Activation Codes and Methods, Hardware Details, Sniffing
-
Johnny
- Posts: 4
- Joined: 10 Feb 2023, 11:39
Post
by Johnny » 10 Feb 2023, 11:54
The 4G Systems XSStick
W1209 presents as a mass storage device with vendor ID "2fd4" and device ID "4000". The Windows tool switches it to modem mode, which presents as vendor ID "2fd4" and device ID "4001". This mode switch can be replicated with
Code: Select all
usb_modeswitch -v 2fd4 -p 4000 -V 2fd4 -P 4001 -M "55534243606566058000000080000606f50402527600000000000000000000"
In modem mode, the
W1209 is an RNDIS virtual ethernet device which offers an IP address in the 192.168.123.0/24 network via DHCP and has an HTTP web interface at 192.168.123.254.
HTH.
-
Johnny
- Posts: 4
- Joined: 10 Feb 2023, 11:39
Post
by Johnny » 11 Aug 2023, 19:07
-deleted-
Last edited by
Johnny on 28 Aug 2023, 22:05, edited 1 time in total.
-
Johnny
- Posts: 4
- Joined: 10 Feb 2023, 11:39
Post
by Johnny » 13 Aug 2023, 19:44
The W1209 can be turned into an MBIM device with the same USB message as the W1208. It then changes its device ID from $4000 to $4004. This should be preferred due to RNDIS being deprecated.
-
thomasschaefer
- Posts: 114
- Joined: 17 Jul 2011, 12:08
Post
by thomasschaefer » 26 Aug 2023, 21:55
Thank you. It works for me.
Code: Select all
usb_modeswitch -v 2fd4 -p 4000 -M "55534243a069008d8000000080000606f50402527100000000000000000000"
Look for default devices ...
Found devices in default mode (1)
Access device 004 on bus 001
Get the current device configuration ...
Current configuration number is 1
Use interface number 0
with class 8
Use endpoints 0x01 (out) and 0x81 (in)
Looking for active drivers ...
OK, driver detached
Set up interface 0
Use endpoint 0x01 for message sending ...
Trying to send message 1 to endpoint 0x01 ...
OK, message successfully sent
Read the response to message 1 (CSW) ...
Response successfully read (13 bytes), status 0
Reset response endpoint 0x81
Reset message endpoint 0x01
Device is gone, skip any further commands
-> Run lsusb to note any changes. Bye!
usb-devices
Code: Select all
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 5 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=2fd4 ProdID=4004 Rev=03.18
S: Manufacturer=USB Modem
S: Product=USB Modem
C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 4 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
I: If#= 5 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Modemmanger works well with it. (Telekom, Vodafone, Telefonica - all with IPv6)
-
Misa9x
- Posts: 1
- Joined: 27 Nov 2023, 06:21
Post
by Misa9x » 27 Nov 2023, 06:23
Thank you for providing this information about the XSStick
W1209 4G System. It would be useful to know that the device can be switched to modem mode using the usb_modeswitch
incredibox tool. The HTTP web interface at 192.168.123.254 can be used to manage the device's settings or to access other features.