On Sat, Dec 12, 2020 at 05:59:38PM +0100, Karsten Hilbert wrote: > You may want to capture USB traffic during *startup* of the > Windows app, not before exposure only. It may well send setup > commands at that point. Yes, in fact usbmon was started even before windows VM. That makes me believe it may not be too complicated. Have to just watch a few exchanges before the image data is exchanged.