#Rage native ui driver#
#Rage native ui code#

Therefore, we can hook CFMessagePortCreateLocal and then hook the address specified by the callout parameter that the caller passed. This callout is called when a message is received on the port and is passed a CFDataRef which points to the passed message. This is because the function to create a receiving message port, CFMessagePortCreateLocal, takes a callout parameter. To observe incoming messages, we will have to make use of HookCaseвЂ™s new dynamic hooking functionality. To observe the outgoing messages, we will simply hook the CFMessagePortSendRequest function. We want to be able to see the IPC messages coming to and from the hardware agent. Using our trusty HookCase, we can now hook the CFMessagePort send and receive functions to observe the data being passed back and forth. Searching for strings containing the word вЂњhardwareвЂќ reveals a very interesting string:ДЄha! We can now see that the hardware agent and the Maschine 2 application are using CFMessagePort's for interprocess communication.

#Rage native ui driver#

The one I decided to take was to search the Maschine 2 binary for strings related to certain words I thought might be related to the driver or the device itself. There are many different steps that couldвЂ™ve been taken here. There is likely a better way to finding the process that has our interface open, but IвЂ™ll describe the steps I took because it appropriately describes the messy reverse engineering process. It looks like another process has already opened our USB interface! Finding the Owning Process

#Rage native ui code#

Looking at the ioreturn.h header, we can see that this error code corresponds to the kIOReturnExclusiveAccess error. If we look at the IOReturn error code from the call, we always get code 0x2C5. Running the code, everything works fine until the call to, USBInterfaceOpen. WeвЂ™ll follow the guide at, specifically Listing 2вЂ“8. LetвЂ™s try to get a handle to the HID USB interface to see if we can read data from it. WeвЂ™ll just be concerned with the HID interface since that would be the interface that button commands are sent through. An HID (human interface device) and a DFU (device firmware upgrade) interface.