A Windows USB protocol analyzer that captures and decodes USB traffic at the kernel level. USBTrace consists of a kernel-mode capture driver, a GUI application for real-time capture and analysis, and a set of decoder plug-ins for major USB device classes.

• Real-time USB packet capture via IAT (Import Address Table) patching of USB driver images
• Captures entire device enumeration traffic
• Per-device and per-driver/device-object filtering
• Trigger-based capture (start/stop on matching patterns)
• Non-stop (circular buffer) capture mode
• Configurable capture buffer size (up to 4500 MB)
• Decoded view of IRPs, USB requests, URBs, and data payloads
• USB device tree view with descriptor details
• Search within captured log data
• Export to HTML or native .utl log files
• Performance statistics view
• Supports x86 and x64 Windows

┌──────────────────────────────┐
│     USBTrace.exe (GUI)       │  MFC Document/View application
│   CMainFrame / CUSBTraceDoc  │
└────────────┬─────────────────┘
             │  IOCTL
┌────────────▼─────────────────┐
│    utdrv.sys (kernel driver) │  Kernel mode hook driver to intercept USB traffic
└──────────────────────────────┘
             │  per-packet data
┌────────────▼─────────────────┐
│   Decoder DLLs (plug-ins)    │  One DLL per USB device class
└──────────────────────────────┘

utdrv.sys is not a WDM filter driver attached to the USB device stack — DriverEntry (utdrv/Init.c) creates a plain control device (\Device\utdrv) for IOCTL communication and never calls IoAttachDeviceToDeviceStack/AddDevice. Instead, capture works by patching the Import Address Table (IAT) of the relevant driver images directly in kernel memory:

1. The GUI (CDriverMon in USBTrace/DriverMon.cpp) memory-maps the on-disk driver image (SEC_IMAGE) of the target driver (e.g. a USB device's function driver, or the hub driver usbhub.sys / Wdf01000.sys for enumeration events), walks its PE headers (IMAGE_DOS_HEADER → IMAGE_NT_HEADERS → import directory) to locate the IAT slots for key WDM entry points (IofCallDriver, IofCompleteRequest, PoCallDriver, IoCreateDevice), and combines that with the driver's runtime load base to compute the live IAT addresses.
2. Those addresses are sent to utdrv.sys via IOCTL_UTDRV_START_MONITOR / IOCTL_UTDRV_START_MONITOR_FOR_DEVARRIVAL (utdrv/ioctl.c), which overwrites the IAT entries with proxy trampolines (saving the originals for restore on stop). The trampolines log each IRP and then jump to the original routine, so target drivers keep functioning unmodified.
3. Hooking IoCreateDevice on the hub driver specifically catches new child PDO creation the instant a device is plugged in, letting utdrv immediately begin patching that new device's own driver — which is how enumeration traffic is captured despite there being no filter device object attached ahead of time.
4. The capture code is written in x86, IA64, x64 assembly for absolute control and for not disturbing/leaving traces in the stack and registers.

The GUI reads raw USB packets captured this way and passes them to the appropriate decoder DLL based on the USB class of the device. Decoded results are displayed in a list view with expandable detail panes.

• Windows 2000 or later (x86 or x64)
• Administrative privileges (required to load the kernel driver)
• The utdrv.sys driver and all decoder DLLs must be in the same directory as USBTrace.exe

• Visual Studio 2012 (toolset v110 / v110_xp)
• Windows 7 DDK (WDK 7600.16385.1) installed at D:\WINDDK\7600.16385.1\
  • The driver project (utdrv) uses the DDK build system
  • If your DDK is installed elsewhere, update the include/library paths in utdrv\sources and the project property sheets

Open USBTrace\USBTrace.sln in Visual Studio 2012. The solution contains the main application and all decoder DLL projects.

Win32 Release:

msbuild USBTrace\USBTrace.sln /p:Configuration=Release /p:Platform=Win32

x64 Release:

msbuild USBTrace\USBTrace.sln /p:Configuration=Release /p:Platform=x64

Kernel driver (utdrv) must be built separately using the DDK build environment:

cd utdrv
build -cZ

Or open a WDK build command prompt and run build in the utdrv directory for the target architecture.

USBTrace/          Main GUI application (MFC)
utdrv/             Kernel-mode IAT-patch helper driver (WDM/WDK)
HIDDecoder/        HID class decoder DLL
HubDecoder/        Hub class decoder DLL
MSDDecoder/        Mass Storage decoder DLL
AudDecoder/        Audio class decoder DLL
CDCDecoder/        CDC decoder DLL
CCIDDecoder/       CCID decoder DLL
VidDecoder/        Video decoder DLL
SICDecoder/        Smart Card Interface decoder DLL
PHDCDecoder/       PHDC decoder DLL
PrinterDecoder/    Printer class decoder DLL
TMCDecoder/        USBTMC decoder DLL
WCDecoder/         Wireless/BT decoder DLL (contains BTDecoder and HWADecoder)
VendorDecoder/     Vendor-specific fallback decoder DLL

The following third-party code is included in the USBTrace/ source tree:

This project is released under the GNU General Public License v2 (or later). See LICENSE for details.

The USB ID database (USBTrace/inc/usb.ids.txt) is from the Linux USB project and is also GPL-licensed.