# HP Array Configuration Utility - Reverse Engineering
## About
Trying to figure out which requests the [HP ProLiant Array Configuration Utility for Windows 64-bit](https://support.hpe.com/connect/s/softwaredetails?language=en_US&softwareId=MTX_669f83062c7b492083c2aa7125) sends to my HP Smart Array P410 RAID Controller, so that I can script it to e.g. fetch disk alerts etc.
The ACU sends a couple of `IOCTL_SCSI_MINIPORT` IOCTLs with custom payloads on controller selection; this is received and handled by the `HpSAMD.sys` driver. So far cross-checking the payload format with the well-known Linux sources hasn't yielded any success; I assume when `IOCTL_SCSI_MINIPORT` is used, the payload isn't what 1:1 gets sent to the controller, unlike `IOCTL_SCSI_PASS_THROUGH` which isn't what the ACU uses. Next step might be trying to port over the Linux CCISS example requests to the Windows SCSI API by using `IOCTL_SCSI_PASS_THROUGH` to try if the controller then responds with the same packet structure as it would under Linux.
I was able to get some packet captures of `IOCTL_SCSI_PASS_THROUGH_DIRECT` requests directly to the virtual LUNs exposed by the SCSI adapter (see [NOTES.md](./Notes.md)), but observing state changes in ACU I do not think that the controller state and properties of interest are proxied through them, so far I haven't found how exactly the ACU and controller exchange data like array recovery and rebuild status and progress, license keys etc.
- [HP ProLiant Array Configuration Utility for Windows 64-bit](https://support.hpe.com/connect/s/softwaredetails?language=en_US&softwareId=MTX_669f83062c7b492083c2aa7125)
