1

I rarely run Windows, but have some Windows software I'd like to take a look at. This doesn't require a security "dongle", but won't start without the presence of a particular USB-connected peripheral about which virtually nothing is known.

The software I have is Brother PE-Design Plus, which prepares .pes files for their embroidery machines. The hardware is described as "04f9:2100 Brother Industries, Ltd Card Reader Writer".

This is not at all "mission critical" for me since the machine I'm looking at can be configured using a USB "thumb drive", but older machines /have/ to be programmed via one of these writers.

The writers are scarce and expensive. Older variants for the same type of card were connected to a serial port, but the software I have appears to be USB-specific. The card has a chip under an epoxy blob, which is suspected to be a 512Kbyte Flash device.

After installation, the Brother software includes a file CardIO.dll, which encodes the correct USB vid:pid numbers and has what looks like card-related debugging messages and mangled C++ entry point names including ?ChkCardWriterConnected@CCardIO@@QAE?AW4CIOError@@HPAEPAH@Z

There is nothing in that file which indicates what type of device is expected (i.e. USB serial vs HID etc.) but my knowledge of the inside of Windows drivers is limited.

I was thinking that I might be able to program a Teensy (I think I've got a 3.5) to emulate the various USB device types and see if I could at least work out what sort of device type the Brother software was expecting. Otherwise I'm aware of e.g. https://hackaday.com/2019/07/02/hands-on-greatfet-is-an-embedded-tool-that-does-it-all/ and the Facedancer project, however I think that most things like this are more oriented to analysing available hardware rather than something unseen.

Wireshark on Windows shows nothing. I've not yet tried setting up Windows under Qemu (etc.) and seeing whether I can track anything at the hardware level, but I suspect that detection is based on a hotplug event which tells Windows that it is to respond positively to a presence query.

Any thoughts would be appreciated.

A few days later: It looks as though having any USB device with the correct vid:pid doublet is sufficient to get the Brother card reader driver loaded, but not to get the app running (and nothing useful shows up in Wireshark). I've been using a Teensy 3.5 set up as a rawhid device, I'm not sure whether the type of device matters since I suspect I'm up against OS caching issues which muddy the water.

0

My first approach would be, to collect traces from working system:

USB Event Tracing for Windows

If from this information cannot work out what is going on a software protocol analyzer, such as these:

http://www.sysnucleus.com/

https://www.usblyzer.com/

https://wiki.wireshark.org/CaptureSetup/USB

Sometimes I have had different results with a different tool so it can be worth trying different software protocol analyzers for your scenario. If this is not sufficient, in some cases it is necessary to finally resort to a hardware USB protocol analyzer. These can sit between the USB port and the device and capture everything without relying on software within the PC, helpful if the driver is explicitly trying to block/bypass software protocol analyzer.

I'm not familiar with this particular device but in some cases the detection is more complicated then simply detected particular type of device connected, in some case the USB device may contain information that the application would not be able to run unless that data was available.

Depending on your requirements sometimes a solution such as donglify which allows sharing USB dongles over a network can help meet needs.

For complex scenarios a complete dongle emulation is required. You may find examples of other work in this area searching internet for information on copying / emulating USB dongles, however there is not one generic solution for this.

If the actual working device is not available then I would use a combination of the following tools to analyze the program that is not launching without the hardware:

Process Monitor With this tool easy to observe if application is looking for specific files or registry keys. API Monitor Can analyze the app at the Windows API level. For example simply monitoring the C++ Runtime "Strings" operations may determine what it is looking for exactly.

WinDbg Time Travel Debugging

Reverse engineering software such as IDA Pro / Ghidra

8
  • I can assure you that it would be my approach as well- as it has been numerous times in the past- but virtually nobody has one of these devices. Nov 26 '20 at 14:01
  • I managed to have my company provide me one once for a project, but it was the only time i ever used one and very $$$, I have heard chap option is ezSniffer but I have not used it and probably more fiddling to get working Nov 26 '20 at 14:39
  • Sorry, you misunderstand. There's plenty of ways of sniffing USB these days: starting off with Wireshark (which I've already says doesn't help) and moving on through BeagleBones etc. The problem here is the device I'm trying to deduce the properties of: there's very few around and buying one second hand would probably knock me back £150 or so. Nov 26 '20 at 17:26
  • Is the software that doesn’t launch available for download somewhere? Nov 26 '20 at 21:10
  • Not legally, I've got a 2nd-hand CD and it's buried in installation files. Nov 26 '20 at 22:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.