Hi, On Fri, Jul 04, 2003 at 01:40:00PM +0200, gnawa wrote: > > Can you post an URL to the full log, so I can check if the protocol > > is really similar? > > http://gnawa.homeunix.org/2300c_preview.LOG > http://gnawa.homeunix.org/2300c_scan.LOG
I had a quick look and may have missed some stuff but that's what I found out. I can see the following types of USB messages (scan log): -------------------------- control messages ------------------------------ 1) Control messages that send one byte of data to the device, e.g. URB 2162: 40 0c 83 00 00 00 01 00 (data: 0x41) Request type 40 means: host-to-device, send to the device itsself (not a specific interface or endpoint), vendor request (so the other rules in the USB spec for control messages do not apply). request is 0x0c, value is 0x83 2) Control messages that read one byte of data from the device, e.g. URB 2163: c0 0c 84 00 00 00 01 00 (data: 0x6c) Request type c0 means: device-to-host, send to the device itsself (not a specific interface or endpoint), vendor request request is 0x0c, value is 0x84 3) Control messages that write one byte of data to the device, e.g. URB 2167: 40 0c 85 00 00 00 01 00 (data: 0x11) request is 0x0c, value is 0x85 The message 1) seems to be always followed by 2), 3) or 4). So maybe it's used to select the register (or function) and message 2) is used to read data while 3) is for sending data? 4) Control messages that write 8 bytes of data to the device, e.g. URB 2170: 40 04 82 00 00 00 08 00 (data: 01 11 00 00 06 00 00 00) request is 0x04, value is 0x82 Message 4) seems to be used to initiate a bulk transfer (see below). Byte 5 of the data (06 in this example) and byte 6 (little-endian) is the number of bytes that will be transferred in the following bulk transfer. I don't know what the second byte of data (0x11) means. It's sometimes 0x11, sometimes 0x00. The fisrt byte of data seems to describe the direction of the following bulk-transfer: 01 is out (write), 00 is in (read). 5) Control messages that write 1 byte of data to the device, e.g. URB 3800: 40 0c 8b 00 00 00 01 00 (data: 0x00) request is 0x0c, value is 0x8b 6) Control messages that read 1 byte of data to the device, e.g. URB 3872: c0 0c 8a 00 00 00 01 00 (data: 0x73) request is 0x0c, value is 0x8a I'm not sure about those ones (5) and 6)), they only appear at the end of the scan and some URBs are missing here. -------------------------- bulk messages ------------------------------ 7) bulk-out tranfers: Different sizes are used. They are initiated by control message 4). Maybe the smaller buffers are used to set parameters, the bigger ones to set gamma tables or calibration. 8) bulk-in transfers: Different sizes. Seems to be split to more than one message sometimes. Looks like the windows driver used fixed buffer sizes of e.g. 0x500 bytes, 0x100 bytes or 0x40 bytes. If the number of bytes that should be read doesn't fit into that sizes, multiple buffers are read. E.g. to read 0x102 bytes, 0x100 and 0x40 are read and the last buffer is only filled with 2 bytes. Probably used for calibration and reading scan data. Ok, I think you now have enough information for more digging what that actually means. Bye, Henning
