Fixed BAD_POOL_HEADER issue

sys/ByteArray.h

@@ -22,13 +22,13 @@
 #include <ntifs.h>
 
 #define INITIAL_ARRAY_CAPACITY PAGE_SIZE
-#define ARRAY_POOL_TAG	'arrA'
+#define ARRAY_POOL_TAG    'arrA'
 
 typedef struct _BYTE_ARRAY
 {
-    UCHAR* Data;		//> array of data we're storing
-    ULONG_PTR Size;		//> slots used so far
-    ULONG_PTR Capacity;	//> total available memory
+    UCHAR* Data;        //> array of data we're storing
+    ULONG_PTR Size;        //> slots used so far
+    ULONG_PTR Capacity;    //> total available memory
 } BYTE_ARRAY, *PBYTE_ARRAY;
 
 NTSTATUS InitByteArray(IN OUT PBYTE_ARRAY Array);

sys/Ds4.h

@@ -32,7 +32,7 @@
 #define HID_REPORT_ID_3                                 0x13
 #define HID_REPORT_ID_4                                 0x14
 
-#define DS4_DESCRIPTOR_SIZE	                            0x0029
+#define DS4_DESCRIPTOR_SIZE                             0x0029
 #if defined(_X86_)
 #define DS4_CONFIGURATION_SIZE                          0x0050
 #else

sys/Xgip.h

@@ -46,7 +46,7 @@ DEFINE_GUID(GUID_DEVINTERFACE_XGIP_UNKNOWN_4,
 
 #pragma once
 
-#define XGIP_DESCRIPTOR_SIZE	        0x0040
+#define XGIP_DESCRIPTOR_SIZE            0x0040
 #define XGIP_CONFIGURATION_SIZE         0x88
 #define XGIP_REPORT_SIZE                0x12
 #define XGIP_SYS_INIT_PACKETS           0x0F

sys/Xusb.h

@@ -44,11 +44,20 @@ DEFINE_GUID(GUID_DEVINTERFACE_XUSB_UNKNOWN_2,
 #else
 #define XUSB_CONFIGURATION_SIZE         0x0130
 #endif
-#define XUSB_DESCRIPTOR_SIZE	        0x0099
+#define XUSB_DESCRIPTOR_SIZE            0x0099
 #define XUSB_RUMBLE_SIZE                0x08
 #define XUSB_LEDSET_SIZE                0x03
 #define XUSB_LEDNUM_SIZE                0x01
 #define XUSB_INIT_STAGE_SIZE            0x03
+#define XUSB_BLOB_STORAGE_SIZE          0x26
+
+#define XUSB_BLOB_00_OFFSET             0x00
+#define XUSB_BLOB_01_OFFSET             0x03
+#define XUSB_BLOB_02_OFFSET             0x06
+#define XUSB_BLOB_03_OFFSET             0x09
+#define XUSB_BLOB_04_OFFSET             0x0C
+#define XUSB_BLOB_05_OFFSET             0x20
+#define XUSB_BLOB_06_OFFSET             0x23
 
 #define XUSB_IS_DATA_PIPE(_x_)          ((BOOLEAN)(_x_->PipeHandle == (USBD_PIPE_HANDLE)0xFFFF0081))
 #define XUSB_IS_CONTROL_PIPE(_x_)       ((BOOLEAN)(_x_->PipeHandle == (USBD_PIPE_HANDLE)0xFFFF0083))
@@ -98,6 +107,11 @@ typedef struct _XUSB_DEVICE_DATA
     // 
     ULONG InterruptInitStage;
 
+    //
+    // Storage of binary blobs (packets) for PDO initialization
+    // 
+    WDFMEMORY InterruptBlobStorage;
+
 } XUSB_DEVICE_DATA, *PXUSB_DEVICE_DATA;
 
 WDF_DECLARE_CONTEXT_TYPE_WITH_NAME(XUSB_DEVICE_DATA, XusbGetData)

sys/busenum.h

@@ -49,6 +49,7 @@
 #define HID_REPORT_TYPE_FEATURE         0x03
 
 #define VIGEM_POOL_TAG                  0x45476956 // "EGiV"
+#define XUSB_POOL_TAG                   'BSUX'
 #define DRIVERNAME                      "ViGEm: "
 #define MAX_HARDWARE_ID_LENGTH          0xFF
 
@@ -93,7 +94,7 @@ EVT_WDF_CHILD_LIST_CREATE_DEVICE Bus_EvtDeviceListCreatePdo;
 
 EVT_WDF_CHILD_LIST_IDENTIFICATION_DESCRIPTION_COMPARE Bus_EvtChildListIdentificationDescriptionCompare;
 
-EVT_WDF_DEVICE_PREPARE_HARDWARE Bus_EvtDevicePrepareHardware;
+EVT_WDF_DEVICE_PREPARE_HARDWARE Pdo_EvtDevicePrepareHardware;
 
 EVT_WDF_IO_QUEUE_IO_INTERNAL_DEVICE_CONTROL Pdo_EvtIoInternalDeviceControl;
 

sys/buspdo.c

@@ -25,7 +25,7 @@
 #ifdef ALLOC_PRAGMA
 #pragma alloc_text(PAGE, Bus_CreatePdo)
 #pragma alloc_text(PAGE, Bus_EvtDeviceListCreatePdo)
-#pragma alloc_text(PAGE, Bus_EvtDevicePrepareHardware)
+#pragma alloc_text(PAGE, Pdo_EvtDevicePrepareHardware)
 #endif
 
 NTSTATUS Bus_EvtDeviceListCreatePdo(
@@ -260,7 +260,7 @@ NTSTATUS Bus_CreatePdo(
 
     WDF_PNPPOWER_EVENT_CALLBACKS_INIT(&pnpPowerCallbacks);
 
-    pnpPowerCallbacks.EvtDevicePrepareHardware = Bus_EvtDevicePrepareHardware;
+    pnpPowerCallbacks.EvtDevicePrepareHardware = Pdo_EvtDevicePrepareHardware;
 
     WdfDeviceInitSetPnpPowerEventCallbacks(DeviceInit, &pnpPowerCallbacks);
 
@@ -520,9 +520,9 @@ NTSTATUS Bus_CreatePdo(
 }
 
 //
-// Exposes necessary interfaces on PDO power-up.
+// PDO power-up.
 // 
-NTSTATUS Bus_EvtDevicePrepareHardware(
+NTSTATUS Pdo_EvtDevicePrepareHardware(
     _In_ WDFDEVICE Device,
     _In_ WDFCMRESLIST ResourcesRaw,
     _In_ WDFCMRESLIST ResourcesTranslated

sys/usbpdo.c

@@ -509,6 +509,7 @@ NTSTATUS UsbPdo_BulkOrInterruptTransfer(PURB urb, WDFDEVICE Device, WDFREQUEST R
     NTSTATUS                                    status;
     PPDO_DEVICE_DATA                            pdoData;
     WDFREQUEST                                  notifyRequest;
+    PUCHAR                                      blobBuffer;
 
     pdoData = PdoGetData(Device);
 
@@ -544,6 +545,8 @@ NTSTATUS UsbPdo_BulkOrInterruptTransfer(PURB urb, WDFDEVICE Device, WDFREQUEST R
                 TRACE_USBPDO,
                 ">> >> >> Incoming request, queuing...");
 
+            blobBuffer = WdfMemoryGetBuffer(xusb->InterruptBlobStorage, NULL);
+
             if (XUSB_IS_DATA_PIPE(pTransfer))
             {
                 //
@@ -552,48 +555,58 @@ NTSTATUS UsbPdo_BulkOrInterruptTransfer(PURB urb, WDFDEVICE Device, WDFREQUEST R
                 switch (xusb->InterruptInitStage)
                 {
                 case 0:
-                    xusb->InterruptInitStage++;
                     pTransfer->TransferBufferLength = XUSB_INIT_STAGE_SIZE;
-                    COPY_BYTE_ARRAY(pTransfer->TransferBuffer, P99_PROTECT({
-                        0x01, 0x03, 0x0E
-                        }));
+                    xusb->InterruptInitStage++;
+                    RtlCopyMemory(
+                        pTransfer->TransferBuffer, 
+                        &blobBuffer[XUSB_BLOB_00_OFFSET],
+                        XUSB_INIT_STAGE_SIZE
+                        );
                     return STATUS_SUCCESS;
                 case 1:
-                    xusb->InterruptInitStage++;
                     pTransfer->TransferBufferLength = XUSB_INIT_STAGE_SIZE;
-                    COPY_BYTE_ARRAY(pTransfer->TransferBuffer, P99_PROTECT({
-                        0x02, 0x03, 0x00
-                        }));
+                    xusb->InterruptInitStage++;
+                    RtlCopyMemory(
+                        pTransfer->TransferBuffer, 
+                        &blobBuffer[XUSB_BLOB_01_OFFSET],
+                        XUSB_INIT_STAGE_SIZE
+                        );
                     return STATUS_SUCCESS;
                 case 2:
-                    xusb->InterruptInitStage++;
                     pTransfer->TransferBufferLength = XUSB_INIT_STAGE_SIZE;
-                    COPY_BYTE_ARRAY(pTransfer->TransferBuffer, P99_PROTECT({
-                        0x03, 0x03, 0x03
-                        }));
+                    xusb->InterruptInitStage++;
+                    RtlCopyMemory(
+                        pTransfer->TransferBuffer, 
+                        &blobBuffer[XUSB_BLOB_02_OFFSET],
+                        XUSB_INIT_STAGE_SIZE
+                        );
                     return STATUS_SUCCESS;
                 case 3:
-                    xusb->InterruptInitStage++;
                     pTransfer->TransferBufferLength = XUSB_INIT_STAGE_SIZE;
-                    COPY_BYTE_ARRAY(pTransfer->TransferBuffer, P99_PROTECT({
-                        0x08, 0x03, 0x00
-                        }));
+                    xusb->InterruptInitStage++;
+                    RtlCopyMemory(
+                        pTransfer->TransferBuffer, 
+                        &blobBuffer[XUSB_BLOB_03_OFFSET],
+                        XUSB_INIT_STAGE_SIZE
+                        );
                     return STATUS_SUCCESS;
                 case 4:
-                    xusb->InterruptInitStage++;
                     pTransfer->TransferBufferLength = sizeof(XUSB_INTERRUPT_IN_PACKET);
-                    COPY_BYTE_ARRAY(pTransfer->TransferBuffer, P99_PROTECT({
-                        0x00, 0x14, 0x00, 0x00, 0x00, 0x00, 0xe4, 0xf2,
-                        0xb3, 0xf8, 0x49, 0xf3, 0xb0, 0xfc, 0x00, 0x00,
-                        0x00, 0x00, 0x00, 0x00
-                        }));
+                    xusb->InterruptInitStage++;
+                    RtlCopyMemory(
+                        pTransfer->TransferBuffer, 
+                        &blobBuffer[XUSB_BLOB_04_OFFSET],
+                        sizeof(XUSB_INTERRUPT_IN_PACKET)
+                        );
                     return STATUS_SUCCESS;
                 case 5:
-                    xusb->InterruptInitStage++;
                     pTransfer->TransferBufferLength = XUSB_INIT_STAGE_SIZE;
-                    COPY_BYTE_ARRAY(pTransfer->TransferBuffer, P99_PROTECT({
-                        0x01, 0x03, 0x03
-                        }));
+                    xusb->InterruptInitStage++;
+                    RtlCopyMemory(
+                        pTransfer->TransferBuffer, 
+                        &blobBuffer[XUSB_BLOB_05_OFFSET],
+                        XUSB_INIT_STAGE_SIZE
+                        );
                     return STATUS_SUCCESS;
                 default:
                     /* This request is sent periodically and relies on data the "feeder"
@@ -609,10 +622,11 @@ NTSTATUS UsbPdo_BulkOrInterruptTransfer(PURB urb, WDFDEVICE Device, WDFREQUEST R
             {
                 if (!xusb->ReportedCapabilities && pTransfer->TransferBufferLength >= XUSB_INIT_STAGE_SIZE)
                 {
-                    pTransfer->TransferBufferLength = XUSB_INIT_STAGE_SIZE;
-                    COPY_BYTE_ARRAY(pTransfer->TransferBuffer, P99_PROTECT({
-                        0x05, 0x03, 0x00
-                        }));
+                    RtlCopyMemory(
+                        pTransfer->TransferBuffer, 
+                        &blobBuffer[XUSB_BLOB_06_OFFSET],
+                        XUSB_INIT_STAGE_SIZE
+                        );
 
                     xusb->ReportedCapabilities = TRUE;
 

sys/xusb.c

@@ -242,8 +242,9 @@ NTSTATUS Xusb_PrepareHardware(WDFDEVICE Device)
 
 NTSTATUS Xusb_AssignPdoContext(WDFDEVICE Device)
 {
-    NTSTATUS status;
-    WDF_OBJECT_ATTRIBUTES attributes;
+    NTSTATUS                status;
+    WDF_OBJECT_ATTRIBUTES   attributes;
+    PUCHAR                  blobBuffer;
 
     WDF_OBJECT_ATTRIBUTES_INIT(&attributes);
     attributes.ParentObject = Device;
@@ -259,6 +260,44 @@ NTSTATUS Xusb_AssignPdoContext(WDFDEVICE Device)
     // Packet size (20 bytes = 0x14)
     xusb->Packet.Size = 0x14;
 
+    // Allocate blob storage
+    status = WdfMemoryCreate(
+        &attributes,
+        NonPagedPoolNx,
+        XUSB_POOL_TAG,
+        XUSB_BLOB_STORAGE_SIZE,
+        &xusb->InterruptBlobStorage,
+        &blobBuffer
+    );
+    if (!NT_SUCCESS(status))
+    {
+        TraceEvents(TRACE_LEVEL_ERROR,
+            TRACE_XUSB,
+            "WdfMemoryCreate failed with status %!STATUS!",
+            status);
+        return status;
+    }
+
+    // Fill blob storage
+    COPY_BYTE_ARRAY(blobBuffer, P99_PROTECT({
+        // 0
+        0x01, 0x03, 0x0E,
+        // 1
+        0x02, 0x03, 0x00,
+        // 2
+        0x03, 0x03, 0x03,
+        // 3
+        0x08, 0x03, 0x00,
+        // 4
+        0x00, 0x14, 0x00, 0x00, 0x00, 0x00, 0xe4, 0xf2,
+        0xb3, 0xf8, 0x49, 0xf3, 0xb0, 0xfc, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00,
+        // 5
+        0x01, 0x03, 0x03,
+        // 6
+        0x05, 0x03, 0x00
+        }));
+
     // I/O Queue for pending IRPs
     WDF_IO_QUEUE_CONFIG holdingInQueueConfig;