Activation Codes and Methods, Hardware Details, Sniffing
richirich
Posts: 15
Joined: 31 Dec 2010, 13:58

Haier CE100 (vendor=201e product=2009)

Post by richirich » 31 Dec 2010, 14:18

Hi

There is no modeswitch method for vendor=201e product=2009.
It's a Tata Photon data card MODEL NO. V-ME101 and Brand is Olive.
Its device information is

T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=201e ProdID=2009 Rev= 0.00
S: Manufacturer=Qualcomm, Incorporated
S: Product=USB MMC Storage
S: SerialNumber=000000000002
C:* #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none)
E: Ad=86(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=07(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms

Please please help me out.
Thanks in advance.

Josh
Site Admin
Posts: 6570
Joined: 03 Nov 2007, 00:30

Post by Josh » 31 Dec 2010, 15:18

The first switching command to try is the "eject" method which is widely used.

You could copy the "1a8d:1000" config file to "201e:2009" and adapt the content respectively (don't bother about the target IDs or the success check yet).
Then use it with usb_modeswitch and the "-c" parameter and see what happens.

If it does not change anything, you might have to sniff out the Windows driver.


richirich
Posts: 15
Joined: 31 Dec 2010, 13:58

Post by richirich » 10 Jan 2011, 12:10

Thanks Josh for reply. I will try that and will give you its result too.

atmoriyo
Posts: 5
Joined: 16 Jan 2011, 00:27
Location: Indonesia

Sniff result

Post by atmoriyo » 16 Jan 2011, 00:33

Here are the sniff result of Haier CE 100, but still don't know how to use it

Code: Select all

1	in down	n/a	0.000	GET_DESCRIPTOR_FROM_DEVICE		
URB Header (length: 80)
SequenceNumber: 1
Function: 000b (GET_DESCRIPTOR_FROM_DEVICE)
1	in up	n/a	0.000	CONTROL_TRANSFER	12 01 10 01 00 00 00 40	0x00000000
URB Header (length: 80)
SequenceNumber: 1
Function: 0008 (CONTROL_TRANSFER)
PipeHandle: 8195c4f8

SetupPacket:
0000: 80 06 00 01 00 00 12 00 
bmRequestType: 80
  DIR: Device-To-Host
  TYPE: Standard
  RECIPIENT: Device
bRequest: 06  
  GET_DESCRIPTOR
Descriptor Type: 0x0001
  DEVICE


TransferBuffer: 0x00000012 (18) length
0000: 12 01 10 01 00 00 00 40 1e 20 09 20 00 00 01 02 
0010: 03 01 
    bLength            : 0x12 (18)
    bDescriptorType    : 0x01 (1)
    bcdUSB             : 0x0110 (272)
    bDeviceClass       : 0x00 (0)
    bDeviceSubClass    : 0x00 (0)
    bDeviceProtocol    : 0x00 (0)
    bMaxPacketSize0    : 0x40 (64)
    idVendor           : 0x201e (8222)
    idProduct          : 0x2009 (8201)
    bcdDevice          : 0x0000 (0)
    iManufacturer      : 0x01 (1)
    iProduct           : 0x02 (2)
    iSerialNumber      : 0x03 (3)
    bNumConfigurations : 0x01 (1)
2	in down	n/a	0.000	GET_DESCRIPTOR_FROM_DEVICE		
URB Header (length: 80)
SequenceNumber: 2
Function: 000b (GET_DESCRIPTOR_FROM_DEVICE)
2	in up	n/a	0.010	CONTROL_TRANSFER	09 02 20 00 01 01 00 c0	0x00000000
URB Header (length: 80)
SequenceNumber: 2
Function: 0008 (CONTROL_TRANSFER)
PipeHandle: 8195c4f8

SetupPacket:
0000: 80 06 00 02 00 00 09 00 
bmRequestType: 80
  DIR: Device-To-Host
  TYPE: Standard
  RECIPIENT: Device
bRequest: 06  
  GET_DESCRIPTOR
Descriptor Type: 0x0002
  CONFIGURATION


TransferBuffer: 0x00000009 (9) length
0000: 09 02 20 00 01 01 00 c0 32 
    bLength            : 0x09 (9)
    bDescriptorType    : 0x02 (2)
    wTotalLength       : 0x0020 (32)
    bNumInterfaces     : 0x01 (1)
    bConfigurationValue: 0x01 (1)
    iConfiguration     : 0x00 (0)
    bmAttributes       : 0xc0 (192)
    MaxPower           : 0x32 (50)
3	in down	n/a	0.010	GET_DESCRIPTOR_FROM_DEVICE		
URB Header (length: 80)
SequenceNumber: 3
Function: 000b (GET_DESCRIPTOR_FROM_DEVICE)
3	in up	n/a	0.010	CONTROL_TRANSFER	09 02 20 00 01 01 00 c0	0x00000000
URB Header (length: 80)
SequenceNumber: 3
Function: 0008 (CONTROL_TRANSFER)
PipeHandle: 8195c4f8

SetupPacket:
0000: 80 06 00 02 00 00 20 00 
bmRequestType: 80
  DIR: Device-To-Host
  TYPE: Standard
  RECIPIENT: Device
bRequest: 06  
  GET_DESCRIPTOR
Descriptor Type: 0x0002
  CONFIGURATION


TransferBuffer: 0x00000020 (32) length
0000: 09 02 20 00 01 01 00 c0 32 09 04 00 00 02 08 06 
0010: 50 00 07 05 86 02 40 00 00 07 05 07 02 40 00 00 
    bLength            : 0x09 (9)
    bDescriptorType    : 0x02 (2)
    wTotalLength       : 0x0020 (32)
    bNumInterfaces     : 0x01 (1)
    bConfigurationValue: 0x01 (1)
    iConfiguration     : 0x00 (0)
    bmAttributes       : 0xc0 (192)
    MaxPower           : 0x32 (50)
4	in down	n/a	0.010	GET_DESCRIPTOR_FROM_DEVICE		
URB Header (length: 80)
SequenceNumber: 4
Function: 000b (GET_DESCRIPTOR_FROM_DEVICE)
4	in up	n/a	0.020	CONTROL_TRANSFER	04 03	0x00000000
URB Header (length: 80)
SequenceNumber: 4
Function: 0008 (CONTROL_TRANSFER)
PipeHandle: 8195c4f8

SetupPacket:
0000: 80 06 00 03 00 00 02 00 
bmRequestType: 80
  DIR: Device-To-Host
  TYPE: Standard
  RECIPIENT: Device
bRequest: 06  
  GET_DESCRIPTOR
Descriptor Type: 0x0003
  STRING


TransferBuffer: 0x00000002 (2) length
0000: 04 03 
5	in down	n/a	0.020	GET_DESCRIPTOR_FROM_DEVICE		
URB Header (length: 80)
SequenceNumber: 5
Function: 000b (GET_DESCRIPTOR_FROM_DEVICE)
5	in up	n/a	0.020	CONTROL_TRANSFER	04 03 09 04	0x00000000
URB Header (length: 80)
SequenceNumber: 5
Function: 0008 (CONTROL_TRANSFER)
PipeHandle: 8195c4f8

SetupPacket:
0000: 80 06 00 03 00 00 04 00 
bmRequestType: 80
  DIR: Device-To-Host
  TYPE: Standard
  RECIPIENT: Device
bRequest: 06  
  GET_DESCRIPTOR
Descriptor Type: 0x0003
  STRING


TransferBuffer: 0x00000004 (4) length
0000: 04 03 09 04 
6	in down	n/a	0.020	GET_DESCRIPTOR_FROM_DEVICE		
URB Header (length: 80)
SequenceNumber: 6
Function: 000b (GET_DESCRIPTOR_FROM_DEVICE)
6	in up	n/a	0.020	CONTROL_TRANSFER	1a 03	0x00000000
URB Header (length: 80)
SequenceNumber: 6
Function: 0008 (CONTROL_TRANSFER)
PipeHandle: 8195c4f8

SetupPacket:
0000: 80 06 03 03 09 04 02 00 
bmRequestType: 80
  DIR: Device-To-Host
  TYPE: Standard
  RECIPIENT: Device
bRequest: 06  
  GET_DESCRIPTOR
Descriptor Type: 0x0303
  unknown


TransferBuffer: 0x00000002 (2) length
0000: 1a 03 
7	in down	n/a	0.020	GET_DESCRIPTOR_FROM_DEVICE		
URB Header (length: 80)
SequenceNumber: 7
Function: 000b (GET_DESCRIPTOR_FROM_DEVICE)
7	in up	n/a	0.030	CONTROL_TRANSFER	1a 03 30 00 30 00 30 00	0x00000000
URB Header (length: 80)
SequenceNumber: 7
Function: 0008 (CONTROL_TRANSFER)
PipeHandle: 8195c4f8

SetupPacket:
0000: 80 06 03 03 09 04 1a 00 
bmRequestType: 80
  DIR: Device-To-Host
  TYPE: Standard
  RECIPIENT: Device
bRequest: 06  
  GET_DESCRIPTOR
Descriptor Type: 0x0303
  unknown


TransferBuffer: 0x0000001a (26) length
0000: 1a 03 30 00 30 00 30 00 30 00 30 00 30 00 30 00 
0010: 30 00 30 00 30 00 30 00 32 00 
8	??? down	n/a	0.030	SELECT_CONFIGURATION		
URB Header (length: 80)
SequenceNumber: 8
Function: 0000 (SELECT_CONFIGURATION)
Configuration Descriptor:
bLength: 9 (0x09)
bDescriptorType: 2 (0x02)
wTotalLength: 32 (0x0020)
bNumInterfaces: 1 (0x01)
bConfigurationValue: 1 (0x01)
iConfiguration: 0 (0x00)
bmAttributes: 192 (0xc0)
  0x80: Bus Powered
  0x40: Self Powered
MaxPower: 50 (0x32)
  (in 2 mA units, therefore 100 mA power consumption)

Number of interfaces: 1
Interface[0]:
  Length: 0x0038
  InterfaceNumber: 0x00
  AlternateSetting: 0x00
  Class             = 0x00
  SubClass          = 0x00
  Protocol          = 0x00
  InterfaceHandle   = 0x00000000
  NumberOfPipes     = 0x00000002
  Pipe[0]:
    MaximumPacketSize = 0x0000
    EndpointAddress   = 0x00
    Interval          = 0x00
    PipeType          = 0x00
      UsbdPipeTypeControl
    PipeHandle        = 0x00000000
    MaxTransferSize   = 0x00001000
    PipeFlags         = 0x00
  Pipe[1]:
    MaximumPacketSize = 0x0000
    EndpointAddress   = 0x00
    Interval          = 0x00
    PipeType          = 0x00
      UsbdPipeTypeControl
    PipeHandle        = 0x00000000
    MaxTransferSize   = 0x00001000
    PipeFlags         = 0x00
8	??? up	n/a	0.070	SELECT_CONFIGURATION		0x00000000
URB Header (length: 80)
SequenceNumber: 8
Function: 0000 (SELECT_CONFIGURATION)
Configuration Descriptor:
bLength: 9 (0x09)
bDescriptorType: 2 (0x02)
wTotalLength: 32 (0x0020)
bNumInterfaces: 1 (0x01)
bConfigurationValue: 1 (0x01)
iConfiguration: 0 (0x00)
bmAttributes: 192 (0xc0)
  0x80: Bus Powered
  0x40: Self Powered
MaxPower: 50 (0x32)
  (in 2 mA units, therefore 100 mA power consumption)

Number of interfaces: 1
Interface[0]:
  Length: 0x0038
  InterfaceNumber: 0x00
  AlternateSetting: 0x00
  Class             = 0x08
  SubClass          = 0x06
  Protocol          = 0x50
  InterfaceHandle   = 0x81a25bc8
  NumberOfPipes     = 0x00000002
  Pipe[0]:
    MaximumPacketSize = 0x0040
    EndpointAddress   = 0x86
    Interval          = 0x00
    PipeType          = 0x02
      UsbdPipeTypeBulk
    PipeHandle        = 0x81a25be4
    MaxTransferSize   = 0x00001000
    PipeFlags         = 0x00
  Pipe[1]:
    MaximumPacketSize = 0x0040
    EndpointAddress   = 0x07
    Interval          = 0x00
    PipeType          = 0x02
      UsbdPipeTypeBulk
    PipeHandle        = 0x81a25c04
    MaxTransferSize   = 0x00001000
    PipeFlags         = 0x00
9	inout down	n/a	0.070	SELECT_INTERFACE		
URB Header (length: 76)
SequenceNumber: 9
Function: 0001 (SELECT_INTERFACE)
ConfigurationHandle: 0x81bec390 (-2118204528)

Interface:
  Length: 0x0038 (56)
  InterfaceNumber: 0x00 (0)
  AlternateSetting: 0x00 (0)
9	inout up	n/a	0.110	SELECT_INTERFACE		0x00000000
URB Header (length: 76)
SequenceNumber: 9
Function: 0001 (SELECT_INTERFACE)
ConfigurationHandle: 0x81bec390 (-2118204528)

Interface:
  Length: 0x0038 (56)
  InterfaceNumber: 0x00 (0)
  AlternateSetting: 0x00 (0)

Output
  Class: 0x08 (8)
  SubClass: 0x06 (6)
  Protocol: 0x50 (80)
  Reserved: 0x00
  InterfaceHandle: 0x817ecce0
  NumberOfPipes: 0x00000002 (2)
  Pipe[0]:
    MaximumPacketSize: 0x0040 (64)
    EndpointAddress: 0x86 (134)
    Interval: 0 ms
    PipeType: 0x02
      UsbdPipeTypeBulk
    PipeHandle: 0x817eccfc

    MaximumTransferSize: 0x00010000 (65536) bytes
    PipeFlags: 0x00000000 (0)
  Pipe[1]:
    MaximumPacketSize: 0x0040 (64)
    EndpointAddress: 0x07 (7)
    Interval: 0 ms
    PipeType: 0x02
      UsbdPipeTypeBulk
    PipeHandle: 0x817ecd1c

    MaximumTransferSize: 0x00010000 (65536) bytes
    PipeFlags: 0x00000000 (0)
10	out down	n/a	0.110	CLASS_INTERFACE	-	
URB Header (length: 80)
SequenceNumber: 10
Function: 001b (CLASS_INTERFACE)
PipeHandle: 00000000

SetupPacket:
0000: 00 fe 00 00 00 00 00 00 
bmRequestType: 00
  DIR: Host-To-Device
  TYPE: Standard
  RECIPIENT: Device
bRequest: fe  
  unknown!


No TransferBuffer

10	in up	n/a	0.120	CONTROL_TRANSFER	00	0x00000000
URB Header (length: 80)
SequenceNumber: 10
Function: 0008 (CONTROL_TRANSFER)
PipeHandle: 8195c4f8

SetupPacket:
0000: a1 fe 00 00 00 00 01 00 
bmRequestType: a1
  DIR: Device-To-Host
  TYPE: Class
  RECIPIENT: Interface
bRequest: fe  


TransferBuffer: 0x00000001 (1) length
0000: 00 
11	??? down	n/a	0.120	BULK_OR_INTERRUPT_TRANSFER	55 53 42 43 08 0a 92 81	
URB Header (length: 72)
SequenceNumber: 11
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000000

TransferBuffer: 0x0000001f (31) length
0000: 55 53 42 43 08 0a 92 81 24 00 00 00 80 00 06 12 
0010: 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 
11	??? up	n/a	0.120	BULK_OR_INTERRUPT_TRANSFER	-	0x00000000
URB Header (length: 72)
SequenceNumber: 11
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000000

No TransferBuffer

12	??? down	n/a	0.120	BULK_OR_INTERRUPT_TRANSFER	00 00 00 00 00 00 00 00	
URB Header (length: 72)
SequenceNumber: 12
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000002

TransferBuffer: 0x00000024 (36) length
0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
0020: 00 00 00 00 
12	??? up	n/a	0.130	BULK_OR_INTERRUPT_TRANSFER	05 80 02 00 33 00 00 00	0x00000000
URB Header (length: 72)
SequenceNumber: 12
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000003

TransferBuffer: 0x00000024 (36) length
0000: 05 80 02 00 33 00 00 00 51 75 61 6c 63 6f 6d 6d 
0010: 4d 4d 43 20 53 74 6f 72 61 67 65 20 20 20 20 20 
0020: 32 2e 33 31 
13	??? down	n/a	0.130	BULK_OR_INTERRUPT_TRANSFER	55 53 42 43 08 0a 92 81	
URB Header (length: 72)
SequenceNumber: 13
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000000

TransferBuffer: 0x0000000d (13) length
0000: 55 53 42 43 08 0a 92 81 24 00 00 00 80 
13	??? up	n/a	0.130	BULK_OR_INTERRUPT_TRANSFER	55 53 42 53 08 0a 92 81	0x00000000
URB Header (length: 72)
SequenceNumber: 13
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000001

TransferBuffer: 0x0000000d (13) length
0000: 55 53 42 53 08 0a 92 81 00 00 00 00 00 
14	??? down	n/a	0.130	BULK_OR_INTERRUPT_TRANSFER	55 53 42 43 c0 d9 7e 81	
URB Header (length: 72)
SequenceNumber: 14
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000000

TransferBuffer: 0x0000001f (31) length
0000: 55 53 42 43 c0 d9 7e 81 24 00 00 00 80 00 06 12 
0010: 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 
14	??? up	n/a	0.140	BULK_OR_INTERRUPT_TRANSFER	-	0x00000000
URB Header (length: 72)
SequenceNumber: 14
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000000

No TransferBuffer

15	??? down	n/a	0.140	BULK_OR_INTERRUPT_TRANSFER	b8 7d ca 6e 60 8b fd a6	
URB Header (length: 72)
SequenceNumber: 15
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000002

TransferBuffer: 0x00000024 (36) length
0000: b8 7d ca 6e 60 8b fd a6 bd e2 9c c2 c9 2c 44 99 
0010: 00 40 b0 81 c7 60 d4 c5 13 46 e4 8d 52 f4 a4 8e 
0020: 8c 93 6d e9 
15	??? up	n/a	0.150	BULK_OR_INTERRUPT_TRANSFER	05 80 02 00 33 00 00 00	0x00000000
URB Header (length: 72)
SequenceNumber: 15
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000003

TransferBuffer: 0x00000024 (36) length
0000: 05 80 02 00 33 00 00 00 51 75 61 6c 63 6f 6d 6d 
0010: 4d 4d 43 20 53 74 6f 72 61 67 65 20 20 20 20 20 
0020: 32 2e 33 31 
16	??? down	n/a	0.150	BULK_OR_INTERRUPT_TRANSFER	55 53 42 43 c0 d9 7e 81	
URB Header (length: 72)
SequenceNumber: 16
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000000

TransferBuffer: 0x0000000d (13) length
0000: 55 53 42 43 c0 d9 7e 81 24 00 00 00 80 
16	??? up	n/a	0.160	BULK_OR_INTERRUPT_TRANSFER	55 53 42 53 c0 d9 7e 81	0x00000000
URB Header (length: 72)
SequenceNumber: 16
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000001

TransferBuffer: 0x0000000d (13) length
0000: 55 53 42 53 c0 d9 7e 81 00 00 00 00 00 
17	??? down	n/a	0.160	BULK_OR_INTERRUPT_TRANSFER	55 53 42 43 c0 d9 7e 81	
URB Header (length: 72)
SequenceNumber: 17
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000000

TransferBuffer: 0x0000001f (31) length
0000: 55 53 42 43 c0 d9 7e 81 38 00 00 00 80 00 06 12 
0010: 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 
17	??? up	n/a	0.160	BULK_OR_INTERRUPT_TRANSFER	-	0x00000000
URB Header (length: 72)
SequenceNumber: 17
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000000

No TransferBuffer

18	??? down	n/a	0.160	BULK_OR_INTERRUPT_TRANSFER	05 80 02 00 33 00 00 00	
URB Header (length: 72)
SequenceNumber: 18
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000002

TransferBuffer: 0x00000038 (56) length
0000: 05 80 02 00 33 00 00 00 51 75 61 6c 63 6f 6d 6d 
0010: 4d 4d 43 20 53 74 6f 72 61 67 65 20 20 20 20 20 
0020: 32 2e 33 31 32 37 d3 80 56 c1 8d 03 db 63 ba b2 
0030: e1 64 8c 3f 98 76 2f c5 
18	??? up	n/a	0.170	BULK_OR_INTERRUPT_TRANSFER	05 80 02 00 33 00 00 00	0x00000000
URB Header (length: 72)
SequenceNumber: 18
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000003

TransferBuffer: 0x00000038 (56) length
0000: 05 80 02 00 33 00 00 00 51 75 61 6c 63 6f 6d 6d 
0010: 4d 4d 43 20 53 74 6f 72 61 67 65 20 20 20 20 20 
0020: 32 2e 33 31 20 20 20 20 20 20 20 20 20 20 20 20 
0030: 20 20 20 20 20 20 20 20 
19	??? down	n/a	0.170	BULK_OR_INTERRUPT_TRANSFER	55 53 42 43 c0 d9 7e 81	
URB Header (length: 72)
SequenceNumber: 19
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000000

TransferBuffer: 0x0000000d (13) length
0000: 55 53 42 43 c0 d9 7e 81 38 00 00 00 80 
19	??? up	n/a	0.170	BULK_OR_INTERRUPT_TRANSFER	55 53 42 53 c0 d9 7e 81	0x00000000
URB Header (length: 72)
SequenceNumber: 19
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000001

TransferBuffer: 0x0000000d (13) length
0000: 55 53 42 53 c0 d9 7e 81 00 00 00 00 00 
20	??? down	n/a	0.170	BULK_OR_INTERRUPT_TRANSFER	55 53 42 43 08 0a 92 81	
URB Header (length: 72)
SequenceNumber: 20
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000000

TransferBuffer: 0x0000001f (31) length
0000: 55 53 42 43 08 0a 92 81 08 00 00 00 80 00 0a 25 
0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
20	??? up	n/a	0.170	BULK_OR_INTERRUPT_TRANSFER	-	0x00000000
URB Header (length: 72)
SequenceNumber: 20
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000000

No TransferBuffer

21	??? down	n/a	0.170	BULK_OR_INTERRUPT_TRANSFER	00 00 00 00 00 00 00 00	
URB Header (length: 72)
SequenceNumber: 21
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000002

TransferBuffer: 0x00000008 (8) length
0000: 00 00 00 00 00 00 00 00 
21	??? up	n/a	0.180	BULK_OR_INTERRUPT_TRANSFER	00 00 27 3f 00 00 08 00	0x00000000
URB Header (length: 72)
SequenceNumber: 21
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000003

TransferBuffer: 0x00000008 (8) length
0000: 00 00 27 3f 00 00 08 00 
22	??? down	n/a	0.180	BULK_OR_INTERRUPT_TRANSFER	55 53 42 43 08 0a 92 81	
URB Header (length: 72)
SequenceNumber: 22
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000000

TransferBuffer: 0x0000000d (13) length
0000: 55 53 42 43 08 0a 92 81 08 00 00 00 80 
22	??? up	n/a	0.180	BULK_OR_INTERRUPT_TRANSFER	55 53 42 53 08 0a 92 81	0x00000000
URB Header (length: 72)
SequenceNumber: 22
Function: 0009 (BULK_OR_INTERRUPT_TRANSFER)
TransferFlags: 0x00000001

TransferBuffer: 0x0000000d (13) length
0000: 55 53 42 53 08 0a 92 81 00 00 00 00 00 

Josh
Site Admin
Posts: 6570
Joined: 03 Nov 2007, 00:30

Post by Josh » 16 Jan 2011, 11:48

Can you confirm that this is the whole log right up to the moment of switching ?

This is important because the commands immediately before that moment are obviously suspicious.

atmoriyo
Posts: 5
Joined: 16 Jan 2011, 00:27
Location: Indonesia

Post by atmoriyo » 16 Jan 2011, 15:06

This is exactly what i have done :

I'm capturing the logs from windows XP inside VirtualBox on top of Archlinux. On Windows XP, i started the usblog driver just for the MMC storage, then i plug the modem. The log still zero. From virtualbox menu, the device is recognized as MMC storage, but from archlinux (the host OS) this modem already recognized by the option module and already mapped to /dev/ttyUSB0, and i think the option module is incorrect because i still cannot connect, even the ATZ command is not responding.

Then from VirtualBox menu, i gave this USB device to be accessed from guest OS (in this case is Windows XP). The usblog start capturing, and then the log is freezing because the device is disconnected and changing the role become modem device. Thats all the log what i've got.

Yes this dongle is rather weird, if i plug the modem before i start the computer, sr_mod will recognized it and mapped correctly to /dev/sr1 and after ejected, the option module will start recognized and mapped to ttyUSB0, ttyUSB1 and ttyUSB2. And i can connect to internet.

But if i plug the modem after i start the computer, sr_mod will not recognized it, but option module recognized it and mapped to only one device /dev/ttyUSB0. It seems option module falsely recognized it because from VirtualBox, it still recognized as MMC storage and i cannot connect to internet. In this situation, i'm starting the XP from virtualbox, then running the CE 100 windows driver just to switch this device from MMC storage into Qualcom modem. From dmesg, this dongle is correctly mapped to ttyUSB0, ttyUSB1 and ttyUSB2. At this point, it seems i can dial from archlinux, but its not. I have to remove the option module first, the reload again, after that i can dial it.

Fiuhh ... long way just want to see the pppd running :)

Josh
Site Admin
Posts: 6570
Joined: 03 Nov 2007, 00:30

Post by Josh » 16 Jan 2011, 19:12

Generally, my instict tells me it's better to sniff on a native Windows, as well as doing the first switching attempts on a native Linux with no guest system ...

If you installed the sniffing filter in Windows on the MMC storage, you may have gotten the wrong line. The storage card slot usually included with these 3G sticks will in most cases be available only after switching. It may well be that the original install storage (the pseudo CD-ROM) is hiding under the same name, but with a different ID.

Concerning the USB ID: is there any change after the "eject" you are performing ? Is it still 201e:2009 ?

If so, I should like to see the result from "lsusb -v -d 201e:2009" before and after switching (ejecting).


atmoriyo
Posts: 5
Joined: 16 Jan 2011, 00:27
Location: Indonesia

Post by atmoriyo » 17 Jan 2011, 03:01

I follow your direction, i'm capturing the usblog on native windows,
installing the capture driver for 'USB composite device' only, and automatically its also installing the capture driver for MMC storage, and i got three log files :

http://pastebin.com/4S1vzPGN
http://pastebin.com/hfSaCHde
http://pastebin.com/9EtHhsWc

Thanks for your patient Josh

Josh
Site Admin
Posts: 6570
Joined: 03 Nov 2007, 00:30

Post by Josh » 17 Jan 2011, 09:39

I'm not sure you caught the right device.

I don't know about that program you use for sniffing; I usually use and recomment "SniffUSB" which is linked on the usb_modeswitch doc page, paragraph "Contribute".
In this program, there is an option to list all devices ever having been connected to the computer, and to install the sniffing filter on one of the devices not connected at the moment.

This is important because the original device - present when plugging in - will be gone a moment later. Switching modes is like unplugging one device and plugging in a different one.

So you would have to catch that original device which is the receiver of the switching command. But it will not be visible if you see a list of active devices only.
If you can see a composite device, it is usually switched already. It consists of several "subdevices" which can have various drivers attached.

Again, please check the original (unswitched) mode in Linux and run
"lsusb -v -d 201e:2009" (if that is the USB ID when not switched).


atmoriyo
Posts: 5
Joined: 16 Jan 2011, 00:27
Location: Indonesia

Post by atmoriyo » 17 Jan 2011, 13:26

I'm using SnoopyPro, it can see inactive device too.
Wondering if SniffUSB can see more device, i'm installing the SniffUSB too, after checking 'list devices not present', their listing exactly equal with what snoopypro list.

These are all the devices with vendor id 201e :
1. USB\Vid201e&Piid_2009&Rev_000 USB Composite Device
2. USB\Vid201e&Piid_2009&Rev_000 USB Mass Storage Device
3. USB\Vid201e&Piid_2009&Rev_000 USB Wireless Modem
4. USB\Vid201e&Piid_2009&Rev_000 USB Wireless Modem Diagnostic Interface
5. USB\Vid201e&Piid_2009&Rev_000 USB Wireless Modem NMEA device
Thats all

The log i've produced previously is the result on installing capture driver on item #1 and #2
Would you hint me, on what item should i sniff ?

And for the 'lsusb -v -d 20e1:2009', you can see the captured output here, this what i've done :

1. First i kill udevd, so no automatic module loading.

2. Then unloading option,sr_mod,usb_wwan module

3. Plug the modem, here are the result :
http://pastebin.com/34LgAhbd

4. From dmesg, it still not mapped into /dev/sr1, so i load the sr_mod, and the result of lsusb after that :
http://pastebin.com/1A2GZLcE

5. Eject /dev/sr1, and the lsusb after that :
http://pastebin.com/45Saye5N

Josh
Site Admin
Posts: 6570
Joined: 03 Nov 2007, 00:30

Post by Josh » 17 Jan 2011, 17:21

I think you can skip any further sniffing, we know enough about the device.
It's a little strange that the install device is appearing as the MMC slot later but the main point is that the thing can be switched with the "eject" command.

You can add a new file "201e:2009" to the folder "/etc/usb_modeswitch.d" with this content:

Code: Select all

#######################################################
# Haier CE 100

DefaultVendor=  0x201e
DefaultProduct= 0x2009

TargetClass=    0xff

MessageContent="5553424312345678000000000000061e000000000000000000000000000000"
MessageContent2="5553424312345679000000000000061b000000020000000000000000000000"

NeedResponse=1

CheckSuccess=10
Then you can test this config file manually with
"usb_modeswitch -I -c /etc/usb_modeswitch.d/201e:2009".

If it works you can make the switching automatic by adding a rule line to
"/lib/udev/rules.d/40-usb_modeswitch.rules". It's pretty straightforward if you look into it.


atmoriyo
Posts: 5
Joined: 16 Jan 2011, 00:27
Location: Indonesia

Post by atmoriyo » 18 Jan 2011, 02:56

U r very damn good ! Its works, thanks you very much.
This modem is quite popular in Indonesia, maybe better if u can add this device to your package.
Once again, many thanks

Josh
Site Admin
Posts: 6570
Joined: 03 Nov 2007, 00:30

Post by Josh » 20 Jan 2011, 00:45

Of course I will add this device in the next data package release.

If you want, give me your real name (via PM or e-mail) and I'll add you as the contributor for this device. You did some important work, after all.

moonsunearth
Posts: 1
Joined: 20 Jan 2011, 10:26

Post by moonsunearth » 20 Jan 2011, 10:36

so funny,ce100 is my first 3g modem product.
I code all drivers and firmware. :roll:

I add standard eject scsi command.

richirich
Posts: 15
Joined: 31 Dec 2010, 13:58

Post by richirich » 17 Feb 2011, 12:26

WOW Josh, thanks a lot.
Well it was working with eject command.
But it's very nice that it can be achieved with usb_modeswitch too. Now no more need of eject.
I get latest usb_modeswitch and fired the command line
usb_modeswitch -v 0x201e -p 0x2009 -C 0xff -M 5553424312345678000000000000061e000000000000000000000000000000 -2 5553424312345679000000000000061b000000020000000000000000000000 -I

Looking for target devices ...
No devices in target mode or class found
Looking for default devices ...
Found devices in default mode, class or configuration (1)
Accessing device 005 on bus 001 ...
Getting the current device configuration ...
OK, got current device configuration (1)
Using endpoints 0x07 (out) and 0x86 (in)
Using endpoints 0x07 (out) and 0x86 (in)

USB description data (for identification)
-------------------------
Manufacturer: Qualcomm, Incorporated
Product: USB MMC Storage
Serial No.: 000000000002
-------------------------
Looking for active driver ...
OK, driver found ("option")
OK, driver "option" detached
Setting up communication with interface 0 ...
Using endpoint 0x07 for message sending ...
Trying to send message 1 to endpoint 0x07 ...
OK, message successfully sent
Trying to send message 2 to endpoint 0x07 ...
OK, message successfully sent
Resetting response endpoint 0x86
Error resetting endpoint: -71
Resetting message endpoint 0x07
Error resetting endpoint: -71
Device is gone, skipping any further commands
-> Run lsusb to note any changes. Bye.


and after this my modem gets working. But i have some queries regarding this. From usb_modeswitch output, it seems all is ok but there is some error line(in bold). So does it matter ??? or should i ignore it.
and my another query is ...do we really need "-I" option. I checked it without -I. It's also working.

Post Reply