USB大容量存储BOT
U盘BOT存储UFI协议READ_CAPACITY命令说明及实例分析
2022-05-23
1786
0
READ_CAPACITY命令用于主机从设备获取当前设备媒价的存储容量。
#define READ_CAPACITY 0x25
UFI READ CAPACITY命令格式
- RelAdr:必须为0
- Logical Block Address：为0
- PMI：为0
如果UFI设备识别已格式化介质，UFI设备将向批量输入端点上的主机返回READ CAPACITY数据。
如果介质未格式化、未知或未显示，UFI设备会使命令块失败，并将检测键设置为下列出的适当值。
| Sense Key | ASC | ASCQ | Description of Error |
|---|---|---|---|
| 0 | 0 | NO SENSE | |
| 1 | 17 | 1 | RECOVERED DATA WITH RETRIES |
| 1 | 18 | 0 | RECOVERED DATA WITH ECC |
| 2 | 4 | 1 | LOGICAL DRIVE NOT READY - BECOMING READY |
| 2 | 4 | 2 | LOGICAL DRIVE NOT READY - INITIALIZATION REQUIRED |
| 2 | 4 | 4 | LOGICAL UNIT NOT READY - FORMAT IN PROGRESS |
| 2 | 4 | FF | LOGICAL DRIVE NOT READY - DEVICE IS BUSY |
| 2 | 6 | 0 | NO REFERENCE POSITION FOUND |
| 2 | 8 | 0 | LOGICAL UNIT COMMUNICATION FAILURE |
| 2 | 8 | 1 | LOGICAL UNIT COMMUNICATION TIME-OUT |
| 2 | 8 | 80 | LOGICAL UNIT COMMUNICATION OVERRUN |
| 2 | 3A | 0 | MEDIUM NOT PRESENT |
| 2 | 54 | 0 | USB TO HOST SYSTEM INTERFACE FAILURE |
| 2 | 80 | 0 | INSUFFICIENT RESOURCES |
| 2 | FF | FF | UNKNOWN ERROR |
| 3 | 2 | 0 | NO SEEK COMPLETE |
| 3 | 3 | 0 | WRITE FAULT |
| 3 | 10 | 0 | ID CRC ERROR |
| 3 | 11 | 0 | UNRECOVERED READ ERROR |
| 3 | 12 | 0 | ADDRESS MARK NOT FOUND FOR ID FIELD |
| 3 | 13 | 0 | ADDRESS MARK NOT FOUND FOR DATA FIELD |
| 3 | 14 | 0 | RECORDED ENTITY NOT FOUND |
| 3 | 30 | 1 | CANNOT READ MEDIUM - UNKNOWN FORMAT |
| 3 | 31 | 1 | FORMAT COMMAND FAILED |
| 4 | 40 | NN | DIAGNOSTIC FAILURE ON COMPONENT NN (80H-FFH) |
| 5 | 1A | 0 | PARAMETER LIST LENGTH ERROR |
| 5 | 20 | 0 | INVALID COMMAND OPERATION CODE |
| 5 | 21 | 0 | LOGICAL BLOCK ADDRESS OUT OF RANGE |
| 5 | 24 | 0 | INVALID FIELD IN COMMAND PACKET |
| 5 | 25 | 0 | LOGICAL UNIT NOT SUPPORTED |
| 5 | 26 | 0 | INVALID FIELD IN PARAMETER LIST |
| 5 | 26 | 1 | PARAMETER NOT SUPPORTED |
| 5 | 26 | 2 | PARAMETER VALUE INVALID |
| 5 | 39 | 0 | SAVING PARAMETERS NOT SUPPORT |
| 6 | 28 | 0 | “NOT READY TO READY TRANSITION - MEDIA CHANGED” |
| 6 | 29 | 0 | “POWER ON RESET OR BUS DEVICE RESET OCCURRED” |
| 6 | 2F | 0 | COMMANDS CLEARED BY ANOTHER INITIATOR |
| 7 | 27 | 0 | WRITE PROTECTED MEDIA |
| 0B | 4E | 0 | OVERLAPPED COMMAND ATTEMPTED |
UFI READ CAPACITY响应数据格式
- Last Logical Block Address：最后一个有效的LBA
- Block Length In Bytes:每个LBA的字幕了数
typedef struct _READ_CAPACITY_RESPONSE_STRUCT
{
ULONG LastLogicalBlockAddress;
ULONG BlockLengthInBytes;
}READ_CAPACITY_RESPONSE_STRUCT,*PREAD_CAPACITY_RESPONSE_STRUCT;
如我们虚拟的一个8M U盘(http://www.usbzh.com/article/detail-920.html)，其数据定义如下：
#define BLOCK_LENGTH (ULONG)(512*8)
#define BLOCK_NUM (ULONG)(2046)
#define SwapUSHORT(A) (( ((USHORT)(A) & 0xff00) >> 8) | ((USHORT)(A) & 0x00ff) << 8)
#define SwapULONG(A) ((( (ULONG)(A) & 0xff000000) >> 24) | (((ULONG)(A) & 0x00ff0000) >> 8) | (((ULONG)(A) & 0x0000ff00) << 8) | (((ULONG)(A) & 0x000000ff) << 24))
PREAD_CAPACITY_RESPONSE_STRUCT pft = (PREAD_CAPACITY_RESPONSE_STRUCT)buffer;
RtlZeroMemory(pft, length);
pft->LastLogicalBlockAddress = SwapULONG(BLOCK_NUM);
pft->BlockLengthInBytes = SwapULONG(BLOCK_LENGTH);
HID人机交互QQ群：564808376
UAC音频QQ群：218581009
UVC相机QQ群：331552032
BOT&UASP大容量存储QQ群：258159197
STC-USB单片机QQ群：315457461
USB技术交流QQ群2:580684376
USB技术交流QQ群：952873936
