What (software) usb sniffers are available for win

问题:

Are there any software drivers for windows 7 (64-bit) that can report the data transferred between some application software and a usb device?

I have tried snoopy (http://sourceforge.net/projects/usbsnoop/) but I can't get it working. Possibly I would need to go down the route of installing an earlier version of windows.

Any other suggestions?

回答1:

Had decent luck with this tool many years ago. http://www.sysnucleus.com/

回答2:

USBPCap + Wireshark is a great new open-source solution that I recommend.

I've had good results with Event Tracing in Windows (ETW), as described at (link) (part 1) and in part 2 of that post. I remember the setup being somewhat involved though.

USBlyzer and USBTrace are both good products but they come with a $200 price tag. They both offer demo versions though and I've had good results with them. They're very easy to set up and use.

For a list of other tools see: here

回答3:

Here is a tutorial for installing and using a newer Windows 7 network monitor called Netmon.

http://blogs.msdn.com/b/usbcoreblog/archive/2009/12/04/etw-in-the-windows-7-usb-core-stack.aspx

I haven't tried it to see if it works. When I do, I will post an update saying whether it works with Windows 7 x64.

EDIT:

It worked on my Parallels Win7 x64 Virtual Machine.

The biggest downside was the massive amount of packets it logged. To help with this, the following filter can extract only the packets with your USB VID (vendor id), where the vid is 0xABCD.

// Following searches frame for hex data of 0xAB 0xCD

ContainsBin(FrameData, hex, "AB CD")

Note: As in the tutorial, to log usb packets, use the following commands in a cmd prompt run as an administrator:

Logman start Usbtrace -p Microsoft-Windows-USB-USBPORT -o usbtrace.etl -ets -nb 128 640 -bs 128

Logman update Usbtrace -p Microsoft-Windows-USB-USBHUB -ets

//Perform desired usb activities

Logman stop Usbtrace -ets

EDIT 2

UsbSnoop is another free option. I have confirmed that it works on my Win7 x64 machine.

http://www.pcausa.com/Utilities/UsbSnoop/

回答4:

busdog: http://code.google.com/p/busdog/

You need to enable test signing for 64 bit however

回答5:

USBPcap: http://desowin.org/usbpcap/ Works under XP, Vista, 7 and 8.

Still work in progress though so no end-user installer yet.

回答6:

Take a look at WDMSniffer by Compuware. It supports IRP, USB, 1394 (Firewire), SCSI, NDIS and TDI.

回答7:

Try SourceUSB from SourceQuest. They have a demo version too.

回答8:

Windows web site has devon I think they call it.

Is that what you want?