RNDIS-ECM及MBIM报文简述.docx

RNDIS/ECM/MBIM报文简述本文对USBCDC中三种较常见的CommunicationClass报文内容进行了简单的描1.RNDIS相关资料为RemoteNDISSpecification,VL1August9,2002o其报头格式如表1所示。表1Remote-NDIS报头OffwtSizeFieldDescription04MessageTypeSpecifiestheRemoteNDISmessagetype.ThisissettoREMoTE一NDlS-PAeKET一MSG=0x1.44MessageLengthMessagelengthinbytes,includingappendedpacketdata,out-of-banddata,per-packet-infodata,andbothInternalandexternalpadding.84DataOffsetSpecifiestheoffsetinbytesfromthestartoftheDataOffsetfieldofthismessagetothestartofthedata.Thisisanintegermultipleof4.124DataLengthSpecifiesthenumberofbytesInthedatacontentofthismessage.164OOBDataOffsetSpecifiestheoffsetinbytesofthefirstoutofbanddatarecordfromthestartoftheDataOffsetfieldofthismessage.SettoOIfthereisnoout-of-banddata.Otherdsethisisanintegermultipleof4.204OOBDataLengthSpecifiesinbytesthetotallengthoftheoutofbanddata.244NumOOBDataEIementsSpecifiesthenumberofoutofbandrecordsinthismessage.284PerPacketInfoffsetSpecifiesInbytestheoffsetfromthebeginningoftheDataOffsetfieldintheREMOTE_NDIS_PACKET_MSGdatamessagetothestartofthefirstperpacketinfodatarecord.SettoOifthereisnoper-packetdata.Otherlsethisisanintegermultipleof4.324PerPacketInfoLengthSpecifiesinbytesthetotallengthoftheperpacketinformationcontainedInthismessage.364VcHandIeReservedforconnection-orienteddevices.SettoO.404ReservedReserved.SettoO.其报文示例如图1所示。红色标记部分为其包头部分，余下为MAC包。图IRNDlS示例报文利用wireshark,分析其MAC包，如图2所示。由此可知，该包为IPv4,UDP0图2MAC包示例2. ECM相关资料为（UniversalSerialBusCommunicationsClassSubclassSpecificationforEthernetControlModelDevices,Vl.2February9,2007o目前为MacOS采用。用LecroyUSBAnalyzer抓包的结果看，没有报头，仅是MAC包用wireshark分析该包，如图3所示。图3ECM报文格式示例由此可见，该虚拟网卡½t为0x00:0x0C:0x29:0xA3:0x9B:0x6Do3. MBIM相关资料为UniversalSerialBusCommunicationsClassSubclassSpecificationforMobileBroadbandInterfaceModel,Vl.0November14,2011o目前为win8采用。其报文结构如图4所示。图4MBlM报文格式HeaderSiguITH16)len(header)Datagrarn0index(11DP)DataRraml11.bytosDatagran2IIDP01P：qt*wXr*2e*tfwhlbjHrTtmMUacturber*fhs*，haadr4bytes：tlKMH*MrtthM*infirstbyt2bytes:OOODCInbttida2bytes:tncrcmcnOngsequencenubrresetANCMr-(seRxbne62byt«WngthL224M*o<»©Pfromiu11Cfxfr-rmtbemutopteof4S5(NDP16)IenalDPheader)index(nextIIDP)index(Daagranf01)len(Datawram01)index(DataararnnI)Ien(DataaramfID4byte.4tKMx'w/Minfitbyte2bytefncMes由.UebeKk>1)4g16.20,MC2byte;brAtonext，P16.oreroifnone2bytA；:offsetfrombyt0ofhdr0RequiredyEnd8ofZgIZeropaddingmaybeirvrt<dhererfCOeVFEt其中Header具体结构如表2所示。表2NTP16结构OffsetFieMSizeValueDescriptiondwSgnature4Number(0x44D434E)SignatureoftheNTH16HeadefTsistransmutedinlttle-eodanform.e.as0x4E.0x43.0x4。.0x48.orarstecharactersequence,NCMH-4WHeaderLength2Number(OxOOOC>Seem»tesofthsNTH16structure,inIrtMe-Cndianformat.6wSequence2NumberSequencenuntJtrTheuamniiwaabiockshaNMiIhtStoZecointhetrstNTBIranSfenedaftereveryfunctionresefevent,andShalGcremenHocvwyNTBsubsequerttzEMmd.ThtMeetdancut-cr-sequenceblockonthereceivertsnotspecifiedThespec<c3txallowsmerecervertodedeWnethefloche<AmesequencenumberandtodeodehowtorespondIrSincorrectThesequencenumberispn-matySUPPbedfordetxjg9ngpurposes.8WBIOCkLOngth2NumberSeeofthsNTBrtMsCL'inAgire3-1).ReoreswtedinIrraMndlanform.NTBsize(IWOUT)ShannotexceeddwMt)fr>MaxzeorWMbOutM*S>zerespectively,seeTatte6-3in6.2.1.ifwBtod(Leg(=0x00,theb¼×HterminatedSaShoapxMIntnscaseIneUSBtranslefmustsubeStxxterthanOwMbfnMaxSrzeorOwMbOutMax-Size.tfexactlyOwMbinMaxStzeor<M'MbOMaxSf2ebytesaresentandthesizeisamulopleof>vMax-PacAeeSrzeforthegivenpe.thennoZLPshallbesent.MegLMgg0x0000mus:beused.thextremecare,becauseOfthepossibATymattehostanddevicemaygetoutofsync,andbecauseoftestissues.*tocLe11oth=0x0000aNowsthesec)ertoreduceUMncybysMngtotendaverylargeNTB.WAMnshortening<whentheSemefoscoversthatmere'snotgtatojusKytendingalargeNTB10MdPlndeX2NumberOffset.inMueendian.ofthenr«NDPl6frombytezeroOftheNiBnsvaluemustbeamutpieo<4,andmustbe>三OxOOOC其中NDP16具体结构如表3所示。其中Datagram为IP包内容，其结构如图5所示。用Busfound抓包，如图6所示。综上可知，该IP报文为IPv4的IGMP包。因WireShark无法识别该网口，所以无法使用该工具。表3NDPl6结构OffsetFieldSizeValueDescnption0dwSignature4Number(0x304D434E.0×314D434)Ssqnatureof'.sNDP16TsistrnsmrttdinWe-endform,e,as0x4E.0x43.0x4D.0x30or0x4E,0x43,04D.0x31(xasthecharactersequencesNCM<r,o(*NCM1wreXTorThasthemeaningveninTable>54wLengt2NumberSizeGtthisNDP16tinlittle-endianformatThismustbearrx4Hpie<X4.andmu$tbeatleast16(0x0010)6/NextNdpIrxtes2Reserved(O)ReservedforuseasainktothenextNDPI6intheNlU8wDatagramlndex(O2NumberByteindex,inmeendian,oftefirstdugramdescribedbythisNDP16TbeindexisfrombytezeroofteNTBThisvaluemustbethevaluestoredinWHMdefLenQthoftheNTH16(becausertmustpointpasttheNTH16).10M>atagramLeg