USB抓包

1.wireshark抓包软件

再安装的时候一定要勾选USBPcap,默认选项是不勾选的

2.筛选规则

一个计算中存在多个usb设备,消息非常多,我们就需要对消息进行筛选,根据usb协议特征,主机会为从机分配一个7字节的地址,因此可以将设备地址作为筛选

3.如何查看设备地址

使用第三工具UsbTreeView
下载链接:https://www.uwe-sieber.de/english.html
在这里插入图片描述
step1:找到目标设备
step2:搜索关键字Connection Information
step3:查看device address
在这里插入图片描述

4.设置筛选规则

筛选设备地址:usb.device_address == 10
在这里插入图片描述

  • 2
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
The USB Device Tree Viewer, short UsbTreeView is based upon the Microsoft "USBView" sample application found in the Windows Driver Development Kits and now standalone at GitHub. But it is source code only, there is no executable for end users provided. Meanwhile USBView comes as executables as part of the "Debugging Tools für Windows", see here: USBView. UsbTreeView started with the USBView source code from the DDK for Server 2003. Here are the improvements I've done: Informations from the Windows Device Management are collected and matched with the found USB devices; Therefore UsbTreeView can show the child devices, including drive letters and COM-ports Window position is saved Background color and font of the right pane can be set (the font shown in the screenshots is DOSLike 7) Text output rearranged Keeps the tree item selection over refresh way more descriptors are decoded, as Audio 2.0 Hexdump of the descriptors can be shown Safe removal, device restart and port restart Extended USB information available under Windows 8 (taken from the latest USBView sample application) Extended information about host controllers Enumeration of the USB devices accelerated and independent from the treeview Failed USB requests are re-tried in the background, e.g. if a USB mouse was moved while requesting its properties Toolbar with jump-lists for easily finding devices in complex trees TreeView with handmade 16x16 icons, USBView used 32x32 icons scaled down to 15x15 many minor improvements With V3.0 No more enumeration of all devices on arrival and removal of a USB device Search function (not full text, only things like device ID, drive letter, volume name etc) Some new Keyboard shortcuts (Alt+D to open the drives list, Alt+O the Others list, Alt+S to focus the search edit, Alt+Left/Right to cycle thru the search hits Options not to expand empty hubs or hub with only empty hubs attached Options to jump to arrived and removed devices Option to expand tree items to make selected
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值