Activation Codes and Methods, Hardware Details, Sniffing
Post Reply
boltyu
Posts: 4
Joined: Mon May 21, 2018 11:38 am

vendor:1c9e , product:9b05

Post by boltyu » Tue May 22, 2018 4:31 am

platform : Linux tegra-ubuntu 4.4.38 aarch64@nvidia TX2
manufacturer : longsung

after failing to download ""SniffUSB",

i follow some instructions on the web:

1. modify "/lib/udev/rules.d/40-usb_modeswitch.rules" ,
add " ATTR{idVendor}=="1c9e", ATTR{idProduct}=="9b05", RUN+="usb_modeswitch '%b/%k'" "
2. createfile "/etc/usb_modeswitch.d/1c9e:9b05" ,
add " DefaultVendor=0x1c9e DefaultProduct=0x9b05 TargetVendor=0x1c9e TargetProduct=0x0257 MessageContent="55534243123456782400000080000685000000240000000000000000000000" CheckSuccess=20 "

then replug the usbmodem , "ttyUSBN" has been added to /dev , and i hava tested "AT" cmd successfuly

how did it work?

LOM
Posts: 1286
Joined: Wed Jul 11, 2012 3:14 pm
Location: Koh Samui, TH

Re: vendor:1c9e , product:9b05

Post by LOM » Tue May 22, 2018 5:34 am

boltyu wrote:
how did it work?
I have no idea :) because of the limited info you gave.
Please post the output from lsusb -vd 1c9e:9b05 before you switch it, then the same output from the expected target device 1c9e:0257 after you have switched it.

boltyu
Posts: 4
Joined: Mon May 21, 2018 11:38 am

Re: vendor:1c9e , product:9b05

Post by boltyu » Tue May 22, 2018 8:19 am

LOM wrote: I have no idea :) because of the limited info you gave.
Please post the output from lsusb -vd 1c9e:9b05 before you switch it, then the same output from the expected target device 1c9e:0257 after you have switched it.
thanks to LOM

<<< before switch >>>
--->printed info in terminal
[ 22.510780] usb 1-2: new high-speed USB device number 2 using xhci-tegra
[ 22.643863] usb 1-2: New USB device found, idVendor=1c9e, idProduct=9b05
[ 22.650603] usb 1-2: New USB device strings: Mfr=2, Product=3, SerialNumber=4
[ 22.657772] usb 1-2: Product: USB Modem
[ 22.661639] usb 1-2: Manufacturer: USB Modem
[ 22.666931] xhci-tegra 3530000.xhci: tegra_xhci_mbox_work mailbox command 6
[ 23.937768] xhci-tegra 3530000.xhci: tegra_xhci_mbox_work mailbox command 5
[ 23.944802] xhci-tegra 3530000.xhci: tegra_xhci_mbox_work ignore firmware MBOX_CMD_DEC_SSPI_CLOCK ret

--->"lsusb -vd 1c9e:9b05"

Code: Select all

Bus 001 Device 002: ID 1c9e:9b05 OMEGA TECHNOLOGY 
Couldn't open device, some information will be missing
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x1c9e OMEGA TECHNOLOGY
  idProduct          0x9b05 
  bcdDevice            2.32
  iManufacturer           2 
  iProduct                3 
  iSerial                 4 
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength          232
    bNumInterfaces          6
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0x80
      (Bus Powered)
    MaxPower              500mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      ** UNRECOGNIZED:  05 24 00 10 01
      ** UNRECOGNIZED:  05 24 01 00 00
      ** UNRECOGNIZED:  04 24 02 02
      ** UNRECOGNIZED:  05 24 06 00 00
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x000a  1x 10 bytes
        bInterval               9
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        2
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      ** UNRECOGNIZED:  05 24 00 10 01
      ** UNRECOGNIZED:  05 24 01 00 00
      ** UNRECOGNIZED:  04 24 02 02
      ** UNRECOGNIZED:  05 24 06 00 00
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x85  EP 5 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x000a  1x 10 bytes
        bInterval               9
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x84  EP 4 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x03  EP 3 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        3
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      ** UNRECOGNIZED:  05 24 00 10 01
      ** UNRECOGNIZED:  05 24 01 00 00
      ** UNRECOGNIZED:  04 24 02 02
      ** UNRECOGNIZED:  05 24 06 00 00
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x87  EP 7 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x000a  1x 10 bytes
        bInterval               9
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x86  EP 6 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x04  EP 4 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        4
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x89  EP 9 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0008  1x 8 bytes
        bInterval               9
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x88  EP 8 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x05  EP 5 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        5
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass     66 
      bInterfaceProtocol      1 
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x8a  EP 10 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x06  EP 6 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0

<<< after switch >>>
--->print info in terminal
[ 811.145406] usb 1-2: new high-speed USB device number 3 using xhci-tegra
[ 811.278941] usb 1-2: New USB device found, idVendor=1c9e, idProduct=9b05
[ 811.285694] usb 1-2: New USB device strings: Mfr=2, Product=3, SerialNumber=4
[ 811.292969] usb 1-2: Product: USB Modem
[ 811.296894] usb 1-2: Manufacturer: USB Modem
[ 811.302712] xhci-tegra 3530000.xhci: tegra_xhci_mbox_work mailbox command 6
[ 811.311044] option 1-2:1.0: GSM modem (1-port) converter detected
[ 811.317508] usb 1-2: GSM modem (1-port) converter now attached to ttyUSB0
[ 811.324692] option 1-2:1.1: GSM modem (1-port) converter detected
[ 811.331069] usb 1-2: GSM modem (1-port) converter now attached to ttyUSB1
[ 811.338206] option 1-2:1.2: GSM modem (1-port) converter detected
[ 811.344523] usb 1-2: GSM modem (1-port) converter now attached to ttyUSB2
[ 811.351576] option 1-2:1.3: GSM modem (1-port) converter detected
[ 811.357834] usb 1-2: GSM modem (1-port) converter now attached to ttyUSB3
[ 811.364841] option 1-2:1.4: GSM modem (1-port) converter detected
[ 811.371066] usb 1-2: GSM modem (1-port) converter now attached to ttyUSB4
[ 811.378043] option 1-2:1.5: GSM modem (1-port) converter detected
[ 811.384254] usb 1-2: GSM modem (1-port) converter now attached to ttyUSB5
[ 812.572489] xhci-tegra 3530000.xhci: tegra_xhci_mbox_work mailbox command 5
[ 812.579453] xhci-tegra 3530000.xhci: tegra_xhci_mbox_work ignore firmware MBt

--->"lsusb -vd 1c9e:0257" has no output info
--->"lsusb -vd 1c9e:9b05" same to above

actually i dont know how to fill "target * id = " , just try some id , like 0257.

LOM
Posts: 1286
Joined: Wed Jul 11, 2012 3:14 pm
Location: Koh Samui, TH

Re: vendor:1c9e , product:9b05

Post by LOM » Tue May 22, 2018 9:25 am

boltyu wrote:--->"lsusb -vd 1c9e:9b05" same to above

actually i dont know how to fill "target * id = " , just try some id , like 0257.
I actually suspected that :) , Longsung has not used such low numbered pid in the past.
There are other of their devices I know of in the 9bxx pid series and they get those pids after switching, the verbose lsusb of your device shows the same ie a device already in useable mode.
I think that your device does not have an initial mode and instead starts up in usable mode without the need for any switching.

The pid 9b05 is not supported in linux serial driver named option but older version of usb_modeswitch will load the option driver and then add temporary support by using the drivers new_id function. Thats why you get ttyUSB interfaces after running usb_modeswitch and that is the only thing usb_modeswitch has done for you.
You can get the same result by skipping the udev rule and the device config file and instead do:

modeprobe option
echo '1c9e 9b05 ff' > /sys/bus/usb-serial/drivers/option1/new_id

The usage for a few of the 6 interfaces in your device are easy to guess:
Interface 0 is for Device Management (flashing new firmware for instance) and interface 5 is for Android debug.
Interface 4 is most likely a qmi/rmnet interface for direct ethernet connection.

Two of the three remaining interface are for ppp dialup modem and for AT-cmd, the third I don't know.
Probably for SIM card comms or maybe for PCM Voice over serial.

boltyu
Posts: 4
Joined: Mon May 21, 2018 11:38 am

Re: vendor:1c9e , product:9b05

Post by boltyu » Wed May 23, 2018 7:58 am

LOM wrote: You can get the same result by skipping the udev rule and the device config file and instead do:

modeprobe option
echo '1c9e 9b05 ff' > /sys/bus/usb-serial/drivers/option1/new_id

The usage for a few of the 6 interfaces in your device are easy to guess:
Interface 0 is for Device Management (flashing new firmware for instance) and interface 5 is for Android debug.
Interface 4 is most likely a qmi/rmnet interface for direct ethernet connection.

Two of the three remaining interface are for ppp dialup modem and for AT-cmd, the third I don't know.
Probably for SIM card comms or maybe for PCM Voice over serial.
it works with echo operation! but it need to be executed manually every time after a system cold start , i keep using usb_modeswitch just only with a little config :D
are you the author ? its really a awesome tool help me to understand how usbmodem work on linux and manage devices

LOM
Posts: 1286
Joined: Wed Jul 11, 2012 3:14 pm
Location: Koh Samui, TH

Re: vendor:1c9e , product:9b05

Post by LOM » Wed May 23, 2018 1:55 pm

boltyu wrote: it works with echo operation! but it need to be executed manually every time after a system cold start , i keep using usb_modeswitch just only with a little config :D
Be aware that later versions of usb_modeswitch does not load drivers, it would be more future safe if you wrote a shell script with those two lines in it and then RUN it from udev instead of using usb_modeswitch as a driver loader.
boltyu wrote: are you the author ? its really a awesome tool help me to understand how usbmodem work on linux and manage devices
No, I'm just one of many contributors, see

http://www.draisberghof.de/usb_modeswitch/#whodunit

boltyu
Posts: 4
Joined: Mon May 21, 2018 11:38 am

Re: vendor:1c9e , product:9b05

Post by boltyu » Mon May 28, 2018 2:28 am

thanks to all contributors ! :D

Post Reply