Success report: ZTE K3565-Z
Posted: 08 May 2009, 16:45
After hours and hours I finally succeed to unlock my brand new ZTE 3565-Z (from SFR, in France).
This device have a microSD slot. It is labelled K3564-Z and FFC ID Q78-K3565-Z. The Windows drivers are labelled K3520. And the Windows modem diagnostic display K3565-Z (very usefull idea: http://www.draisberghof.de/usb_modeswit ... .php?t=152).
This device works perfectly under Windows XP pro.
I then tryied to made it work under the latest Ubuntu. It worked once, then never again. I don't understand how. I recompiled the kernel because of "unusual_devs.h" but nothing better.
I dropped this (stupid?) distro and switched to my favorite Debian: immediate success.
For the ZTE 6535-Z you just have to use the same command as for ZTE MF626 / MF628+, but the target product is 0x0052 and you have to wait at least 8 seconds to see it (9 is better), because the device first disappear and it took times to have the new ones.
Note that I sniffed the datas when using Windows XP and didn't managed to do anything uselfull with them. Nowhere I saw the same datas that the ones I use under Linux. I then think about some "compatibility mode" or so: this device probably respond to different commands.
Before the device is switched, lsusb display it only 5 seconds after. The red led on the device start to flash about 10 seconds after the connection. You then have 19d2:2000 as a mass storage, but you can't access the mass storage under Linux (or maybe you have to use special module ? I don't bother). Once the swith command is sent to the device, you have to wait 8 seconds to see the new ones. You then have 19d2:0052 with several devices inside. The mass storage and the modem work at the same time (in Windows, you can use the modem and the storage at the same time too. Not tested with the microSD).
note that the four ACPI lines are always present at the same place.
This device have a microSD slot. It is labelled K3564-Z and FFC ID Q78-K3565-Z. The Windows drivers are labelled K3520. And the Windows modem diagnostic display K3565-Z (very usefull idea: http://www.draisberghof.de/usb_modeswit ... .php?t=152).
This device works perfectly under Windows XP pro.
I then tryied to made it work under the latest Ubuntu. It worked once, then never again. I don't understand how. I recompiled the kernel because of "unusual_devs.h" but nothing better.
I dropped this (stupid?) distro and switched to my favorite Debian: immediate success.
For the ZTE 6535-Z you just have to use the same command as for ZTE MF626 / MF628+, but the target product is 0x0052 and you have to wait at least 8 seconds to see it (9 is better), because the device first disappear and it took times to have the new ones.
Note that I sniffed the datas when using Windows XP and didn't managed to do anything uselfull with them. Nowhere I saw the same datas that the ones I use under Linux. I then think about some "compatibility mode" or so: this device probably respond to different commands.
Before the device is switched, lsusb display it only 5 seconds after. The red led on the device start to flash about 10 seconds after the connection. You then have 19d2:2000 as a mass storage, but you can't access the mass storage under Linux (or maybe you have to use special module ? I don't bother). Once the swith command is sent to the device, you have to wait 8 seconds to see the new ones. You then have 19d2:0052 with several devices inside. The mass storage and the modem work at the same time (in Windows, you can use the modem and the storage at the same time too. Not tested with the microSD).
Code: Select all
# dmesg
[20542.992830] usb 5-3: new high speed USB device using ehci_hcd and address 15
[20543.302524] usb 5-3: configuration #1 chosen from 1 choice
[20543.304034] usb-storage: device ignored
[20543.304186] usb 5-3: New USB device found, idVendor=19d2, idProduct=2000
[20543.304193] usb 5-3: New USB device strings: Mfr=2, Product=1, SerialNumber=0
[20543.304196] usb 5-3: Product: ZTE CDMA Technologies MSM
[20543.304201] usb 5-3: Manufacturer: ZTE, Incorporated
Code: Select all
# lsusb -d 19d2:2000 -v
Bus 005 Device 015: ID 19d2:2000 ONDA Communication S.p.A.
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x19d2 ONDA Communication S.p.A.
idProduct 0x2000
bcdDevice 0.00
iManufacturer 2 ZTE, Incorporated
iProduct 1 ZTE CDMA Technologies MSM
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xe0
Self Powered
Remote Wakeup
MaxPower 500mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 8 Mass Storage
bInterfaceSubClass 5 SFF-8070i
bInterfaceProtocol 80
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Device Qualifier (for other device speed):
bLength 10
bDescriptorType 6
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
bNumConfigurations 1
Device Status: 0x0001
Self Powered
Code: Select all
# usb_modeswitch --DefaultVendor 0x19d2 --DefaultProduct 0x2000 --TargetVendor 0X19d2 --TargetProduct 0x0052 --success 8 --MessageEndpoint 0x01 --MessageContent 55534243123456782000000080000c85010101180101010101000000000000
* usb_modeswitch: tool for controlling "flip flop" mode USB devices
* Version 0.9.7 (C) Josua Dietze 2009
* Works with libusb 0.1.12 and probably other versions
Looking for target devices ...
No devices in target mode or class found
Looking for default devices ...
Found default devices (1)
Prepare switching, accessing device 015 on bus 005 ...
Looking for active driver ...
No driver found. Either detached before or never attached
Setting up communication with interface 0 ...
Trying to send the message to endpoint 0x01 ...
OK, message successfully sent
Checking for mode switch after 8 seconds settling time ...
Original device can't be accessed anymore. Good.
Found a new device in target mode or class
Mode switch was successful. Bye!
Code: Select all
# dmesg
[20757.342196] usb 5-3: USB disconnect, address 15
[20762.728303] usb 5-3: new high speed USB device using ehci_hcd and address 16
[20762.899353] usb 5-3: configuration #1 chosen from 1 choice
[20762.917652] scsi26 : SCSI emulation for USB Mass Storage devices
[20762.918044] scsi27 : SCSI emulation for USB Mass Storage devices
[20762.918273] usb 5-3: New USB device found, idVendor=19d2, idProduct=0052
[20762.918281] usb 5-3: New USB device strings: Mfr=2, Product=1, SerialNumber=3
[20762.918283] usb 5-3: Product: ZTE CDMA Technologies MSM
[20762.918288] usb 5-3: Manufacturer: ZTE, Incorporated
[20762.918292] usb 5-3: SerialNumber: 1234567890ABCDEF
[20762.918310] usb-storage: device found at 16
[20762.918312] usb-storage: waiting for device to settle before scanning
[20762.925756] usb-storage: device found at 16
[20762.925763] usb-storage: waiting for device to settle before scanning
[20763.873984] ACPI: Transitioning device [FAN1] to D0
[20763.873984] ACPI: Unable to turn cooling device [f7437fa4] 'on'
[20763.885982] ACPI: Transitioning device [FAN1] to D0
[20763.885982] ACPI: Unable to turn cooling device [f7437fa4] 'on'
[20767.947035] usb-storage: device scan complete
[20767.955031] scsi 27:0:0:0: CD-ROM ZTE USB SCSI CD-ROM 2.31 PQ: 0 ANSI: 0
[20767.955031] usb-storage: device scan complete
[20767.955031] scsi 26:0:0:0: Direct-Access ZTE MMC Storage 2.31 PQ: 0 ANSI: 2
[20767.971030] sr1: scsi3-mmc drive: 0x/52x cd/rw xa/form2 cdda tray
[20767.971030] sr 27:0:0:0: Attached scsi CD-ROM sr1
[20767.971030] sr 27:0:0:0: Attached scsi generic sg2 type 5
[20767.974094] sd 26:0:0:0: [sdb] Attached SCSI removable disk
[20767.974142] sd 26:0:0:0: Attached scsi generic sg3 type 0
[20781.259349] ISO 9660 Extensions: Microsoft Joliet Level 1
[20781.261906] ISOFS: changing to secondary root
Code: Select all
# lsusb -d 19d2:0052 -v
Bus 005 Device 016: ID 19d2:0052 ONDA Communication S.p.A.
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x19d2 ONDA Communication S.p.A.
idProduct 0x0052
bcdDevice 0.00
iManufacturer 2 ZTE, Incorporated
iProduct 1 ZTE CDMA Technologies MSM
iSerial 3 1234567890ABCDEF
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 184
bNumInterfaces 7
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xe0
Self Powered
Remote Wakeup
MaxPower 500mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 255 Vendor Specific Protocol
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 32
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 32
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 255 Vendor Specific Protocol
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 32
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 32
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 2
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 8 Mass Storage
bInterfaceSubClass 6 SCSI
bInterfaceProtocol 80 Bulk (Zip)
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x03 EP 3 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x83 EP 3 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 3
bAlternateSetting 0
bNumEndpoints 3
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 255 Vendor Specific Protocol
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x84 EP 4 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 5
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x85 EP 5 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 32
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x04 EP 4 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 32
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 4
bAlternateSetting 0
bNumEndpoints 3
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 255 Vendor Specific Protocol
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x86 EP 6 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 5
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x87 EP 7 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 32
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x05 EP 5 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 32
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 5
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 8 Mass Storage
bInterfaceSubClass 5 SFF-8070i
bInterfaceProtocol 80
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x06 EP 6 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x88 EP 8 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 6
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 255 Vendor Specific Protocol
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x07 EP 7 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x89 EP 9 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Device Qualifier (for other device speed):
bLength 10
bDescriptorType 6
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
bNumConfigurations 1
Device Status: 0x0001
Self Powered