USBTrace

A Windows USB protocol analyzer that captures and decodes USB traffic at the kernel level. USBTrace consists of a kernel-mode capture driver, a GUI application for real-time capture and analysis, and a set of decoder plug-ins for major USB device classes.

Features

• Real-time USB packet capture via IAT (Import Address Table) patching of USB driver images
• Per-device and per-class filtering
• Trigger-based capture (start/stop on matching patterns)
• Non-stop (circular buffer) capture mode
• Configurable capture buffer size (up to 4500 MB)
• Decoded view of USB requests, URBs, and data payloads
• USB device tree view with descriptor details
• Search within captured log data
• Export to HTML or native .utl log files
• Performance statistics view
• Supports x86 and x64 Windows

Supported USB Device Classes

Decoder	Class
HIDDecoder	Human Interface Device (HID)
HubDecoder	USB Hub
MSDDecoder	Mass Storage (Bulk-Only & CBI)
AudDecoder	Audio
CDCDecoder	Communications Device Class (CDC)
CCIDDecoder	Chip/Smart Card (CCID)
VidDecoder	Video
SICDecoder	Smart Card Interface Class
PHDCDecoder	Personal Healthcare Device Class
PrinterDecoder	Printer
TMCDecoder	Test & Measurement Class (USBTMC)
WCDecoder	Wireless / Bluetooth (BTDecoder + HWADecoder)
VendorDecoder	Vendor-specific fallback

Architecture

┌──────────────────────────────┐
│     USBTrace.exe (GUI)       │  MFC Document/View application
│   CMainFrame / CUSBTraceDoc  │
└────────────┬─────────────────┘
             │  IOCTL
┌────────────▼─────────────────┐
│    utdrv.sys (kernel driver) │  Privileged IAT-write helper (not a filter driver)
└──────────────────────────────┘
             │  per-packet data
┌────────────▼─────────────────┐
│   Decoder DLLs (plug-ins)    │  One DLL per USB device class
└──────────────────────────────┘

utdrv.sys is not a WDM filter driver attached to the USB device stack — DriverEntry (utdrv/Init.c) creates a plain control device (\Device\utdrv) for IOCTL communication and never calls IoAttachDeviceToDeviceStack/AddDevice. Instead, capture works by patching the Import Address Table (IAT) of the relevant driver images directly in kernel memory:

1. The GUI (CDriverMon in USBTrace/DriverMon.cpp) memory-maps the on-disk driver image (SEC_IMAGE) of the target driver (e.g. a USB device's function driver, or the hub driver usbhub.sys / Wdf01000.sys for enumeration events), walks its PE headers (IMAGE_DOS_HEADER → IMAGE_NT_HEADERS → import directory) to locate the IAT slots for key WDM entry points (IofCallDriver, IofCompleteRequest, PoCallDriver, IoCreateDevice), and combines that with the driver's runtime load base to compute the live IAT addresses.
2. Those addresses are sent to utdrv.sys via IOCTL_UTDRV_START_MONITOR / IOCTL_UTDRV_START_MONITOR_FOR_DEVARRIVAL (utdrv/ioctl.c), which overwrites the IAT entries with proxy trampolines (saving the originals for restore on stop). The trampolines log each IRP and then jump to the original routine, so target drivers keep functioning unmodified.
3. Hooking IoCreateDevice on the hub driver specifically catches new child PDO creation the instant a device is plugged in, letting utdrv immediately begin patching that new device's own driver — which is how enumeration traffic is captured despite there being no filter device object attached ahead of time.

The GUI reads raw USB packets captured this way and passes them to the appropriate decoder DLL based on the USB class of the device. Decoded results are displayed in a list view with expandable detail panes.

Requirements

To run

• Windows 2000 or later (x86 or x64)
• Administrative privileges (required to load the kernel driver)
• The utdrv.sys driver and all decoder DLLs must be in the same directory as USBTrace.exe

To build

• Visual Studio 2012 (toolset v110 / v110_xp)
• Windows 7 DDK (WDK 7600.16385.1) installed at D:\WINDDK\7600.16385.1\
  • The driver project (utdrv) uses the DDK build system
  • If your DDK is installed elsewhere, update the include/library paths in utdrv\sources and the project property sheets

Building

Open USBTrace\USBTrace.sln in Visual Studio 2012. The solution contains the main application and all decoder DLL projects.

Win32 Release:

msbuild USBTrace\USBTrace.sln /p:Configuration=Release /p:Platform=Win32

x64 Release:

msbuild USBTrace\USBTrace.sln /p:Configuration=Release /p:Platform=x64

Kernel driver (utdrv) must be built separately using the DDK build environment:

cd utdrv
build -cZ

Or open a WDK build command prompt and run build in the utdrv directory for the target architecture.

Project Structure

USBTrace/          Main GUI application (MFC)
utdrv/             Kernel-mode IAT-patch helper driver (WDM/WDK)
HIDDecoder/        HID class decoder DLL
HubDecoder/        Hub class decoder DLL
MSDDecoder/        Mass Storage decoder DLL
AudDecoder/        Audio class decoder DLL
CDCDecoder/        CDC decoder DLL
CCIDDecoder/       CCID decoder DLL
VidDecoder/        Video decoder DLL
SICDecoder/        Smart Card Interface decoder DLL
PHDCDecoder/       PHDC decoder DLL
PrinterDecoder/    Printer class decoder DLL
TMCDecoder/        USBTMC decoder DLL
WCDecoder/         Wireless/BT decoder DLL (contains BTDecoder and HWADecoder)
VendorDecoder/     Vendor-specific fallback decoder DLL

Third-Party Components

The following third-party code is included in the USBTrace/ source tree:

Component	Author	License
HLinkCtrl/ — Hyperlink control	PJ Naughter	Permissive (attribution required)
CPPToolTip/ — Tooltip with HTML rendering	Eugene Pustovoyt	Free for OSS/freeware use
Graph/2DPushGraph.* — Push graph control	Stuart Konen	No explicit license
HexEdit/ — Hex editor control	Various	See individual file headers
smtp/ — SMTP client	PJ Naughter	See file header
inc/usb.ids.txt — USB vendor/device ID database	Linux USB Project	GPL

License

This project is released under the GNU General Public License v2 (or later). See LICENSE for details.

The USB ID database (USBTrace/inc/usb.ids.txt) is from the Linux USB project and is also GPL-licensed.