Reverse engineering USB peripheral driver

Question

I'm looking to reverse engineer a Windows driver for a printer I have here. I found out a bit about USB sniffing but I don't think Snoopy runs on Windows 7. I know the driver is on my computer somewhere but it's location is not obvious. Can someone outline the steps I will need to take to accomplish this? I've never done this before 😐. There's a lot on the web but it is a bit confusing as to which direction to go. I'm using python 3

Answer 1

Well, your question is a bit broad as it stands, but let's take it one by one. Typically (but not always) drivers for printers these days are user mode drivers (UMDF), which means you're looking for a DLL. If that were not the case you'd be looking for a .sys file of some kind.

Microsoft has come up with a number of "simplified" driver models over the years. Some of those run in user mode, some in kernel mode. Provided this is a modern device and the vendor has updated everything, they'll be using the user mode driver.

In order to get you started you need to first figure out the driver responsible for your printer. Assuming you are indeed dealing with a USB printer, you should see it with USBDeView which also helps you identify the driver name. Alternatively try the more generic DevManView.

Failing all that you can look at the printer properties and use the Sharing tab, provided you're on a recent version of Windows. There you can see the type of your installed driver, at least. Example for one of my printers:

Equipped with that information we can then look into the folder C:\Windows\System32\spool\drivers (%SystemRoot%\System32\spool\drivers) and find the actual driver (also check the prtprocs subfolder instead of drivers).

Furthermore you could peek into HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers using the Registry Editor built into Windows in order to find details about your driver. Specifically within the subkey corresponding to the printer in question you should find a value named Print Processor (type string) which contains the name of the print processor. In my case that's ssa7mPC and this in turn can be tracked down to the DLL C:\Windows\System32\spool\prtprocs\x64\ssa7mpc.dll.

From that point on it's not at all clear from your question what you want to achieve. I.e. do you want to intercept something or do you want to reverse engineer the wire protocol or do you only care about being able to talk to the printer and so on ... (so until you clarify, I cannot provide more details either).

Since you also give no information about the printer model, it's hard to provide any meaningful detail beyond what I just gave.

Answer 2

I am more familiar with linux but some steps are similar. To find where is your driver, I believe that if you plug your device and go in the Device Manager, click right on the device then properties, you can find the path to the driver. To reverse engineer the protocol, you can use a combination of driver disassembly (using radare, IDA or other tools) and USB sniffing/capturing. I usually find it easier to capture USB traffic when running a virtual machine. Wireshark can do it on Linux and apparently on Windows too, see this page. It will help tremendously if your device uses a known protocol like serial or SCSI over USB, otherwise you will really have to learn about USB, this is a good start.

Answer 3

Answers to this question deal with generic reversing of USB devices, but if you want to start from the driver files, find the printer in Device Manager, go to properties, then Driver tab-Driver details... to see the driver files. MSDN topics on printer driver development or WDK samples may be useful too.