windows webcam driver modification

Hi /prog/

I recently read this:
http://blog.erratasec.com/2013/12/how-to-disable-webcam-light-on-windows.html
Sinc then I've been trying to figure out how the windows webcam driver works. Specifically I'd like to be able to manually control activation of the LED on the camera.

Here's what I've established so far:

- the default windows driver is usbvideo.sys
- the driver may or may not have the ability to control the LED on webcams (havent established for sure yet)
- I'm using a Logitech webcam. I installed the software/drivers, then replaced the drivers in device manager with the windows default one. The webcam still worked, but the software popped up a message that it was using generic/MS UVC driver. The control for the light inside the logitech application still worked (however I later noticed that the webcam was using an additional logitech driver, so I haven't been able to establish for sure if the windows driver can set the LED, going to check again shortly).
- The logitech app sets a registry key (value LVUVC_LEDControl). Changing this value DOES allow you to control the LED. 0 == off, 1 == on, 4 == auto. This affects all applications (tested it with AMCap too), but it only works the first time you plug in the cam; changing it while the cam is plugged in has no effect.

I don't know much about drivers, decompiling or debugging. I did try and attach a debugger to the logitech app to see what happens when you change the LED setting inside of it, but the debugger couldn't attach to the app and I didn't have any success starting the app as new process via the debugger (the app is launched from another executable), so I'm not sure how/whether to proceed further down that route.

I also tried opening a few of the logitech drivers in PEBrowse and searching for references to 'LED', 'light', 'lamp' etc, but with limited success. Opening USBVideo.sys didn't provide me with much insight either.

What I'd like to achieve is either:
- create a modified version of the usbvideo.sys driver in which the light is always off
- create a small application that allows me to set the light (as I don't know too much about how drivers work, I'm not sure this is plausible)
- ideally create a 2nd driver so I can pick which one to use depending on which application I'm using it in.

What I need to know more about is:
1. which of the above is most plausible?

2. which route(s) should I proceed with: trying to observe the logitech app under the hood to see how it controls the light, trying to get more info on the usbvideo.sys driver (havent been able to find much in terms of documentation), or other?

3. apps/tutorials/protips for 2.

I'm pretty sure you can't attach simple debuggers to a driver space process.

If I remember correctly, there might be a Windows driver toolkit of some sort with a kernel level debugger.

I'm sure it's not possible for all webcams, either, since some might activate the LED in the firmware.

I'm pretty sure that most webcam LEDs are hardwired to the sensor. This means that you can't turn off the LED without turning off the webcam.

you're platantly trying to violate girlfriend consent in picture taking. Conclusion: POLEKAT KABABS

>>4
More likely he's trying to send some trojan horse to random girls so that he can watch them change clothes.

A trojan horse? >>1-san are you 11?

Ok have done a bit more research:

- the option to set the light in the logitech software isn't shown if using only the windows usbvideo.sys driver
- the registry key has no effect without the logitech drivers
- modifying usbvideo.sys probably isn't plausible (although I'd like to hear more opinions on this)
- this can be done in Linux using uvcdynctrl ( uvcdynctrl -s "LED1 Mode" 0 ) although its not clear what cameras this works on.

the article states that:
"In theory, the indicator light should be a hardware function. When power is supplied to the sensor, it should also be supplied to an indicator light. This would make the light impossible to hack. However, I don't think anybody does this.

In some cases, it's a firmware function. Webcams have their own wimpy microprocessors and run code directly within the webcam. Control the light is one of those firmware functions.
[...]
In some cases, it's the driver, either within the kernel mode driver that interfaces at a low-level with the hardware, or a DLL that interfaces at a high-level with software."

also:
"Almost all webcams, even those inside your laptop's screen, are USB devices. There is a standard for USB video cameras, the UVC standard. According to this standard, the LED indicator light is controlled by the host software. The UVC utilities that come with Linux allow you to control this light directly with a command-line tool, being able to turn off the light while the camera is on.
[...]
In our research we believe it can be done generically across most any webcam, using most any operating system.
"

and:
"To hack this on Windows appears to require a filter driver. [...] a filter driver for the UVC standard would get most webcam products from different vendors, without having to write a custom hack for different vendors."

I like how >>4 >>5 and >>6 think. What I'd like is to be able to do is use the camera on my laptop with skype normally, and without the light when using motion-detection software. The camera doesn't have any vendor specific drivers/software to allow me to do this though.

reviving dead thread but I'm gonna try and write a filter driver for this purpose, yeet

Hit me up if you have that driver filter bro.