Activation Codes and Methods, Hardware Details, Sniffing
Post Reply
MooSE
Posts: 1
Joined: Sun Apr 07, 2019 5:09 pm

New Device 05c6:1000 DS Telecom DSU7

Post by MooSE » Sun Apr 07, 2019 5:45 pm

Hi!

I have a modem from brand "DS Telecom", model "DSU7".


lsusb:

Code: Select all

Bus 002 Device 017: ID 05c6:1000 Qualcomm, Inc. Mass Storage Device

dmesg:

Code: Select all

[Сб апр  6 22:40:32 2019] usb 2-1: new high-speed USB device number 17 using xhci_hcd
[Сб апр  6 22:40:33 2019] usb 2-1: New USB device found, idVendor=05c6, idProduct=1000
[Сб апр  6 22:40:33 2019] usb 2-1: New USB device strings: Mfr=3, Product=2, SerialNumber=4
[Сб апр  6 22:40:33 2019] usb 2-1: Product: Qualcomm CDMA Technologies MSM
[Сб апр  6 22:40:33 2019] usb 2-1: Manufacturer: Qualcomm, Incorporated
[Сб апр  6 22:40:33 2019] usb 2-1: SerialNumber: 351602000025260
Solution for switch:

Code: Select all

usb_modeswitch -v 0x05c6 -p 0x1000 -V 0x05c6 -P 0x6000 -K -M 5553424312345678000000000000061b000000020000000000000000000000
Please add this to usb-modeswitch-data.

Josh
Site Admin
Posts: 6533
Joined: Sat Nov 03, 2007 12:30 am

Re: New Device 05c6:1000 DS Telecom DSU7

Post by Josh » Mon Sep 30, 2019 6:10 pm

Thanks!

What is the USB ID after the mode switch?

LOM
Posts: 1274
Joined: Wed Jul 11, 2012 3:14 pm
Location: Koh Samui, TH

Re: New Device 05c6:1000 DS Telecom DSU7

Post by LOM » Tue Oct 22, 2019 8:41 am

I don't think we can have generic support for this usb id, it will interfere with the entries for the same id which we already have with attribute filtering.
There has also been problem in the past for mobile phones using this id.

We need to see a verbose lsusb listing for this modem before it has switched.

sudo lsusb -v -d 05c6:1000

and paste the result here.

alexx
Posts: 2
Joined: Tue Dec 17, 2019 6:15 pm

Re: New Device 05c6:1000 DS Telecom DSU7

Post by alexx » Tue Dec 17, 2019 6:18 pm

USB ID after mode switch is 12d1:1001

Here is info about the device just after it has been inserted (detected as Mass Storage):

Code: Select all

$ sudo lsusb -v -d 05c6:1000

Bus 001 Device 027: ID 05c6:1000 Qualcomm, Inc. Mass Storage Device
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x05c6 Qualcomm, Inc.
  idProduct          0x1000 Mass Storage Device
  bcdDevice            0.00
  iManufacturer           3 USBModem
  iProduct                2 HSPA Data Card
  iSerial                 4 1234567890ABCDEF
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength       0x0020
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          1 Qualcomm Configuration
    bmAttributes         0xc0
      Self Powered
    MaxPower              500mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk-Only
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  bNumConfigurations      1
can't get debug descriptor: Resource temporarily unavailable
Device Status:     0x0000
  (Bus Powered)
And here is what happens after usb_modeswitch switches it (with MessageContent="5553424312345678000000000000061b000000020000000000000000000000"):

Code: Select all

$ sudo lsusb -v -d 12d1:1001

Bus 001 Device 026: ID 12d1:1001 Huawei Technologies Co., Ltd. E161/E169/E620/E800 HSDPA Modem
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x12d1 Huawei Technologies Co., Ltd.
  idProduct          0x1001 E161/E169/E620/E800 HSDPA Modem
  bcdDevice            0.00
  iManufacturer           3 USBModem
  iProduct                2 HSPA Data Card
  iSerial                 4 1234567890ABCDEF
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength       0x0083
    bNumInterfaces          5
    bConfigurationValue     1
    iConfiguration          1 Qualcomm Configuration
    bmAttributes         0xe0
      Self Powered
      Remote Wakeup
    MaxPower              500mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               5
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        2
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x84  EP 4 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x03  EP 3 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        3
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x85  EP 5 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x04  EP 4 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        4
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk-Only
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x05  EP 5 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x86  EP 6 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  bNumConfigurations      1
can't get debug descriptor: Resource temporarily unavailable
Device Status:     0x0002
  (Bus Powered)
  Remote Wakeup Enabled

LOM
Posts: 1274
Joined: Wed Jul 11, 2012 3:14 pm
Location: Koh Samui, TH

Re: New Device 05c6:1000 DS Telecom DSU7

Post by LOM » Wed Dec 18, 2019 3:59 am

alexx wrote:USB ID after mode switch is 12d1:1001
Is that really for a DS Telecom DSU7 for which user MooSE started this thread?

alexx
Posts: 2
Joined: Tue Dec 17, 2019 6:15 pm

Re: New Device 05c6:1000 DS Telecom DSU7

Post by alexx » Thu Dec 19, 2019 4:20 pm

Well, it's a good question. I guess that mine is a clone.

My modem looks a bit different from MooSE's. Initial USB IDs are the same, and MooSE's MessageContent="5553424312345678000000000000061b000000020000000000000000000000" for usb_modeswitch works for me.

My modem looks like this one: https://www.aliexpress.com/item/33037734160.html
MooSE's modem looks like this: https://www.ylsoftware.com/news/737

I think they are the same inside.

LOM
Posts: 1274
Joined: Wed Jul 11, 2012 3:14 pm
Location: Koh Samui, TH

Re: New Device 05c6:1000 DS Telecom DSU7

Post by LOM » Sat Dec 21, 2019 8:38 am

alexx wrote:Well, it's a good question. I guess that mine is a clone.

My modem looks a bit different from MooSE's. Initial USB IDs are the same, and MooSE's
That initial id has been used for lots of modems which doesn't have much in similarity with each other..
It is a bootloader id for smartphones containing Qualcomm chip and it is a bootloader id (initial id) for Qualcomm based modems, the corresponding firmware id (switched id) is 05c6:6000 like MooSe's.
05c6:1000/05c6:6000 is what Qualcomm delivers its modules with before being sold to someone making a product out of the module by applying their plastic casing and sticker with modem model name/number.
Those usb id's are "transport id's" and should be replaced with unique id's owned by manufacture of the finished product but there are loads of Chinese companies selling the modems without doing that, hence we have 10-12 years old modems as well as modern LTE modems with just those two id's..
alexx wrote: MessageContent="5553424312345678000000000000061b000000020000000000000000000000" for usb_modeswitch works for me.
It is the most common message for switching 05c6:1000 but knowing that doesn't help much, there are other switch messages for 05c6:1000 so usb_modeswitch has to distinguish between the different 05c6:1000 and does so by checking for usb attributes like manufacturer and product.
Yours can probably be added by checking if iManufacturer = USBModem but MooSE's modem might not be helped by that.
There was a reason for me asking him to show a verbose lsusb listing of 05c6:1000..

alexx wrote: My modem looks like this one: https://www.aliexpress.com/item/33037734160.html
MooSE's modem looks like this: https://www.ylsoftware.com/news/737

I think they are the same inside.
Inside doesn't count, and think doesn't count, it is what the bootloader presents in usb attributes that decides how it should be switched.
Yours has btw been programmed to have a Huawei switched id without being a Huawei product, most likely done because there are no Windows or linux drivers for 05c6:6000..

Post Reply