|Benjamin Höglinger-Stelzer f84c44b493|
HP Array Configuration Utility - Reverse Engineering
Trying to figure out which requests the HP ProLiant Array Configuration Utility for Windows 64-bit sends to my HP Smart Array P410 RAID Controller, so that I can script it to e.g. fetch disk alerts etc.
Heavily work in progress 🔥
The ACU sends a couple of
IOCTL_SCSI_MINIPORT IOCTLs with custom payloads on controller selection; this is received and handled by the
HpSAMD.sys driver. So far cross-checking the payload format with the well-known Linux sources hasn't yielded any success; I assume when
IOCTL_SCSI_MINIPORT is used, the payload isn't what 1:1 gets sent to the controller, unlike
IOCTL_SCSI_PASS_THROUGH which isn't what the ACU uses. Next step might be trying to port over the Linux CCISS example requests to the Windows SCSI API by using
IOCTL_SCSI_PASS_THROUGH to try if the controller then responds with the same packet structure as it would under Linux.
So far trying to get a
IOCTL_SCSI_PASS_THROUGH for controller identification to work results in a
ERROR_IO_DEVICE 1117 (0x45D).
I was able to get some packet captures of
IOCTL_SCSI_PASS_THROUGH_DIRECT requests directly to the virtual LUNs exposed by the SCSI adapter (see NOTES.md), but observing state changes in ACU I do not think that the controller state and properties of interest are proxied through them, so far I haven't found how exactly the ACU and controller exchange data like array recovery and rebuild status and progress, license keys etc.