USB Endpoint

The USB Endpoint plugin was designed with developers of non-standard USB devices in mind and is also an invaluable tool for those looking to reverse engineer USB interfaces. It provides direct, low-level access to USB transactions, making it indispensable when standard USB classes and system-level drivers fall short. Powered by the libusb library, the plugin offers an intuitive, interactive interface for sending and receiving data over a range of USB transfer types, bridging the gap for custom and proprietary USB development scenarios.

Capabilities

Required

org.jancy.io.usb

Required for low-level IO operations on USB endpoints.

Basic Setup

1. If on Windows, ensure that your USB device is associated with a supported driver before starting. You can follow Microsoft’s official guide, or use a tool such as Zadig.

2. In IO Ninja, click the “New Session” dropdown and select a new “USB Endpoint” session

3. From the “Device:” dropdown menu, select the USB device you want to communicate with.

4. Open the device by clicking the “Open Device” button on the far side of the dropdown menu.

5. In the “Control” pane, check the USB interfaces you want to claim, and press the “Claim” button.

6. In the “Control” pane, check the In-endpoints you want to read, and press the “Read” button.

7. In the “Control” pane, select the OUT-endpoint.

8. In the “Control” pane’s “USB control transfer” section, send parameters such as request type, value, and index using the built-in form. Check the log to monitor communications.

9. Adjust settings as needed via the “Settings” button (see “Settings” section below for details)

Settings

Setting	Description	Default
Device	The target USB device.
Auto-detach (Linux and Mac-only)	Some devices may already have a kernel driver attached. If this setting is set to “True”, the plugin will automatically detach any currently attached kernel driver (when possible) so it can communicate directly with the device. If this setting is set to “False”, you’ll have to detach the kernel driver manually or ensure a compatible driver (like WinUSB) is already in use before the plugin can access the device.	True
Direction	Specifies whether the transfer is “In” (device-to-host) or “Out” (host-to-device). See available options.	In
Recipient	Recipient of the USB control transfer. See available options.	Device
Type	Class of the USB control request code. See available options.	Standard
Request	Code of the USB control request. See available options.	0
Value	The 1st parameter of the USB control request.	0x0000
Index	The 2nd parameter of the USB control request.	0x0000
Use read timeout	For control transfers, timeouts do not apply, as a control transfer always waits for the device response and completes. For bulk/interrupt/isochronous transfers, if this setting is set to ON, read parallelism is disabled, allowing only one ongoing transfer. This transfer completes either when the Read block size is filled or when the Read timeout expires. If Use read timeout is set to OFF (default), read parallelism is enabled and Read block size is ignored; transfers are performed using the “native” size defined in the USB descriptor for that endpoint.	False
Read timeout	Specify the timeout for USB read transfers.	1000
Read parallelism	Maximum number of read requests to issue in parallel. Having more than one pending read at a time helps with increasing read throughput when incoming data arrives in rapid streams (after filling one user buffer, the kernel can immediately switch to the next one without any waiting). Increasing this number beyond 4 usually won’t yield any extra performance gains.	4
Read block size (B)	The size of each individual read block submitted to the underlying transport.	4KB
RX buffer size (B)	The full size of the incoming data (RX) buffer. Affects read throughput.	64KB
TX buffer size (B)	The full size of the outbound data (TX) buffer. Affects write throughput.	2KB
Keep read block size	Don’t merge read blocks in RX buffer. Incoming data blocks coming in quick succession can be merged together so that IO Ninja writes them to log as a whole. When this option is set to True, blocks are written to the log without merging, i.e., exactly as they are received from the underlying transport.	False
Keep write block size	Don’t merge write blocks in TX buffer. Outbound data blocks sent in quick succession can be merged together before submission to the underlying transport. When this option is set to True, blocks are submitted to the transport without merging, i.e., exactly as they are sent by the Transmit or Script panes.	False
RX buffer full notifications	Toggle warnings in log about the incoming data (RX) buffer getting full.	False
Control transfer buffer size	Specify the size of a buffer for control IN transfers.	1024 (bits)

Direction Options

Option	Description
In	Device-to-host data flow (IN endpoint)​.
Out	Host-to-device data flow (OUT endpoint)​.

Recipient Options

Option	Description
Device	The request is directed to the device as a whole.
Interface	The request targets a specific interface on the device​.
Endpoint	The request targets a specific endpoint on the device.
Other	The request is for an unspecified recipient (not device, interface, or endpoint)​.

Type Options

Option	Description
Standard	A standard request (defined by core USB specifications).
Class	A class-specific request (defined by a USB device class).
Vendor	A vendor-specific request​.

Request Options

Option	Description
Get Status	Request the status of the specified recipient​.
Clear Feature	Clear or disable a specific feature on the recipient​.
Set Feature	Set or enable a specific feature on the recipient.
Set Address	Assign a device address for all future communications​.
Get Descriptor	Retrieve the specified descriptor from the device.
Set Descriptor	Update or add a descriptor on the device.
Get Configuration	Get the current device configuration value.
Set Configuration	Set the device’s configuration.
Get Interface	Return the currently selected alternate setting for a given interface​.
Set Interface	Select an alternate setting for a given interface​.
Synch Frame	Set then read an endpoint’s synchronization frame number.