFreePoolWithTag =

fffff800`caac96ac WinUSB!WinUSB_FlushPSEO靠我ipe ()

fffff800`caac2100 WinUSB!_imp_KeEnterCriticalRegion =

fffff800`caac0248 WinUSB!WinUSB_SubmitIsoSEO靠我chRequests ()

fffff800`caabaf04 WinUSB!WinUSB_IsInterruptOrBulkOutPipe ()

fffff800`caac0b78 WinUSB!WinSEO靠我USB_GetFreeChildIsochRequest ()

fffff800`caaca270 WinUSB! ?? ::NNGAKEGL::`string ()

fffff800`caac2380 SEO靠我WinUSB!WPP_2087dac655485f81d1477b0c81a5b792_Traceguids =

fffff800`caacb000 WinUSB!DriverEntry ()

fffffSEO靠我800`caabda04 WinUSB!WinUSB_WritePipe ()

fffff800`caaca350 WinUSB! ?? ::NNGAKEGL::`string ()

fffff800`cSEO靠我aac31a8 WinUSB!pfnWppTraceMessage =

fffff800`caac8d3c WinUSB!WinUsb_MarkInterfaceRestricted ()

fffff80SEO靠我0`caac6334 WinUSB!WppInitKm ()

fffff800`caabecb0 WinUSB!WinUSB_MapIsochTransfer ()

fffff800`caac2270 WSEO靠我inUSB!GUID_DEVINTERFACE_WINUSB_WINRT =

fffff800`caac2010 WinUSB!HAL_NULL_THUNK_DATA =

fffff800`caabb4SEO靠我ec WinUSB!WinUsb_GetMaxBytesPerInterval ()

fffff800`caac1dc0 WinUSB!memset ()

fffff800`caacb418 WinUSBSEO靠我!_NULL_IMPORT_DESCRIPTOR =

fffff800`caaca220 WinUSB! ?? ::NNGAKEGL::`string ()

fffff800`caacb3dc WinUSSEO靠我B!_IMPORT_DESCRIPTOR_USBD =

fffff800`caac2090 WinUSB!_imp_IoGetDeviceProperty =

项目中，碰到的实际问题是：有的时候，系统软件SEO靠我发出的数据，与USB设备接收到的数据，数据内容不匹配（视频数据，前面部分丢失了一些的情况）。

首先怀疑是设备这端没有做好接受数据的工作，但经过Lecory T3 USB Analyzer的实时数据抓取，SEO靠我设备这边打印，发现设备这边并没有数据丢失的情况发生。

转而怀疑是系统软件与WinUSB之间存在的交互的问题，导致了数据的丢失情况。

于是，在私有视频驱动准备数据工作完成处，与WinUSB的发送数据处，分别SEO靠我设一个断点：

bp WinUSB!WinUSB_WritePipe

观察是不是系统软件每次都将完整的数据包交给了WinUSB.

如果是，那说明两者之间的交互是正确的，问题在于WinUSB后面的数据传输过程，SEO靠我例如，是USB xHCI/USB3 HUB/UCX01000等系统USB3.0主控驱动软件导致, 也有可能是USB3.0的某一款HOST的硬件逻辑本身就有问题，从而导致数据丢失的问题，需要进一步对USEO靠我SB HOST驱动设断点，进行观察与排除怀疑点，缩小问题根源的范围。

下面是笔者设定bp WinUSB!WinUSB_WritePipe断点后，断点HIT时的寄存器上线文与栈回溯（NET双机内核调试）：SEO靠我(以下栈帧中，将其中一些私有驱动名称改为xxmgr)

0: kd> g

Breakpoint 1 hit

rax=0000000000000000 rbx=ffffe00192f57080 rcx=ffffSEO靠我e0019085fe60

rdx=ffffe001908bdcb4 rsi=00001ffe6d0a8f78 rdi=ffffe0019085fe60

rip=fffff800caabda04 rsp=fSEO靠我fffd000234c63d8 rbp=ffffd000234c6430

r8=00001ffe6d0a8f78 r9=ffffd000234c6420 r10=000000000000001c

r11SEO靠我=ffffe001908bd080 r12=0000000000000000 r13=00001ffe6fd9e3d8

r14=fffff800caac2380 r15=0000000000000002SEO靠我

iopl=0 nv up ei ng nz na po nc

cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b SEO靠我 efl=00000286

WinUSB!WinUSB_WritePipe:

fffff800`caabda04 488bc4 mov rax,rsp

0: kd> kvn

# SEO靠我Child-SP RetAddr : Args to Child SEO靠我 : Call Site

00 ffffd000`234c63d8 fffff800`caab70f1 : ffffe001`92f57080 ffffd000`234c6430 00SEO靠我001ffe`6d0a8f78 00000000`00000000 : WinUSB!WinUSB_WritePipe

01 ffffd000`234c63e0 fffff800`c88f69ce : SEO靠我ffffe001`92f57080 00001ffe`6d0a8f78 00000000`03508021 fffff800`c896b748 : WinUSB!WinUSB_DeviceControSEO靠我l+0x3a5

02 ffffd000`234c6460 fffff800`c88f6123 : ffffe001`90261c00 ffffd000`234c6500 ffffe001`9490ce0SEO靠我0 00000000`00000001 : Wdf01000!FxIoQueue::DispatchRequestToDriver+0x1be

03 ffffd000`234c6530 fffff800SEO靠我`c8902279 : ffffe001`90261c20 ffffe001`92f57000 00000000`00000000 ffffd000`234c66d9 : Wdf01000!FxIoQSEO靠我ueue::DispatchEvents+0x363

04 ffffd000`234c65f0 fffff800`c88fad93 : ffffcf80`26e38700 ffffe001`92f570SEO靠我80 ffffcf80`26e38750 ffffcf80`26e38750 : Wdf01000!FxIoQueue::QueueRequest+0x8d

05 ffffd000`234c6660 fSEO靠我ffff800`c86cc832 : 00000000`00020000 ffffd000`234c6700 ffffe001`9085fb70 fffff800`c88fa240 : Wdf0100SEO靠我0!FxDevice::DispatchWithLock+0xb51

06 ffffd000`234c6740 fffff802`33b03911 : ffffcf80`26e38750 0000000SEO靠我0`00000002 ffffe001`94267860 00000000`00000000 : VerifierExt!xdv_IRP_MJ_DEVICE_CONTROL_wrapper+0xfe

0SEO靠我7 ffffd000`234c67a0 fffff802`33b1fec9 : ffffcf80`26e38750 ffffe001`901819f0 00000000`00000002 ffffe0SEO靠我01`93e8e7c0 : nt!IovCallDriver+0x3cd

08 ffffd000`234c67f0 fffff802`33b03911 : ffffe001`90181b40 ffffcSEO靠我f80`26e38750 ffffe001`901819f0 00000000`00000001 : nt!ViFilterDispatchGeneric+0xd1

09 ffffd000`234c68SEO靠我30 fffff802`3385115f : 00000000`00000000 ffffd000`234c6b80 ffffcf80`26e38750 ffffe001`947eca60 : nt!SEO靠我IovCallDriver+0x3cd

0a ffffd000`234c6880 fffff802`33852a76 : 00000000`00000000 00000000`03b830f4 0000SEO靠我0000`00000000 00000000`00ef3110 : nt!IopXxxControlFile+0xa4f

0b ffffd000`234c6a20 fffff802`335e79b3 :SEO靠我 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtDeviceIoControlFile+SEO靠我0x56

0c ffffd000`234c6a90 00007ffb`1ecf16ea : 00007ffb`1c3db805 00000000`000003e5 00000000`026bbb90 0SEO靠我0000000`0377f614 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`234c6b00)

0d 00000000`0377f5eSEO靠我8 00007ffb`1c3db805 : 00000000`000003e5 00000000`026bbb90 00000000`0377f614 00000000`00000000 : ntdlSEO靠我l!NtDeviceIoControlFile+0xa

0e 00000000`0377f5f0 00007ffb`1cef2470 : 00000000`03508021 00007ffb`00000SEO靠我103 00000000`00ef0000 00000000`0000000a : KERNELBASE!DeviceIoControl+0x103

0f 00000000`0377f660 00007SEO靠我ffb`16572cbd : 00000000`0038dc30 00007ffb`1c3d4f4f 00000000`0377f7b0 00000000`00000000 : KERNEL32!DeSEO靠我viceIoControlImplementation+0x74

10 00000000`0377f6b0 00000000`00cc45d6 : 00000000`00ef0200 00000000`SEO靠我0377f702 00000000`00ef2ec0 00000000`038830b8 : WinUsb_7ffb16570000!WinUsb_WritePipe+0x10d

11 00000000SEO靠我`0377f730 00000000`00cc4c1f : 00000000`00000000 00000003`03000400 0000c299`caf3775a 00000000`00ef2ecSEO靠我0 : xxmgr+0x145d6

12 00000000`0377f7f0 00000000`00cd0e45 : 00000000`026bb4d0 00000000`00000000 000000SEO靠我00`00000001 00000000`00000000 : xxmgr+0x14c1f

13 00000000`0377f850 00000000`00cce23d : 00000000`00ef1SEO靠我4c0 00000000`0377f919 00000000`00020d00 00000000`0038a0cc : xxmgr+0x20e45

14 00000000`0377f890 000000SEO靠我00`00cd28c7 : 00000000`00000300 00000000`00000020 00000000`00000004 00000000`026bb398 : xxmgr+0x1e23SEO靠我d

15 00000000`0377f980 00000000`00ccf42f : 00000000`00000000 00000000`00ef2dd0 00000000`00000000 0000SEO靠我0000`00ef14c0 : xxmgr+0x228c7

16 00000000`0377f9e0 00000000`00ccc72b : 00000000`026bbc80 00000000`000SEO靠我00000 00000000`00000000 00000000`00000000 : xxmgr+0x1f42f

17 00000000`0377fa40 00000000`00cc2744 : 00SEO靠我000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : xxmgr+0x1c72b

18 00000000`037SEO靠我7fa80 00007ffb`1cef16ad : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : SEO靠我xxmgr+0x12744

19 00000000`0377fac0 00007ffb`1ecb4409 : 00000000`00000000 00000000`00000000 00000000`0SEO靠我0000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0xd

1a 00000000`0377faf0 00000000`00000000 :SEO靠我 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+SEO靠我0x1d

这里注意，栈帧0和10都有WinUSB_WritePipe的字样，但到底是哪一个呢：

从这两处栈帧的EBP情况看，0帧是处于内核态的（事实上，就是WinUSB.sys）, 10帧是处于用户态的（SEO靠我WinUSB.dll）.

笔者发现，在视频驱动准备数据处的断点HIT时，数据BUFFER的指针为：00000000`038830b8

而10号栈帧，第四个参数（并非是第四个参数，见后文）也是0000000SEO靠我0`038830b8，这就说明，私有驱动在这一次断点（bp WinUSB!WinUSB_WritePipe）HIT时，将数据包交给了WinUSB，并没有改变视频数据BUFFER的起始地址（这是一次SEO靠我正确的情况）。

有了这样的调试方法，后面可以深入追踪这个问题的根源（可能会涉及到对xHCI USB3.0驱动设断点，参考前三篇博文的符号列表）。

当然，设定WinUSB_WritePipe是最基本的，之后SEO靠我的问题追踪，需要更多的WinDbg内核调试技巧。

其中有一点疑惑的是：

MSDN查找WinUSB_WritePipe的文档

http://msdn.microsoft.com/zh-cn/library/fSEO靠我f540322(v=vs.85).aspx

BOOL __stdcall WinUsb_WritePipe(_In_ WINUSB_INTERFACE_HANDLE InterfaceHanSEO靠我dle,_In_ UCHAR PipeID,_In_ PUCHAR Buffer,_In_ ULONG BufferLength,_Out_opt_ PULONGSEO靠我 LengthTransferred,_In_opt_ LPOVERLAPPED Overlapped );

第三个参数是视频BUFFER的指针，（视频数据包的长度为0x300040SEO靠我）

而栈帧10中，（00000000`038830b8 视频数据BUFFER指针）却是第四个参数(其实，这里是以x86函数调用的方式来思考问题，得出BUFFER指针为第四个参数的错误结论)。

# ChiSEO靠我ld-SP RetAddr : Args to Child SEO靠我 : Call Site

10 00000000`0377f6b0 00000000`00cc45d6 : 00000000`00ef0200 00000000`0377f702 00000SEO靠我000`00ef2ec0 00000000`038830b8 : WinUsb_7ffb16570000!WinUsb_WritePipe+0x10d

一时间，对这个问题没有太好的解答，后来突然一想，目SEO靠我标机是X64的平台，会不会函数调用方式与X86有不同之处呢？

查找WinDbg文档发现：

Calling Conventions

Unlike the x86, the C/C++ compiler onlSEO靠我y supports one calling convention on x64. This calling convention takes advantage of the increased nSEO靠我umber of registers available on x64:

The first four integer or pointer parameters are passed in the rcSEO靠我x,rdx,r8, and r9 registers.

The first four floating-point parameters are passed in the first four SSE rSEO靠我egisters,xmm0-xmm3.

The caller reserves space on the stack for arguments passed in registers. The calSEO靠我led function can use this space to spill the contents of registers to the stack.

Any additional argumSEO靠我ents are passed on the stack.

An integer or pointer return value is returned in the raxregister, whileSEO靠我 a floating-point return value is returned inxmm0.

rax, rcx, rdx, r8-r11 are volatile.

rbx, rbp, rdi, rsi,r12SEO靠我-r15 are nonvolatile.

The calling convention for C++ is very similar: the thispointer is passed as an iSEO靠我mplicit first parameter. The next three parameters are passed in registers, while the rest are passeSEO靠我d on the stack.

确实，与X86有很大的不同，X64统一了一种函数调用方式，从以上文档可以看出，前四个参数，是以寄存器rcx, rdx, r8, and r9来传递的。

于是，切换到10栈帧，看当SEO靠我时的寄存器情况：

3: kd> .frame /r 0x10

10 00000000`0377f6b0 00000000`00cc45d6 WinUsb_7ffb16570000!WinUsb_WriteSEO靠我Pipe+0x10d

rax=0000000000000000 rbx=000000000038dc30 rcx=ffffe0019085fe60

rdx=ffffe001908bdf84 rsi=000SEO靠我0000000000000 rdi=0000000000ef3110

rip=00007ffb16572cbd rsp=000000000377f6b0 rbp=000000000377f7b0

r8=0SEO靠我0001ffe6ca109a8 r9=ffffd000234c6420 r10=000000000000001c

r11=ffffe001908bd080 r12=0000000000300040 rSEO靠我13=00000000038830b8

r14=000000000377f764 r15=0000000000380580

iopl=0 nv up ei ng nz na po nc

csSEO靠我=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000286

WinUsb_7ffb16570000!WinUsSEO靠我b_WritePipe+0x10d:

00007ffb`16572cbd 8bd8 mov ebx,eax

我们看到视频数据BUFFER指针与长度分别由以下寄存器传递：

r13SEO靠我=00000000038830b8

r12=0000000000300040

而

rcx=ffffe0019085fe60

rdx=ffffe001908bdf84

r8=00001ffe6ca109a8

r9=SEO靠我ffffd000234c6420

这四个寄存中，既没有看到正确的长度值，也没有BUFFER指针。

笔者得出初步的结论，可能X64的函数调用方式，在新型的计算机中，使用了别的寄存器（r12,13），取代了rSEO靠我cx, rdx, r8, and r9。

列出X86的函数调用方式：

Calling Conventions

The x86 architecture has several different calling SEO靠我conventions. Fortunately, they all follow the same register preservation and function return rules:

FSEO靠我unctions must preserve all registers, except foreax, ecx, and edx, which can be changed across a functSEO靠我ion call, andesp, which must be updated according to the calling convention.

The eaxregister receives SEO靠我function return values if the result is 32 bits or smaller. If the result is 64 bits, then the resulSEO靠我t is stored in theedx:eax pair.

The following is a list of calling conventions used on the x86 architeSEO靠我cture:

Win32 (__stdcall)

Function parameters are passed on the stack, pushed right to left, and the caSEO靠我llee cleans the stack.

Native C++ method call (also known as thiscall)

Function parameters are passed SEO靠我on the stack, pushed right to left, the "this" pointer is passed in theecxregister, and the callee cSEO靠我leans the stack.

COM (__stdcall for C++ method calls)

Function parameters are passed on the stack, pushSEO靠我ed right to left, then the "this" pointer is pushed on the stack, and then the function is called. TSEO靠我he callee cleans the stack.

__fastcall

The first two DWORD-or-smaller arguments are passed in the ecxanSEO靠我dedxregisters. The remaining parameters are passed on the stack, pushed right to left. The callee clSEO靠我eans the stack.

__cdecl

Function parameters are passed on the stack, pushed right to left, and the calSEO靠我ler cleans the stack. The__cdeclcalling convention is used for all functions with variable-length paSEO靠我rameters.

第三十六篇-WinUSB调试实例

最新发布