On 4 June 2010 22:27, waldo kitty <[email protected]> wrote: > On 6/4/2010 05:36, Mark Morgan Lloyd wrote: >> >> That's obviously going to complicate things if you're only sniffing a >> single device (small group of endpoints) or a single class. The sniffing >> software (and any decoders) are not going to be able to say "device x:y >> is now killing itself and will be resurrected as z:t" unless somebody's >> already reverse-engineered the loader- not impossible but not very >> likely either. > > right but one should be able to note the vid:pid (did i get that right?) > attached to a particular USB port and note that it changes within a specific > time period to a secondary and then within another certain time frame to a > tertiary vid:pid... as these will occur within a (presumably) very short > time period (guessing less than 2 or 3 seconds), it would appear to be "not > a human plugging, unplugging and switching devices" because a human won't be > able to do that in that short a time frame... plus there that if a human > /did/ try to do that, it would likely (?) result in the sequence starting > all over and running thru the three steps...
It may be tricky to note the change, but you're only really interested in seeing with what vid/pid it ends up with. Device manager shows you this. As I've noted, you can look in the inf file, since that should have all the vid/pid combinations in it already. Henry -- _______________________________________________ Lazarus mailing list [email protected] http://lists.lazarus.freepascal.org/mailman/listinfo/lazarus
