《RNDIS-ECM及MBIM报文简述.docx》由会员分享，可在线阅读，更多相关《RNDIS-ECM及MBIM报文简述.docx（8页珍藏版）》请在第壹文秘上搜索。
1、RNDIS/ECM/MBIM报文简述本文对USBCDC中三种较常见的CommunicationClass报文内容进行了简单的描1.RNDIS相关资料为RemoteNDISSpecification,VL1August9,2002o其报头格式如表1所示。表1Remote-NDIS报头OffwtSizeFieldDescription04MessageTypeSpecifiestheRemoteNDISmessagetype.ThisissettoREMoTE一NDlS-PAeKET一MSG=0x1.44MessageLengthMessagelengthinbytes,includingappe
2、ndedpacketdata,out-of-banddata,per-packet-infodata,andbothInternalandexternalpadding.84DataOffsetSpecifiestheoffsetinbytesfromthestartoftheDataOffsetfieldofthismessagetothestartofthedata.Thisisanintegermultipleof4.124DataLengthSpecifiesthenumberofbytesInthedatacontentofthismessage.164OOBDataOffsetSp
3、ecifiestheoffsetinbytesofthefirstoutofbanddatarecordfromthestartoftheDataOffsetfieldofthismessage.SettoOIfthereisnoout-of-banddata.Otherdsethisisanintegermultipleof4.204OOBDataLengthSpecifiesinbytesthetotallengthoftheoutofbanddata.244NumOOBDataEIementsSpecifiesthenumberofoutofbandrecordsinthismessag
4、e.284PerPacketInfoffsetSpecifiesInbytestheoffsetfromthebeginningoftheDataOffsetfieldintheREMOTE_NDIS_PACKET_MSGdatamessagetothestartofthefirstperpacketinfodatarecord.SettoOifthereisnoper-packetdata.Otherlsethisisanintegermultipleof4.324PerPacketInfoLengthSpecifiesinbytesthetotallengthoftheperpacketi
5、nformationcontainedInthismessage.364VcHandIeReservedforconnection-orienteddevices.SettoO.404ReservedReserved.SettoO.其报文示例如图1所示。红色标记部分为其包头部分，余下为MAC包。图IRNDlS示例报文利用wireshark,分析其MAC包，如图2所示。由此可知，该包为IPv4,UDP0图2MAC包示例2. ECM相关资料为（UniversalSerialBusCommunicationsClassSubclassSpecificationforEthernetControlMo
6、delDevices,Vl.2February9,2007o目前为MacOS采用。用LecroyUSBAnalyzer抓包的结果看，没有报头，仅是MAC包用wireshark分析该包，如图3所示。图3ECM报文格式示例由此可见，该虚拟网卡t为0x00:0x0C:0x29:0xA3:0x9B:0x6Do3. MBIM相关资料为UniversalSerialBusCommunicationsClassSubclassSpecificationforMobileBroadbandInterfaceModel,Vl.0November14,2011o目前为win8采用。其报文结构如图4所示。图4MBl
7、M报文格式HeaderSiguITH16)len(header)Datagrarn0index(11DP)DataRraml11.bytosDatagran2IIDP01P：qt*wXr*2e*tfwhlbjHrTtmMUacturber*fhs*，haadr4bytes：tlKMH*MrtthM*infirstbyt2bytes:OOODCInbttida2bytes:tncrcmcnOngsequencenubrresetANCMr-(seRxbne62bytWngthL224M*o1)4g16.20,MC2byte;brAtonext，P16.oreroifnone2bytA；:offs
8、etfrombyt0ofhdr0RequiredyEnd8ofZgIZeropaddingmaybeirvrtSeemtesofthsNTH16structure,inIrtMe-Cndianformat.6wSequence2NumberSequencenuntJtrTheuamniiwaabiockshaNMiIhtStoZecointhetrstNTBIranSfenedaftereveryfunctionresefevent,andShalGcremenHocvwyNTBsubsequerttzEMmd.ThtMeetdancut-cr-sequenceblockonthereceiv
9、ertsnotspecifiedThespecc3txallowsmerecervertodedeWnetheflocheMaxzeorWMbOutM*Szerespectively,seeTatte6-3in6.2.1.ifwBtod(Leg(=0x00,thebHterminatedSaShoapxMIntnscaseIneUSBtranslefmustsubeStxxterthanOwMbfnMaxSrzeorOwMbOutMax-Size.tfexactlyOwMbinMaxStzeorvMax-PacAeeSrzeforthegivenpe.thennoZLPshallbesent.
10、MegLMgg0x0000mus:beused.thextremecare,becauseOfthepossibATymattehostanddevicemaygetoutofsync,andbecauseoftestissues.*tocLe11oth=0x0000aNowsthesec)ertoreduceUMncybysMngtotendaverylargeNTB.WAMnshorteningwhentheSemefoscoversthatmeresnotgtatojusKytendingalargeNTB10MdPlndeX2NumberOffset.inMueendian.ofthe
11、nrNDPl6frombytezeroOftheNiBnsvaluemustbeamutpieo三OxOOOC其中NDP16具体结构如表3所示。其中Datagram为IP包内容，其结构如图5所示。用Busfound抓包，如图6所示。综上可知，该IP报文为IPv4的IGMP包。因WireShark无法识别该网口，所以无法使用该工具。表3NDPl6结构OffsetFieldSizeValueDescnption0dwSignature4Number(0x304D434E.0314D434)Ssqnatureof.sNDP16TsistrnsmrttdinWe-endform,e,as0x4E.0x43.0x4D.0x30or0x4E,0x43,04D.0x31(xasthecharactersequencesNCM54wLengt2NumberSizeGtthisNDP16tinlittle-endianformatThismustbearrx4HpieatagramLeg
