On 2012.05.23 12:43, Pete Batard wrote: > I think I had a reference on how the hash from the Windows device > interface path is actually generated. I'll see if I can dig that up, as > someone actually went the trouble of reverse engineering it and it's > quite insightful...
Actually, now that I have found it, the info I got was for the ParentIDPrefix [1] of mass storage devices, which was identified as the CRC32 of Device Instance ID, as per [2]. And I should have used "Device Instance ID" instead of "Device Interface Path" in my reply above, though, as far as WinUSB is concerned, the Device Interface Path is mostly the Device Instance ID concatenated with a GUID. There is some info with regards to the Instance ID of the Device Instance ID though [3]: if the USB device has a serial number, then this is what is being used, regardless of the device location. If the device has no serial number however, then Windows generate its own Instance ID according to the location, most likely using another CRC32 hash, but with a location-dependent input value that is not known outside of Microsoft yet. Regards, /Pete [1] http://www.forensicswiki.org/wiki/USB_History_Viewing#Device_Information [2] http://www.msfn.org/board/topic/131770-solved-usbstick-take-letter-d-and-not-u/page__st__80__p__864895#entry864895 [3] http://www.osronline.com/ddkx/install/idstrings_8tt3.htm#ddk_device_instance_ids_dg ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ libusbx-devel mailing list libusbx-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/libusbx-devel
