Reverse engineering a USB peripheral driver for the Owon scope

As part of this router project, I need to understand USB at a low-level – for driving a MAX3421 controller.   And for some months now, I have been meaning to look at a digital storage oscilloscope made by Owon.  It is the PDS5022s model which can be connected to a PC over a USB link.

Owon PDS5022S scope with USB peripheral port

pds5022s scope

owon bitmap using linux driver

Unfortunately, the Owon software although written in Java is wrapped up in a Windows-only executable.   I want to use the scope in Linux, and the binary won’t even run in Wine, nor can I unwrap it to get to the Java classes.

So, there lies the dilemma. I needed to understand USB, and I wanted to reverse engineering the USB peripheral driver for the digital scope.  Here we see two birds and one stone!

With the help of a USB sniffer that runs on Windows, the libusb C library, gcc, khexedit, usbmon and some sticky-backed plastic, I finally got there..   a working userspace Linux driver for the Owon.  At a guess, the code should also work for other scopes in the Owon range.  Once I’ve debugged it a bit, I will post up the source.

[michael@epox Debug]$ ./owondump test5.bin

..Initialising libUSB
..Finding USB buses
..Searching buses for Owon
..Found an Owon device 5345:1234 on bus 001
..Attempting USB lock on device  5345:1234
..Trying to claim interface 0 of 5345:1234
..Successfully claimed interface 0 to 5345:1234
..Attempting to get the Device Descriptor
..Successfully obtained device descriptor!
..Attempting to bulk write start command to device...
..Successful bulk write of 0005h bytes!
..Attempting to bulk read 000ch bytes from device...
..Successful bulk read of 000ch bytes! :
        00000000: e1 d7 00 00 8d d4 2d 21 00 00 00 00
..Attempting to malloc read buffer space of 0000d7e1h bytes
..Successful malloc!
..Owon ready to bulk transfer 0000d7e1h bytes
..Attempting to bulk read 0000d7e1h bytes from device...
..Successful bulk read of 0000d7e1h bytes! :
..Hexdump of CH1 header :
        00000000: 53 50 42 56 30 31 e1 d7 00 00 43 48 31 04 31 00
        00000001: 00 6a 18 00 00 6a 18 00 00 00 00 00 00 11 00 00
        00000002: 00 fe ff ff ff 02 00 00 00 00 00 00 00 00 00 80
        00000003: 40 cb 17 48 42 6c 2d 9c 46 cd cc cc 3e 2a 00 29
..Channel Settings :
 channel name: CH1
 vertical sens: 10mV
 timebase: 0.0025s

 channel name: CH2
 vertical sens: 20mV
 timebase: 0.0025s

 channel name: CHA
 vertical sens: 10mV
 timebase: 0.01s

 channel name: CHB
 vertical sens: 10mV
 timebase: 0.005s

 channel name: CHC
 vertical sens: 20mV
 timebase: 0.01s
..Successfully opened file 'test5.bin'!
..Successfully written 55265 bytes to file test5.bin
..Attempting to release interface 0
..Successful release of interface 0!
[michael@epox Debug]$

Waveform bitmap downloaded using Linux driver for Owon