{ "added_at": "2026-11-03", "additional_evidence_urls": [ "https://github.com/desowin/usbpcap/blob/477b6edcbd7e99a47f77afc0c4168a9ebee603bb/USBPcapCMD/cmd.c#L1118-L1182", "https://github.com/desowin/usbpcap/blob/477b6edcbd7e99a47f77afc0c4168a9ebee603bb/USBPcapDriver/USBPcap.inx", "https://github.com/desowin/usbpcap/blob/477b6edcbd7e99a47f77afc0c4168a9ebee603bb/USBPcapDriver/USBPcapMain.c#L1-L5", "https://github.com/desowin/usbpcap/blob/477b6edcbd7e99a47f77afc0c4168a9ebee603bb/nsis/USBPcap.nsi#L84-L125", "https://github.com/desowin/usbpcap/blob/477b6edcbd7e99a47f77afc0c4168a9ebee603bb/config.bat", "https://github.com/desowin/usbpcap/tree/477b6edcbd7e99a47f77afc0c4168a9ebee603bb/certificates", "https://github.com/desowin/usbpcap/blob/477b6edcbd7e99a47f77afc0c4168a9ebee603bb/nsis/gpl-2.0.txt", "https://github.com/desowin/usbpcap/blob/477b6edcbd7e99a47f77afc0c4168a9ebee603bb/nsis/bsd-2clause.txt", "https://github.com/desowin/usbpcap/releases/tag/1.5.4.0", "https://desowin.org/usbpcap/", "https://desowin.org/usbpcap/tour.html", "https://desowin.org/usbpcap/capture_limitations.html", "https://desowin.org/usbpcap/captureformat.html" ], "category": "protocol-analysis", "description_en": "Tomasz Moń's open-source USB packet capture for Windows. A filter driver installed in the Windows USB device stack records the USB Request Blocks (URBs) exchanged with devices on each root hub, and USBPcapCMD writes them to pcap files in the LINKTYPE_USBPCAP format, which Wireshark dissects. Since 1.2.0.0 the project has recommended running USBPcapCMD as a Wireshark extcap: each root hub then appears as a capture interface, with options to capture selected, all or newly connected devices and to add the descriptors of devices that are already attached.", "description_zh": "Tomasz Moń 开发的开源 Windows USB 抓包工具。安装在 Windows USB 设备栈中的过滤驱动会记录各根集线器上设备收发的 USB 请求块（URB），再由 USBPcapCMD 写成 LINKTYPE_USBPCAP 格式的 pcap 文件，供 Wireshark 解析。从 1.2.0.0 版起，项目推荐把 USBPcapCMD 作为 Wireshark extcap 使用：每个根集线器会显示为一个抓包接口，可选择抓取指定设备、全部设备或新接入的设备，还能把已连接设备的描述符补进抓包数据。", "entry_url": "https://awesomerea.org/resources/usbpcap/", "entry_url_zh": "https://awesomerea.org/zh/resources/usbpcap/", "evidence_url": "https://github.com/desowin/usbpcap/blob/477b6edcbd7e99a47f77afc0c4168a9ebee603bb/README", "group": "tools", "id": "usbpcap", "json_url": "https://awesomerea.org/resources/usbpcap/record.json", "kind": "tool", "markdown_url": "https://awesomerea.org/resources/usbpcap/index.md", "markdown_url_zh": "https://awesomerea.org/zh/resources/usbpcap/index.md", "name": "USBPcap", "name_zh": "USBPcap Windows USB 抓包工具", "record_type": "resource", "relationship": "foundation", "requirements": [ "Latest release at review: 1.5.4.0, published 2020-05-22, with a digitally signed USBPcapSetup installer for x86 and x64 Windows 7, 8 and 10 and a source archive that includes debug symbols. The reviewed master commit (2025-01-25) adds two unreleased driver fixes on top of it, one marked critical, for kernel buffer reallocation and the order of read completions. The installer refuses Windows versions older than 7 (1.5.3.0 was the last release for XP and Vista) and Windows To Go, asks Windows 7 users to install a SHA-2 update (KB3033929 or KB4474419) first, and requires a reboot after installation.", "Capture runs on the analyst's own Windows machine. Either run USBPcapCMD.exe to choose a root-hub filter instance and an output file, or copy it into Wireshark's global or personal extcap folder; USBPcap support has been in Wireshark since 1.10.0rc1. The README notes that there is no capture engine DLL. The project's tour recommends capturing newly connected devices, or reconnecting a device after capture starts, so that its descriptors appear in the capture for Wireshark's dissectors.", "Per the README, source builds use Windows Driver Kit 7.1.0 for the Windows 7 driver, or Visual Studio 2013 with WDK 8.1 Update for the Windows 8 build. Release drivers are attestation-signed through Microsoft's Hardware Dev Center with the author's own, non-public certificate. Self-built drivers are signed with the committed test certificate (certificates/USBPcapTestCert.*) and, as the README explains, load on 64-bit Windows only with test signing enabled. The only other committed binaries are the NSIS SysRestore.dll installer plugin and two public CA cross-certificates.", "The project's capture-limitations page says USBPcap records URBs passed between the stack's functional and physical device objects. It therefore does not show bus states, packet IDs, split transactions, wire timing or transfer speed, nor the enumeration that happens before a device has its address; the page says those appear only in a hardware USB sniffer. Interpreting the captured payloads remains the analyst's own protocol work in Wireshark or another dissector.", "The README and SPDX headers license the driver under GPL-2.0 and USBPcapCMD under BSD-2-Clause. GitHub detects no license because there is no license file at the repository root; the texts are in nsis/ and wix/." ], "requirements_zh": [ "审阅时最新版本为 1.5.4.0，发布于 2020-05-22，提供经数字签名的 USBPcapSetup 安装程序（适用于 x86 和 x64 的 Windows 7、8 和 10），以及附带调试符号的源码包。所审阅的 master 提交（2025-01-25）在此基础上新增两项尚未发布的驱动修复，其中一项标为关键修复，分别涉及内核缓冲区重新分配和读取请求的完成顺序。安装程序不支持早于 Windows 7 的系统（1.5.3.0 是最后支持 XP 和 Vista 的版本），也不支持 Windows To Go；Windows 7 用户需先安装 SHA-2 更新（KB3033929 或 KB4474419），安装后须重启。", "抓包在分析者自己的 Windows 电脑上进行。可直接运行 USBPcapCMD.exe，选择根集线器过滤实例和输出文件；也可以把它复制到 Wireshark 的全局或个人 extcap 文件夹，Wireshark 自 1.10.0rc1 起支持 USBPcap。README 提到目前没有抓包引擎 DLL。项目教程建议抓取新接入的设备，或在开始抓包后重新插拔设备，使设备描述符进入抓包数据，供 Wireshark 解析器使用。", "按 README 说明，从源码构建 Windows 7 驱动需要 Windows Driver Kit 7.1.0，Windows 8 版本则需要 Visual Studio 2013 和 WDK 8.1 Update。正式发布的驱动由作者使用自己未公开的证书，经 Microsoft Hardware Dev Center 进行认证签名。自行构建的驱动使用仓库中的测试证书（certificates/USBPcapTestCert.*）签名；README 说明，在 64 位 Windows 上需开启测试签名模式才能加载。仓库中其余的二进制文件只有 NSIS 安装插件 SysRestore.dll 和两份公开的 CA 交叉证书。", "项目的抓包限制页面说明，USBPcap 记录的是在设备栈的功能设备对象与物理设备对象之间传递的 URB，因此看不到总线状态、包标识（PID）、拆分事务、线上时序和传输速率，也看不到设备获得地址之前的枚举过程；该页面称这些只能由硬件 USB 嗅探器看到。抓到的数据如何解读，仍需分析者在 Wireshark 或其他解析器中自行完成协议分析。", "README 和 SPDX 文件头声明，驱动采用 GPL-2.0，USBPcapCMD 采用 BSD-2-Clause。仓库根目录没有许可证文件，许可证文本位于 nsis/ 和 wix/ 中，因此 GitHub 未识别出许可证。" ], "targets": [ "protocol" ], "url": "https://github.com/desowin/usbpcap", "verification": "source-reviewed", "verified_at": "2026-10-27" }