Fork 0

2.4 KiB

HP Array Configuration Utility - Reverse Engineering


Trying to figure out which requests the HP ProLiant Array Configuration Utility for Windows 64-bit sends to my HP Smart Array P410 RAID Controller, so that I can script it to e.g. fetch disk alerts etc.

Heavily work in progress 🔥


The ACU sends a couple of IOCTL_SCSI_MINIPORT IOCTLs with custom payloads on controller selection; this is received and handled by the HpSAMD.sys driver. So far cross-checking the payload format with the well-known Linux sources hasn't yielded any success; I assume when IOCTL_SCSI_MINIPORT is used, the payload isn't what 1:1 gets sent to the controller, unlike IOCTL_SCSI_PASS_THROUGH which isn't what the ACU uses. Next step might be trying to port over the Linux CCISS example requests to the Windows SCSI API by using IOCTL_SCSI_PASS_THROUGH to try if the controller then responds with the same packet structure as it would under Linux.

So far trying to get a IOCTL_SCSI_PASS_THROUGH for controller identification to work results in a ERROR_IO_DEVICE 1117 (0x45D).

I was able to get some packet captures of IOCTL_SCSI_PASS_THROUGH_DIRECT requests directly to the virtual LUNs exposed by the SCSI adapter (see NOTES.md), but observing state changes in ACU I do not think that the controller state and properties of interest are proxied through them, so far I haven't found how exactly the ACU and controller exchange data like array recovery and rebuild status and progress, license keys etc.

3rd party sources