USB UASP SCSI LOG not decoded?

asked 2023-01-26 08:55:50 +0000

Zibri gravatar image

updated 2023-01-26 09:15:00 +0000

If I try to log a USB UASP SCSI DEVICE (an external hdd in an USB/SATA enclosure with a JMICRON controller) I get this:

    Frame 286: 59 bytes on wire (472 bits), 59 bytes captured (472 bits) on interface \\.\USBPcap1, id 0
    Section number: 1
    Interface id: 0 (\\.\USBPcap1)
    Encapsulation type: USB packets with USBPcap header (152)
    Arrival Time: Jan 26, 2023 10:39:04.214840000 Egypt Standard Time
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1674722344.214840000 seconds
    [Time delta from previous captured frame: 0.000009000 seconds]
    [Time delta from previous displayed frame: 0.000009000 seconds]
    [Time since reference or first frame: 38.717323000 seconds]
    Frame Number: 286
    Frame Length: 59 bytes (472 bits)
    Capture Length: 59 bytes (472 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: usb]
    [Source: host]
    <Source or Destination: host>
    [Destination: 1.22.1]
    <Source or Destination: 1.22.1>
    USBPcap pseudoheader length: 27
    IRP ID: 0xffff810bfe09faa0
    IRP information: 0x00, Direction: FDO -> PDO
    URB bus id: 1
    Device address: 22
    Endpoint: 0x01, Direction: OUT
    URB transfer type: URB_BULK (0x03)
    Packet Data Length: 32
    [Response in: 287]
    [bInterfaceClass: Mass Storage (0x08)]
Leftover Capture Data: 0100000200000000000000000000000012018000fe0000000000000000000000

The issued SCSI command was obviously "12 01 80 00 fe 00" But it's not decoded as SCSI and show just as URB out.

What should I do to get a SCSI decoding?

On windows, on a cygwin shell I issued the command: sg_readcap and got this result:

READ CAPACITY (10) indicates device capacity too large
  now trying 16 byte cdb variant
Read Capacity results:
   Protection: prot_en=0, p_type=0, p_i_exponent=0
   Logical block provisioning: lbpme=0, lbprz=0
   Last logical block address=27344764927 (0x65ddfffff), Number of logical blocks=273447649
   Logical block length=512 bytes
   Logical blocks per physical block exponent=3 [so physical block length=4096 bytes]
   Lowest aligned logical block address=0
   Device size: 14000519643136 bytes, 1.33519e+007 MiB, 14000.5 GB

This is what wireshark/usbpcap logged

The data is all there.. scsi inq and so on.. but it's not decoded.. and all I see is this image description

edit retag flag offensive close merge delete


I made some more tests. If I configure the USB/BRIDGE without UASP, wireshark can correctly decode the traffic. But if UASP is enabled then it's not. As I have shown in this post.

Zibri gravatar imageZibri ( 2023-02-04 02:11:23 +0000 )edit