2

I have a piece of proprietary hardware that I'm trying to reverse engineer and write a cross-platform open-source driver for. This device has an IR camera on it, and it seems to be using the UVC protocol. On linux, de device is exposed as a /dev/video0 camera, and although it doesn't show up in any webcam-based application, I can use OpenCV to pull frames from it.

On Windows, it is a bit more obfuscated. The camera doesn't show up in any application, and only the devices' Windows-only proprietary driver can interface with it. In Device Manager the device shows up under 'Imaging devices' and it uses the ksthunk.sys and usbvideo.sys drivers.

I've tried everything I could think of to pull frames off of the camera, but every attempt failed. First of all, I've tried connecting to it with OpenCV, but i couldn't find the right device id. I've even tried brute-forcing the device id by trying to connect to every possible number within a huge interval, but no luck.

I've also tried using some low-level uvc debugging tools from the Windows SDK (GraphEdit and KsStudio) but none of them could connect to the camera.

One thing I did notice is that actual webcams have registry keys FilterData and MSCameraFlags in HKLM\CurrentControlSet\Control\DeviceClasses\{e5323777-f976-4f5b-9b55-b94699c46e44}\##?#USB#VID_045E&PID_0766&MI_00#6&1d047af0&0&0000#{e5323777-f976-4f5b-9b55-b94699c46e44}\#global\Device Parameters, while this device doesn't. The value FilterData seems to contain values regarding resolution and image compression, so the lack of this key in my device's registry might have something to do with windows not seeing it as a webcam.

Obviously the device's developers did something to make sure the camera doesn't show up as a regular webcam, because it is not meant to be used as such.

My ultimate goal is to be able to use the IR camera from OpenCV in my own software, but I have no idea how to get started with proper reverse engineering of the device.

Improve this question

2 Answers 2

Reset to default
1

First, try to identify the components of the device. If it's cheap, buy a second one and crack it open.

Look for specifications and find similar devices which have the same specs. It's not like this device is the only one on the planet with that imaging sensor. That may help you find a compatible driver or spec from which to start your implementation.

Sounds like the device isn't presenting itself as a camera. There's nothing that says a USB camera has to declare itself to be one. My USB keyboard could claim to not be a USB keyboard.

Can you write a virtual webcam driver which acts as a proxy? Setup fake/ approximate registry entries and proxy data directly to the device?

How about just creating a registry entry approximate to what it should be? You likely know the parameters from OpenCV.

I take it from your post, you need to use this device on windows?

Improve this answer
1
  • The official driver is windows only, but I'm trying to make my own driver cross-platform.
    – Lázár Zsolt
    Commented Dec 4, 2020 at 19:41
1
  1. First I would find the h/w device ID from device manager. i.e. USB\VID_045E&PID_0766. In some cases you can find existing open source drivers for closely matching device IDs and make them work with minimal modifications.
  1. Is the application actually installing 3rd party drivers, the two drivers you mention ksthunk.sys and usbvideo.sys are Microsoft drivers built into Windows.

Drivers using USBVIDEO.sys follow the specifications laid out here:

https://docs.microsoft.com/en-us/windows-hardware/drivers/stream/usb-video-class-driver-overview

The tool USBView which is part of the Windows Driver Kit can extract more info about the USB device.

  1. USB tracing can assist workout more details around the communication, using a tool such as WireShark

  2. An analysis of the setup program for the driver can work out further information. This is a fairly complex topic though but some methods could include:

a) Use a tool to monitor driver installation such as ProcMon (http://live.sysinternals.com/ProcMon.exe) Generally this works best if driver & application is not installed, you start monitoring then run install program and connect device during trace.

b) Static analyze the installer using tools such as UniExtract , Orca (if MSI), then analyse the executable contents with reverse engineering tools such as Ghidra or IDA Pro

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.