USBPcap is an open-source USB Packet Capture tool for Windows that can be used together with Wireshark in order to analyse USB traffic without using a Virtual Machine.
Currently, the live capture can be done on “standard input” capture basis: you write a magic command in cmd.exe and you get the Wireshark to capture raw USB traffic on Windows.
USBPcapDriver has three “hats”:
- Root Hub (USBPCAP_MAGIC_ROOTHUB
- Control (USBPCAP_MAGIC_CONTROL)
- Device (USBPCAP_MAGIC_DEVICE)
What you won’t see using USBPcap
As USBPcap captures URBs passed between functional device object (FDO) and physical device object (PDO) there are some USB communications elements that you will notice only in hardware USB sniffer.
Read the rest of USBPcap – USB Packet Capture For Windows now! Only available at Darknet.