Activation Codes and Methods, Hardware Details, Sniffing
Post Reply
MooSE
Posts: 2
Joined: 07 Apr 2019, 17:09

New Device 05c6:1000 DS Telecom DSU7

Post by MooSE » 07 Apr 2019, 17:45

Hi!

I have a modem from brand "DS Telecom", model "DSU7".


lsusb:

Code: Select all

Bus 002 Device 017: ID 05c6:1000 Qualcomm, Inc. Mass Storage Device

dmesg:

Code: Select all

[Сб апр  6 22:40:32 2019] usb 2-1: new high-speed USB device number 17 using xhci_hcd
[Сб апр  6 22:40:33 2019] usb 2-1: New USB device found, idVendor=05c6, idProduct=1000
[Сб апр  6 22:40:33 2019] usb 2-1: New USB device strings: Mfr=3, Product=2, SerialNumber=4
[Сб апр  6 22:40:33 2019] usb 2-1: Product: Qualcomm CDMA Technologies MSM
[Сб апр  6 22:40:33 2019] usb 2-1: Manufacturer: Qualcomm, Incorporated
[Сб апр  6 22:40:33 2019] usb 2-1: SerialNumber: 351602000025260
Solution for switch:

Code: Select all

usb_modeswitch -v 0x05c6 -p 0x1000 -V 0x05c6 -P 0x6000 -K -M 5553424312345678000000000000061b000000020000000000000000000000
Please add this to usb-modeswitch-data.

Josh
Site Admin
Posts: 6570
Joined: 03 Nov 2007, 00:30

Re: New Device 05c6:1000 DS Telecom DSU7

Post by Josh » 30 Sep 2019, 18:10

Thanks!

What is the USB ID after the mode switch?

LOM
Posts: 1404
Joined: 11 Jul 2012, 15:14
Location: Koh Samui, TH

Re: New Device 05c6:1000 DS Telecom DSU7

Post by LOM » 22 Oct 2019, 08:41

I don't think we can have generic support for this usb id, it will interfere with the entries for the same id which we already have with attribute filtering.
There has also been problem in the past for mobile phones using this id.

We need to see a verbose lsusb listing for this modem before it has switched.

sudo lsusb -v -d 05c6:1000

and paste the result here.

alexx
Posts: 2
Joined: 17 Dec 2019, 18:15

Re: New Device 05c6:1000 DS Telecom DSU7

Post by alexx » 17 Dec 2019, 18:18

USB ID after mode switch is 12d1:1001

Here is info about the device just after it has been inserted (detected as Mass Storage):

Code: Select all

$ sudo lsusb -v -d 05c6:1000

Bus 001 Device 027: ID 05c6:1000 Qualcomm, Inc. Mass Storage Device
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x05c6 Qualcomm, Inc.
  idProduct          0x1000 Mass Storage Device
  bcdDevice            0.00
  iManufacturer           3 USBModem
  iProduct                2 HSPA Data Card
  iSerial                 4 1234567890ABCDEF
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength       0x0020
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          1 Qualcomm Configuration
    bmAttributes         0xc0
      Self Powered
    MaxPower              500mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk-Only
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  bNumConfigurations      1
can't get debug descriptor: Resource temporarily unavailable
Device Status:     0x0000
  (Bus Powered)
And here is what happens after usb_modeswitch switches it (with MessageContent="5553424312345678000000000000061b000000020000000000000000000000"):

Code: Select all

$ sudo lsusb -v -d 12d1:1001

Bus 001 Device 026: ID 12d1:1001 Huawei Technologies Co., Ltd. E161/E169/E620/E800 HSDPA Modem
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x12d1 Huawei Technologies Co., Ltd.
  idProduct          0x1001 E161/E169/E620/E800 HSDPA Modem
  bcdDevice            0.00
  iManufacturer           3 USBModem
  iProduct                2 HSPA Data Card
  iSerial                 4 1234567890ABCDEF
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength       0x0083
    bNumInterfaces          5
    bConfigurationValue     1
    iConfiguration          1 Qualcomm Configuration
    bmAttributes         0xe0
      Self Powered
      Remote Wakeup
    MaxPower              500mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           3
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               5
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        2
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x84  EP 4 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x03  EP 3 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        3
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x85  EP 5 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x04  EP 4 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval              32
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        4
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk-Only
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x05  EP 5 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x86  EP 6 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  bNumConfigurations      1
can't get debug descriptor: Resource temporarily unavailable
Device Status:     0x0002
  (Bus Powered)
  Remote Wakeup Enabled

LOM
Posts: 1404
Joined: 11 Jul 2012, 15:14
Location: Koh Samui, TH

Re: New Device 05c6:1000 DS Telecom DSU7

Post by LOM » 18 Dec 2019, 03:59

alexx wrote:USB ID after mode switch is 12d1:1001
Is that really for a DS Telecom DSU7 for which user MooSE started this thread?

alexx
Posts: 2
Joined: 17 Dec 2019, 18:15

Re: New Device 05c6:1000 DS Telecom DSU7

Post by alexx » 19 Dec 2019, 16:20

Well, it's a good question. I guess that mine is a clone.

My modem looks a bit different from MooSE's. Initial USB IDs are the same, and MooSE's MessageContent="5553424312345678000000000000061b000000020000000000000000000000" for usb_modeswitch works for me.

My modem looks like this one: https://www.aliexpress.com/item/33037734160.html
MooSE's modem looks like this: https://www.ylsoftware.com/news/737

I think they are the same inside.

LOM
Posts: 1404
Joined: 11 Jul 2012, 15:14
Location: Koh Samui, TH

Re: New Device 05c6:1000 DS Telecom DSU7

Post by LOM » 21 Dec 2019, 08:38

alexx wrote:Well, it's a good question. I guess that mine is a clone.

My modem looks a bit different from MooSE's. Initial USB IDs are the same, and MooSE's
That initial id has been used for lots of modems which doesn't have much in similarity with each other..
It is a bootloader id for smartphones containing Qualcomm chip and it is a bootloader id (initial id) for Qualcomm based modems, the corresponding firmware id (switched id) is 05c6:6000 like MooSe's.
05c6:1000/05c6:6000 is what Qualcomm delivers its modules with before being sold to someone making a product out of the module by applying their plastic casing and sticker with modem model name/number.
Those usb id's are "transport id's" and should be replaced with unique id's owned by manufacture of the finished product but there are loads of Chinese companies selling the modems without doing that, hence we have 10-12 years old modems as well as modern LTE modems with just those two id's..
alexx wrote: MessageContent="5553424312345678000000000000061b000000020000000000000000000000" for usb_modeswitch works for me.
It is the most common message for switching 05c6:1000 but knowing that doesn't help much, there are other switch messages for 05c6:1000 so usb_modeswitch has to distinguish between the different 05c6:1000 and does so by checking for usb attributes like manufacturer and product.
Yours can probably be added by checking if iManufacturer = USBModem but MooSE's modem might not be helped by that.
There was a reason for me asking him to show a verbose lsusb listing of 05c6:1000..

alexx wrote: My modem looks like this one: https://www.aliexpress.com/item/33037734160.html
MooSE's modem looks like this: https://www.ylsoftware.com/news/737

I think they are the same inside.
Inside doesn't count, and think doesn't count, it is what the bootloader presents in usb attributes that decides how it should be switched.
Yours has btw been programmed to have a Huawei switched id without being a Huawei product, most likely done because there are no Windows or linux drivers for 05c6:6000..

MooSE
Posts: 2
Joined: 07 Apr 2019, 17:09

Re: New Device 05c6:1000 DS Telecom DSU7

Post by MooSE » 01 Feb 2020, 18:48

Josh wrote: 30 Sep 2019, 18:10 Thanks!

What is the USB ID after the mode switch?
After switch its detected as:

Code: Select all

Bus 002 Device 026: ID 05c6:6000 Qualcomm, Inc. Siemens SG75

LOM
Posts: 1404
Joined: 11 Jul 2012, 15:14
Location: Koh Samui, TH

Re: New Device 05c6:1000 DS Telecom DSU7

Post by LOM » 03 Feb 2020, 08:01

LOM wrote: 22 Oct 2019, 08:41
We need to see a verbose lsusb listing for this modem before it has switched.

sudo lsusb -v -d 05c6:1000

and paste the result here.

Post Reply