I have a U9 Telit modem which, at first, appears as a disk drive on USB bus. Then, the native software after autorun and install, sends a couple of IOCTLs to tell the device to reappear as other things. I can see them in procmon.
I want to better spy on these, to know exactly what they send and how, in order to do the same in proper way.