| |
Descripton |
The USB Device Tree Viewer, short UsbTreeView is based upon the Microsoft "USBView" sample application found in the Windows Driver Development Kits and now standalone at GitHub.
But it is source code only, there is no executable for end users provided. Meanwhile USBView comes as executables as part of the "Debugging Tools für Windows", see here: USBView.
UsbTreeView started with the USBView source code from the DDK for Server 2003. Here are the improvements I've done:
- Informations from the Windows Device Management are collected and matched with the found USB devices; Therefore UsbTreeView can show the child devices, including drive letters and COM-ports
- Window position is saved
- Background color and font of the right pane can be set (the font shown in the screenshots is DOSLike 7)
- Keeps the tree item selection over refresh
- TreeView highlighting of arrived and removed devices
- Shows open handles on failed safe removal
- Way more descriptors are decoded, as Audio 2.0
- Hexdump of the descriptors can be shown
- Safe removal, device restart and port restart
- Extended USB information available under Windows 8 (taken from the latest USBView sample application)
- Extended information about host controllers
- Enumeration of the USB devices accelerated and independent from the treeview
- Failed USB requests are re-tried in the background, e.g. if a USB mouse was moved while requesting its properties
- Toolbar with jump-lists for easily finding devices in complex trees
- TreeView with handmade 16x16 icons, USBView used 32x32 icons scaled down to 15x15
- many minor improvements
With V3.0
- No more enumeration of all devices on arrival and removal of a USB device
- Search function (not full text, only things like device ID, drive letter, volume name etc)
- Some new Keyboard shortcuts (Alt+D to open the drives list, Alt+O the Others list, Alt+S to focus the
search edit, Alt+Left/Right to cycle thru the search hits
- Options not to expand empty hubs or hub with only empty hubs attached
- Options to jump to arrived and removed devices
- Option to expand tree items to make selected arrived and removed devices visible
- Uses Windows visual theme with option to turn it off
With V3.3
- Can write and read a report in XML format (not compatibel with USBview's)
|
|
| |
|
| |
Latest History |
Old History
V3.3.2
- Bugfix: Text report by command-line did not work since V3.3.0
V3.3.1
- Bugfix: Device arrivals not detected when registry contains wrong device path for a USB hub
V3.3.0
- New: Can write and read a report in XML format
V3.2.4
- Bugfix: Crash when showing open handle after failed safe removal of a device with a COM port
- Bugfix: guidExtensionCode in 'Video Control Extension Unit Descriptor' was not shown
- Bugfix: MessageBox was shown after writing a report by command-line
- New: Name of guidExtensionCode (e.g. 'YUY2') is extracted from the first four bytes of the GUID
V3.2.3
- Bugfix: Some strings for Smart Card Functional Descriptor where shown as question marks
- Bugfix: UVC frame intervals where shown without fraction of milliseconds for continuous frame type
V3.2.2
- Bugfix: UVC frame intervals where shown without fraction of milliseconds
V3.2.1
- Bugfix: Under XP the UsbTreeView process did not end after using "Safely Remove"
- New: Highlight color of selected item darker
V3.2.0
- New: TreeView highlighting as known from the SysInternals ProcessExplorer
- New: On failed 'safe removal' it shows open handles found for the device ID Windows returns as VetoName
- New: Shows global registry USB flags under HKLM\SYSTEM\CurrentControlSet\Control\UsbFlags and HKLM\SYSTEM\CurrentControlSet\Services\usbhub\hubg
V3.1.7
- New: Detects arrival of USB devices even its driver fails to start, e.g. if no driver is installed yet
- New: Detects childs of USB devices even they don't generate device notifications nor they are enumerated by SetupDiGetClassDevs (seen on Arduino Micro)
V3.1.6
- Bugfix: Device Qualifier Descriptor was requested even the device is running at SuperSpeed
V3.1.5
- New: Option to show the port chain instead the port number in the tree
- Bugfix: Some hexdumps where missing
- Bugfix: Device Qualifier Descriptor was requested for USB 1.x devices
V3.1.4
- New: Copy tree to clipboard function
- New: Text copied to clipboard as HTML fragment enclosed in <pre> tags to get a monospaced font offhand
- New: SmartCard Reader Feature Descritpor decoded
- Bugfix: Volume of CDROM drives not recognized on arrival
V3.1.3
- Bugfix: Wrong value shown for Clock Selector in Audio Control Clock Selector Unit Descriptor 2.0
- New: Full enumeration when missing USB device notifcation is detected (workaround for SILEX USB Device Servers)
V3.1.2
- Bugfix: Occasional crash on safe removal
- Bugfix: Since V3.0.6 no device information for UHCI controllers under Windows 2000
- Bugfix: wPacketSize decoded wrong if SuperSpeed device reported a Device Bus Speed of 0x02
V3.1.1 (06 May 2017)
- New: Can show multiple Configuration and Other-Speed-Configuration Descriptors
- New: TreeView sub-menu to copy some id strings to clipboard
V3.1.0 (24 Feb 2017)
- Bugfix: Removal of storage volumes not handled correctly
- New: Project is UNICODE now, so non-ASCII string descriptors are shown correctly even the Windows ANSI codepage cannot
- New: Improved robustness when decoding invalid descriptors
- New: Option "Always On Top"
V3.0.8 (01 Jan 2017)
- Bugfix: No more font change in the text pane when hitting some special charaters
V3.0.7 (09 Dec 2016)
- New: Improved detection of arrival/removal of child devices
- New: Devices in low power state and problem code 0 get a 'D1', 'D2' etc icon instead of an exclamation mark
- New: Workaround for a strange phenomenon: On some Windows device notifications come with wide strings even RegisterDeviceNotificationA was used; This is dealt with now.
V3.0.6 (10 Nov 2016)
- New: Support for virtual USB Controllers where Hostcontroller and Root-Hub are one and the same device
V3.0.5 (03 Nov 2016)
- New: Port property PortConnectorIsTypeC (Win10 only)
V3.0.4 (15 Aug 2016)
- New: Device Manager problem numbers shown in the treeview icons
V3.0.3 (29 June 2016)
- New: Search hits get highlighted in the text pane (which is a RichEdit control now)
V3.0.2 (16 June 2016)
- Bugfix: Dropdown lists not refreshed on device arrival and removal
V3.0.1 (13 June 2016)
- Bugfix: Crash on full refresh
V3.0.0 (12 June 2016)
- New: No more enumeration of all devices on arrival and removal of a USB device
- New: Search function (not full text, only things like device ID, drive letter, volume name etc)
- New: Toolbar controls shrink if required
- New: Some new Keyboard shortcuts (Alt+D to open the drives list, Alt+O the Others list, Alt+S to focus the
search edit, Alt+Left/Right to cycle thru the search hits
- New: options not to expand empty hubs or hub with only empty hubs attached
- New: options to jump to arrived and removed devices
- New: option to expand tree items to make selected arrived and removed devices visible
- New: Uses Windows visual theme with option to turn it off
|
|
| |
|
| |
Screenshots |
USB 1.1
Here we have an old XP Computer with one single USB 1.1 host controller. As every USB host controller it has exactly one USB root-hub. The root-hub has two ports, at port 1 there is a USB mass storage device attached which is mounted at drive letter Z:. Even the USB drive is USB 2.0 it is running at Full-Speed only because it is attached to a USB 1.1 hub.
USB 2.0
Here we have Win7 Computer with an Intel P35 chipset which has 8 USB 2.0 High-Speed capable ports. The 8 physical ports are split here: 4 USB 1.1 controllers deal with USB low and Full-Speed devices while one USB "Enhanced" controller deals with the High-Speed devices. I don't know why the 1.1 ports are split over 4 controllers with 2 ports each. Since all manufactures do this, there must be a good reason...
The USB High-Speed controllers usually have the keyword "Enhanced" in their device name. Since Vista the "USB Hub Capabilities" can be checked for the "HighSpeed" flag.
At port 1 of the Enhanced controller there is a USB High-Speed hub attached and at his port 4 there is a USB mass storage device attached which is thanks to USBDLM mounted at drive letter Z: again. Here it is running at High-Speed.
Newer Intel chipset have no more USB1 root hubs. Instead there are two integrated standard hubs which translate Low and Full-Speed into High-Speed. Intel calls them "Integrated USB 2.0 Rate Matching Hub".
USB 3.0
Here we have a Win8 Computer with a Texas Instrumens TUSB7340 USB SuperSpeed controller card. Windows 8 has native support for USB 3.0 SuperSpeed and an enhanced USB stack which delivers more information, e.g. which speed each port supports. Therefore UsbTreeView can show a 'H' in the icon of the high-speed ports and an 'S' for the SuperSpeed ports.
The TUSB7340 has 4 physical ports. 4 logical ports are for low, full and high-speed devices and another 4 for SuperSpeed devices. Windows 8 also delivers information about which logical ports belong together. In the screenshot you see that the selected port 4 has the CompanionPortNumber 8, this means that port 4 and 8 share the same physical port.
|
|
| |
|
| |
Identify simple BadUSB Devices |
Simple BadUSB devices are USB composite devices, so they keep their usual functionality but have an additional 'bad' function as a keyboard or a network adaptor.
By means of UsbTreeView you can check:
The BadUSB device demonstrated by Adam Caudill and Brandon Wilson at github.com looks like this:
======================== USB Device ========================
+++++++++++++++++ Device Information ++++++++++++++++++
Device Description : USB Composite Device
Device ID : USB\VID_13FE&PID_5201\6&1A941099&0&2
Driver KeyName : {36fc9e60-c465-11cf-8056-444553540000}\0021
Driver : C:\Windows\system32\DRIVERS\usbccgp.sys
Legacy BusType : PNPBus
Class : USB
Service : usbccgp
Enumerator : USB
Location Info : Port_#0002.Hub_#0006
Manufacturer Info : (Standard USB Hostcontroller)
Child Device 1 : Disk drive
Device ID : USB\VID_13FE&PID_5201&MI_00\7&17D1C3FF&0&0000
Class : USB
Child Device 2 : USB Input Device
Device ID : USB\VID_13FE&PID_5201&MI_01\7&17D1C3FF&0&0001
Class : HIDClass
Note that it is a Composite Device, that is has two child devices - the expected disk and the potentially bad keyboard.
A regular USB drive look like this:
======================== USB Device ========================
+++++++++++++++++ Device Information ++++++++++++++++++
Device Description : SanDisk Cruzer Edge
Device ID : USB\VID_0781&PID_556B\20043514800F42F2829F
Driver KeyName : {36fc9e60-c465-11cf-8056-444553540000}\0023
Driver : C:\Windows\system32\DRIVERS\USBSTOR.SYS
Legacy BusType : PNPBus
Class : USB
Service : USBSTOR
Enumerator : USB
Location Info : Port_#0002.Hub_#0006
Manufacturer Info : USB Storage Device
Child Device 1 : Disk
Device ID : USBSTOR\DISK&VEN_SANDISK&PROD_CRUZER_EDGE&REV_1.18\123
Class : DiskDrive
Volume : \\?\Volume{4d513cf0-6422-11e4-86f7-001b2157a355}\
Kernel Name : \Device\HarddiskVolume17
Mountpoint : Z:\
USBDLM can ask on arrival of a new keyboard or network device if it shall be activated:
http://www.uwe-sieber.de/usbdlm_help_e.html#badusb
|
|
| |
|
Uwe Sieber
Home: http://www.uwe-sieber.de/english.html |
