I rarely run Windows, but have some Windows software I'd like to take a look at. This doesn't require a security "dongle", but won't start without the presence of a particular USB-connected peripheral about which virtually nothing is known.
The software I have is Brother PE-Design Plus, which prepares .pes files for their embroidery machines. The hardware is described as "04f9:2100 Brother Industries, Ltd Card Reader Writer".
This is not at all "mission critical" for me since the machine I'm looking at can be configured using a USB "thumb drive", but older machines /have/ to be programmed via one of these writers.
The writers are scarce and expensive. Older variants for the same type of card were connected to a serial port, but the software I have appears to be USB-specific. The card has a chip under an epoxy blob, which is suspected to be a 512Kbyte Flash device.
After installation, the Brother software includes a file CardIO.dll, which encodes the correct USB vid:pid numbers and has what looks like card-related debugging messages and mangled C++ entry point names including ?ChkCardWriterConnected@CCardIO@@QAE?AW4CIOError@@HPAEPAH@Z
There is nothing in that file which indicates what type of device is expected (i.e. USB serial vs HID etc.) but my knowledge of the inside of Windows drivers is limited.
I was thinking that I might be able to program a Teensy (I think I've got a 3.5) to emulate the various USB device types and see if I could at least work out what sort of device type the Brother software was expecting. Otherwise I'm aware of e.g. https://hackaday.com/2019/07/02/hands-on-greatfet-is-an-embedded-tool-that-does-it-all/ and the Facedancer project, however I think that most things like this are more oriented to analysing available hardware rather than something unseen.
Wireshark on Windows shows nothing. I've not yet tried setting up Windows under Qemu (etc.) and seeing whether I can track anything at the hardware level, but I suspect that detection is based on a hotplug event which tells Windows that it is to respond positively to a presence query.
Any thoughts would be appreciated.
A few days later: It looks as though having any USB device with the correct vid:pid doublet is sufficient to get the Brother card reader driver loaded, but not to get the app running (and nothing useful shows up in Wireshark). I've been using a Teensy 3.5 set up as a rawhid device, I'm not sure whether the type of device matters since I suspect I'm up against OS caching issues which muddy the water.