pkot

#!/usr/bin/perl
$regexp = " {4}[[:xdigit:]]{8}: ";
while (<>) {
    if (/$regexp/)
    {
        s/\n//;
        print;
        print "     ";
        s/$regexp//;
        @words = split /\s+/;
        for (@words) {
            $_ = chr(hex($_));
            s/[^ -~]/./;
            print $_;
        }
        print "\n";
    }
    else
    {
        print;
    }
}

0539 ms] UsbSnoop - FilterDispatchAny(8bdaffd2) : IRP_MJ_INTERNAL_DEVICE_CONTROL
[110540 ms] UsbSnoop - FdoHookDispatchInternalIoctl(8bdb01ea) : fdo=88756e40, Irp=85b38a40, IRQL=0
[110540 ms]  >>>  URB 627 going down  >>>
-- URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER:
  PipeHandle           = 858be1e4 [endpoint 0x00000003]
  TransferFlags        = 00000000 (USBD_TRANSFER_DIRECTION_OUT, ~USBD_SHORT_TRANSFER_OK)
  TransferBufferLength = 00000028
  TransferBuffer       = 8813b0c8
  TransferBufferMDL    = 00000000
    00000000: 83 00 28 cb 00 00 00 01 42 00 15 78 2d 6f 62 65     ..(.....B..x-obe
    00000010: 78 2f 63 61 70 61 62 69 6c 69 74 79 00 4a 00 0b     x/capability.J..
    00000020: 50 43 20 53 75 69 74 65     PC Suite
  UrbLink              = 00000000
[110541 ms] UsbSnoop - MyInternalIOCTLCompletion(8bdb0126) : fido=00000000, Irp=85b38a40, Context=8847cbb8, IRQL=2
[110541 ms]  <<<  URB 627 coming back  <<<
-- URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER:
  PipeHandle           = 858be1e4 [endpoint 0x00000003]
  TransferFlags        = 00000000 (USBD_TRANSFER_DIRECTION_OUT, ~USBD_SHORT_TRANSFER_OK)
  TransferBufferLength = 00000028
  TransferBuffer       = 8813b0c8
  TransferBufferMDL    = 88735948
  UrbLink              = 00000000
[110554 ms] UsbSnoop - MyInternalIOCTLCompletion(8bdb0126) : fido=00000000, Irp=85ae8008, Context=85ef34f8, IRQL=2
[110554 ms]  <<<  URB 626 coming back  <<<
-- URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER:
  PipeHandle           = 858be1c4 [endpoint 0x00000083]
  TransferFlags        = 00000003 (USBD_TRANSFER_DIRECTION_IN, USBD_SHORT_TRANSFER_OK)
  TransferBufferLength = 0000094a
  TransferBuffer       = 871a3000
  TransferBufferMDL    = 8844d520
    00000000: a0 09 4a c3 00 00 09 3f 49 09 42 3c 3f 78 6d 6c     ..J....?I.B<?xml
    00000010: 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f      version="1.0" ?
    00000020: 3e 0a 3c 21 44 4f 43 54 59 50 45 20 43 61 70 61     >.<!DOCTYPE Capa