Close

Hardware/Software investigation

A project log for USBShare.exe

Replacing unknown exe with opensource

stephengeorgeweststephengeorgewest 09/14/2021 at 16:020 Comments

 The usb hub has 2 un-connected ports. the 4 CH440G look to be the actual switches. CH9884 doesn't seem to have any data sheets online.

When the port is selected, it connects a generic usb hub. same Vendor/Product as a Monoprice "aquamini".

When the main hub is disconnected, it connects a device to the bus instead:
idVendor:                        0x1A86 = Nanjing Qinherg Electronics Co., Ltd.
idProduct:                       0xE041

Which I'm guessing is CH9884

The "Drivers" cd was a burned cd rom with USBShare.exe, and an installer, that I assume puts it somewhere and adds it to startup. I didn't run the installer. Running strings on the exe showed some usb.

VID_1A86&PID_E041
VID_1A86&PID_E040
VID_5131&PID_2007

I ran the exe through ghidra, to see if I could find anything, but I didn't find much. the USB identifiers, and some other strings. \(〇_o)/   I don't have the patience for this. I just decided to run the exe, and wireshark it.

version 1.0.0
Build: May 14 2011
Maybe it still works

Well, it puts a it turns green when connected to the usb hub, and ... well it turns green when not connected too. Turns red, then yellow when switching away.
In yellow state, the program continuously asks (I think it is just connected checks?):


Frame 31356: 44 bytes on wire (352 bits), 44 bytes captured (352 bits) on interface wireshark_extcap2440, id 0
USB URB
    [Source: host]
    [Destination: 2.4.0]
    USBPcap pseudoheader length: 28
    IRP ID: 0xffff898c72c27010
    IRP USBD_STATUS: USBD_STATUS_SUCCESS (0x00000000)
    URB Function: URB_FUNCTION_CLASS_INTERFACE (0x001b)
    IRP information: 0x00, Direction: FDO -> PDO
        0000 000. = Reserved: 0x00
        .... ...0 = Direction: FDO -> PDO (0x0)
    URB bus id: 2
    Device address: 4
    Endpoint: 0x00, Direction: OUT
        0... .... = Direction: OUT (0)
        .... 0000 = Endpoint number: 0
    URB transfer type: URB_CONTROL (0x02)
    Packet Data Length: 16
    [Response in: 31357]
    Control transfer stage: Setup (0)
    [bInterfaceClass: HID (0x03)]
Setup Data
    bmRequestType: 0x21
        0... .... = Direction: Host-to-device
        .01. .... = Type: Class (0x1)
        ...0 0001 = Recipient: Interface (0x01)
    bRequest: SET_REPORT (0x09)
    wValue: 0x0200
        ReportID: 0
        ReportType: Output (2)
    wIndex: 0
    wLength: 8
    bRequest: 9
    wValue: 0x0200
    wIndex: 0 (0x0000)
    wLength: 8
    Data Fragment: 5501000000000000

 In yellow state,  "Switch" gets enabled,

data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIEAAABWCAYAAADom/XHAAAEv0lEQVR4nO2dT2vjRhjGBZuYXupEtiVbf51T99DC7qFqmoUeurCXpBvosT2UOfTQnspSWOhlWdosOvfSTzH0kwjUW75G0Bd4epAsj+SxI6dQT6Tn8AMjZCn28xvNyHlf23J++xsf/fVPTSz+7Mzo+gYXL15g4fnw/AB+ECIII4RRjDCKEcXLmni5RLw8IwZi7RM6JegnVpZlIMNiQ4KiKECGAyUgegnu7u7wf3LoN2HoUAJCCUgpgXrnRgkGSJZl8P0AQRjWMlCCgZFlGRx3jvnCQxCGlGCIZFmGyXQKx53D9wOEUWyIBFLAsqwKAdn1ReUpEitBmu/zRkiIvZ/TH7Isgz2ZYOa48IyRIE+RqMHnKVL5kBfYNVxKYNsTzBzHIAmkgJWkyP/zC6QEj1eCQkJYFpI0b2yXwoKQ6j5KcHmKREhle3mMekoRsnpejjRZby+PVz1Hpkiq7e1z9xlDJWiGVQcvxTpMKZAkSR1Wnq4eq3K0R3h5zM2AK2FWVx8p9luHPHIMlqAiL0enkNXjKigpqpGbpMiLHGmiC15ztdCG25ZlWNOD+RIU5SgvrwCrsCVEHb6AVOSgBH2RQKZbL+F5mmxMA0II5RL/0OmAEpglQbFtUVdsfg6w8blAM0Ap2sdoHruxMKQEJklAKAGhBIQSEEpAKAGhBIQSEEpAKAGhBIQSEEpAKIGCFJp/96pVRQ/hQVXIw8BICXSBN+sLSf8l2KgAkhADqvmjBEWBVQWQtsA0X1cEr4tByyIQIZJq246K4kYxSnsfZb903fzS98pjQyVQq4fVqaAVpBRKhbESlnb90C47U4JvrBeqyiOlqrnvlcfGSrCuLFYqiVujd102ph/lzRGs7KMpON0q2gBKzcyVYBW+VCqJO1cLl+Rpop8OKMFjkWAdYrOSuEu1cPMY+qaU9nTQXF9QAkMk0N7bt6cE3XSg7WjetTDcFTolOKwEhBIQSkAoAaEEhBIQSkAoAaEEhBKQAUpwe3tLDoBREhx6JAwdSkAoAaEEhBIQSkAoAaEEhBKQRyJBs5PI0n6JNemvBOpX3CvbUm1vAOmhBK1exA0oQf8l2NpptEWCrc2lusbU9v797jN83BLs/CGsjs2l9zamFkpT6+HDoARtCbpeCXb1FeoaU7c2tR4+DErQYI81wc7m0pJGY+q9gg0PQyUo6n7C++8OdjWXNkXQfpcBMViCOtAOnxNsay7d9lO72qbWw4dBCQglIJSAUILDvxFDhhIQSkAoAdkmwaH/KEIJiAkSZFkGMiw2JPj15x8xuv6A0eU7HL98g6PzH3D07Fs8+ewKTz69vJezszN8PB5jPD7B+OQUJ6enOD21S+w1tm3DtifEACbTKRx3Dn8lwej6QynB1Xscv3qL469+KkVIvsfR59/dyydPn1YhT2BPpphMp5hOZyUzp2bmEFNw3DnmCw9BGCKKl4oE3/xeXg1evcXxyzc4/vqXTjx7/hwzx4XjunDdOdz5AvOFh/nCw8Lzazzfh+cHxAB8P0AQhgijuCXB65tShKv3GF2+68wX5+d14J7vw/cD+EEIPwgRhFFNGEUIo5gYQhQvEcVLxMszRYLrm5LXK/7oxJcXF5UAQR18+0TlycoTEvP4Fxm/q6h5bDNLAAAAAElFTkSuQmCCand Upon clicking "switch", it fires off:
Frame 31702: 36 bytes on wire (288 bits), 36 bytes captured (288 bits) on interface wireshark_extcap2440, id 0
USB URB
    [Source: host]
    [Destination: 2.4.0]
    USBPcap pseudoheader length: 28
    IRP ID: 0xffff898c81fc6970
    IRP USBD_STATUS: USBD_STATUS_SUCCESS (0x00000000)
    URB Function: URB_FUNCTION_SELECT_CONFIGURATION (0x0000)
    IRP information: 0x00, Direction: FDO -> PDO
        0000 000. = Reserved: 0x00
        .... ...0 = Direction: FDO -> PDO (0x0)
    URB bus id: 2
    Device address: 4
    Endpoint: 0x00, Direction: OUT
        0... .... = Direction: OUT (0)
        .... 0000 = Endpoint number: 0
    URB transfer type: URB_CONTROL (0x02)
    Packet Data Length: 8
    [Response in: 31705]
    Control transfer stage: Setup (0)
Setup Data
    bmRequestType: 0x00
        0... .... = Direction: Host-to-device
        .00. .... = Type: Standard (0x0)
        ...0 0000 = Recipient: Device (0x00)
    bRequest: SET CONFIGURATION (9)
    bConfigurationValue: 1
    wIndex: 0 (0x0000)
    wLength: 0

So, I guess that is it.

Discussions