Content here is by Michael Still All opinions are my own.
See recent comments. RSS feed of all comments.

SnoopyPro is a Windows device driver / application combination which shows you the traffic between a USB device and it's driver. It's useful for reverse engineering USB device drivers, and general driver debugging.

The SnoopyPro user interface is however quite hard to use. This is a simple command line log dumper, which means you can then use your favourite text processing tools to analyse the logfile.

Note that the latest version of the code is always available: as a directory, a tarball, and as a cvsweb page.

Mon, 03 Jan 2005

Usblogdump Version 0.4 released

    And available for download from
    New features in this version:

    • URB flag decoding
    • Started on flag parsing code
    • Support for external decoders
    • Binary output mode
    • Bulk data transfers dump cleanup
    • Fixed a silly omission in the string lookup code
    • Rolled in bulk transfers decoding patch
    • Fixed last night regressions
    • Can now parse usb stepper motor idle traffic correctly

    Let me know if you have any comments...

posted at: 16:39 | path: /usblogdump | permanent link to this entry

Thu, 30 Dec 2004

Bulk transfer dumping

    I'm just finishing up integrating and testing the bulk transfer decode patch from Hin-Tak Leung, which will mean that the next version of usblogdump will include decoding for interrupt and bulk transfers, which will be nice. That means that it has all the decoding smarts it needs for the USB stepper motor I am playing with at the moment. I'll give more details on that later, as having a decoded dump is just a step along the way to understanding how the device works.

    I've also pulled the regression test suite out of the main download, which will make that a lot smaller. I've also started compressing the regression output, which is something that I should have been doing all along.

    If anyone has usblog files their having trouble decoding, now is the time to let me know while I'm on a roll...

posted at: 21:25 | path: /usblogdump | permanent link to this entry

Hacking on usblogdump again

    Well, I've spent some of the evening mostly ignoring Happy Gilmore and hacking away on usblogdump. The motivation? Well, I needed bulk and interrupt transfers to work better to help me analyze a USB stepper motor I'm playing with at the moment. Anyways, I've got that working but it has introduced some fairly significant regressions in the rest of the parsing test suite. I'll look into those hopefully tomorrow, and then have something more worth talking about here.

    Anyways, just wanted y'all to know there is movement at the station.

posted at: 03:45 | path: /usblogdump | permanent link to this entry

Sat, 28 Jun 2003

Bug fix

    It turns out that the initial version of the code had a bug when an unknown URB could cause a segmentation fault. This has been fixed in the version of the code available on this website, and usblogdump should now just abort...

posted at: 07:00 | path: /usblogdump | permanent link to this entry

Fri, 27 Jun 2003

Sample output

posted at: 07:00 | path: /usblogdump | permanent link to this entry

usblogdump Released

    In the words of the annoucement email:
      Subject: [Announce] Linux command line Snoopy Pro logfile dumper
      I had two maths exams last week. This of course means that I had to find 
      something to distract me. That thing was whipping up a SnoopyPro logfile 
      dumper for the command line. This was motivated by generalised frustration 
      with the SnoopyPro user interface.
      For those wondering, SnoopyPro is a Source Force hosted USB traffic dumper
      for Windows. It's useful when reverse engineering USB device drivers.
      This version of the dumper only implements the URB types which I 
      immediately needed. Adding additional URBs isn't hard, but I didn't have 
      any samples. Feel free to mail me usblogs, and I'll add them to the 
      The only really cool feature in this version is that it implements 
      "repeated URB sequence suppression", so if the Windows driver says to the 
      USB device "hey, you still there" every second for 60 seconds, and there 
      is no other traffic between the machine and that device, then the output 
      will only show one of those interactions, and let you know it hid 59 more. 
      This feature can be turned on and off with the -r command line option.
      You can get the GPL'ed CVS version of the source code from:
      There is sample output et cetera at:
      The next step is to modify the display of the URBs so that they're closer 
      to the Linux data structures.
      Michael Still ( | Stage 1: Steal underpants            | Stage 2: ????
      UTC + 10                          | Stage 3: Profit

posted at: 07:00 | path: /usblogdump | permanent link to this entry