Get HID report Descriptor from .pcap file

user_13122806 0
Viewed 910

I am building a C++ app on windows that should reinterpret USB data stream captured by Wireshark and USBPCap stored into a .pcap file. I am currently having trouble to get HID Report descriptor, so then i would be able to interpret data that mouse sends to the host.

The site USB Made Simple has been a great source of information so far, and i have also read a tons of tutorials how to write your own HID Report descriptor in order to understand them. But what i need is to retrieve one from current data flow.

According to wireshark, mouse is sending me a DEVICE DESCRIPTOR (example here), after that it sends CONFIGURATION DESCRIPTOR with its INTERFACE, HID and ENDPOINT DESCRIPTORS (example here).

According to value of wDescriptorLength in HID DESCRIPTOR, there should be HID REPORT DESCRIPTOR of length 56, but there is not. After this there is only ENDPOINT DESCRIPTOR of length 7 and another INTERFACE and HID DESCRIPTOR of total lenght 18.

Is there any way to get HID REPORT DESCRIPTOR from this or am I missing something out ?

Thank you for any input.

pcap usb hid mouse c++
2 Answers

Is there any way to get HID REPORT DESCRIPTOR from this or am I missing something out ?

Don't know about you but for me that looks like Wireshark/USBPCap is missing something. If you compare it with mine example it looks like entries with USBHID protocol are missing in your part.

enter image description here

Please check your Wireshark version or if you don't have enabled any filters in capture configuration.

If you click 'gear' icon on the left side of USBPcap interface you can check your current settings:

USBPcap settings

Important note: Despite fact that "Inject already connected devices descriptors..." is checked it doesn't work for me like I would expect and to capture Report Descriptor you have to reconnect device: unplug USB-HID device -> Start capture -> Plug in USB device -> Now you can stop capture.

user_6451460

You should be able to use the Win32 HID-parse utilities to do this:

https://docs.microsoft.com/en-us/windows-hardware/drivers/hid/preparsed-data

See here for an example of use, where the HID report is accessed using WM_INPUT: https://github.com/supersmo/Using-Raw-Input-API-to-Process-Joystick-Input

...in particular these methods:

// determine buffer size required
CHECK( GetRawInputDeviceInfo(pRawInput->header.hDevice, RIDI_PREPARSEDDATA, NULL, &bufferSize) == 0 );

// allocate buffer
CHECK( pPreparsedData = (PHIDP_PREPARSED_DATA)HeapAlloc(hHeap, 0, bufferSize) );

// determine the usages etc
CHECK( (int)GetRawInputDeviceInfo(pRawInput->header.hDevice, RIDI_PREPARSEDDATA, pPreparsedData, &bufferSize) >= 0 );

// Button caps
CHECK( HidP_GetCaps(pPreparsedData, &Caps) == HIDP_STATUS_SUCCESS )

// Value caps
CHECK( pValueCaps = (PHIDP_VALUE_CAPS)HeapAlloc(hHeap, 0, sizeof(HIDP_VALUE_CAPS) * Caps.NumberInputValueCaps) );
capsLength = Caps.NumberInputValueCaps;
CHECK( HidP_GetValueCaps(HidP_Input, pValueCaps, &capsLength, pPreparsedData) == HIDP_STATUS_SUCCESS )

Another thing to look at is the ReactOS hidusb source which can be found (today) here: https://doxygen.reactos.org/dd/d06/hidusb_8c_source.html

...pay particular attention to e.g. HidUsb_GetReportDescriptor

Hope this points you in the right direction.

user_16079370
Related