如何在Windows下嗅探USB端口？
有时，我需要在 Windows 下转储 USB 流量，主要是为了支持 Linux 下的硬件，所以我的主要目标是生成用于协议分析的转储文件。
对于 USB 流量，似乎 SniffUsb 是明显的赢家...它可以在 Windows XP 下运行（但不能更高版本），并且具有比早期版本更好的 GUI。 它会产生巨大转储文件，但一切都在那里。
但是，我的设备实际上是 USB 串行设备，因此我转向 Portmon 它可以嗅探串行端口流量，而无需 USB 开销。
From time to time, I need to dump USB traffic under Windows, mostly to support hardware under Linux, so my primary goal is to produce dump files for protocol analysis.
For USB traffic, it seems that SniffUsb is the clear winner... It works under Windows XP (but not later) and has a much nicer GUI than earlier versions. It produces huge dump files, but everything is there.
However, my device is in fact a USB serial device, so I turned to Portmon which can sniff serial port traffic without the USB overhead.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
Busdog 是一个托管在 github 上的开源项目，对我来说效果很好。 它安装了一个驱动程序以允许其监视 USB 通信。 配置窗口允许您随时重新安装或删除设备。
您可以从枚举列表中选择所需的 USB 设备。 一个很好的功能是让它自动跟踪插入的新设备：
与我进行逆向工程的 SWR 分析仪之间的数据通信被完美捕获：
Busdog, an open source project hosted on github, has worked well for me. It has a driver it installs to allow it to monitor USB communications. The config window allows you to reinstall or remove the device at any time.
You can select the USB device you want from an enumerated list. A nice feature is to have it automatically trace a new device that is plugged in:
Data communications to and from an SWR analyzer I was reverse engineering were captured flawlessly:
由于人们似乎没有意识到这一点，Wireshark 确实监控 USB 流量并有一个解析器； 但问题是它只能在 Linux 下运行。 Windows 上的 Wireshark 不会这样做。
以上有问题吗？ 我不知道 Linux 机器或 Windows 机器如何相互检测。
Since people don't seem to realize it, Wireshark does monitor USB traffic and has a parser for it; but the catch is it only works under Linux. Wireshark on Windows will not do this.
It may be possible to plug the USB device you want to monitor, along with a Linux machine (with Wireshark running) and your Windows machine and just use the USB device under Windows.
Problem with the above? I don't know how the Linux machine or the Windows machine will detect each other.
经过五年的等待，现在可以在 Windows 上嗅探 USB 数据包
请参阅 http://desowin.org/usbpcap/ tour.html 进行快速浏览。 效果很好
After five years waiting, now it's possible to sniff usb packets on windows
See http://desowin.org/usbpcap/tour.html for a quick tour. It works pretty well
Microsoft 消息分析器能够使用 MS 的
设备和日志文件解析器捕获 USB 流量：链接更新：如 @facetus、MS 消息分析器所述 已于 2019 年 11 月 25 日停用。
Microsoft Message Analyzer was able to capture USB traffic, with
Device and Log Fileparser from MS: linkUpdate: as mentioned by @facetus, MS Message Analyzer has been retired on November 25 2019.
USBSnoop 也可以工作 - 而且是免费的。
或者，您可以购买一个USB 转以太网转换器，并使用您喜欢的任何网络嗅探器来查看数据。
USBSnoop works too - and is free.
Or, you could buy a USB to Ethernet converter and use whatever network sniffer you prefer to see the data.
就我个人而言，我会使用 QEMU 或 KVM 并检测其 USB 直通代码，然后使用 libusb 在用户空间中构建替换驱动程序的原型（后一点我以前做过；用 Python 编写 USB 设备驱动程序很有趣！）。
Personally, I'd use QEMU or KVM and instrument their USB passthrough code, and then use libusb to prototype the replacement driver in user space (this latter bit I've done before; writing USB device drivers in Python is fun!).