I need some guidance in how to troubleshoot a low level issue I am facing with some USB devices.
Background: I have a .NET Windows Service
that, scans connected USB devices via WMI queries
+ reads low level USB data using external C code
.
Although happening seldomly, once in a while a USB device (keyboard, mouse or smart card reader) stops functioning.
Looking at Windows’s Device Manager
, the device shows with a yellow triangle with an exclamation mark.
Looking at Event Viewer
‘s Microsoft-Windows-Kernel PnP
, I see the following error (for mouse, in this case)
XML View:
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Kernel-PnP" Guid="{9c205a39-1250-487d-abd7-e831c6290539}" />
<EventID>411</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000000</Keywords>
<TimeCreated SystemTime="2022-12-22T08:15:21.1540378Z" />
<EventRecordID>300</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="3780" />
<Channel>Microsoft-Windows-Kernel-PnP/Configuration</Channel>
<Computer>MyComputerName</Computer>
<Security UserID="S-1-5-18" />
</System>
- <EventData>
<Data Name="DeviceInstanceId">USBVID_03F0&PID_094A6&1ab5e341&0&2</Data>
<Data Name="DriverName">input.inf</Data>
<Data Name="ClassGuid">{745a17a0-74d3-11d0-b6fe-00a0c90f57da}</Data>
<Data Name="ServiceName">HidUsb</Data>
<Data Name="LowerFilters" />
<Data Name="UpperFilters" />
<Data Name="Problem">0x26</Data>
<Data Name="Status">0xc000038e</Data>
</EventData>
</Event>
How does one proceed from here?
There is no clear indication that the error is caused by the interactions with my .NET Service.
In any case, I guess I need to figure out how are such messages written to Windows’ ETW. From there, try to locate where in the C code there is a hook or piece of code that feeds the given ETW listener.
- Is this the right track? Are there shorter alternatives? Am I missing anything else?
- Could not find conclusive info on what does the
0x26
error/0xc000038e
status codes mean. Is there a specific resource for that? - Is there a way I can dump data from such error instances into a tool like Windows Debugger so it loads the the state of all the parts involved – and perhaps help ?
- Identify the installed driver for this specific device – and search for logs it eventually writes?