Activation Codes and Methods, Hardware Details, Sniffing
Post Reply
strubbi77
Posts: 1
Joined: 21 Sep 2022, 08:50

USB-TSE from Epson

Post by strubbi77 » 21 Sep 2022, 09:23

I don't know if usb_modeswitch is the right way to communicate with my usb-stick because it's not a modem.
Basically it is a device which is identified as

bInterfaceClass : 0x8 Mass Storage

Changing the configuration so it's possible to write/read to the sticks interface didn't work straight forward.
I asked on stackoverflow and one idea was to use usb_modeswitch.

Code: Select all

DEVICE ID 04b8:0638 on Bus 001 Address 007 =================
 bLength                :   0x12 (18 bytes)
 bDescriptorType        :    0x1 Device
 bcdUSB                 :  0x200 USB 2.0
 bDeviceClass           :    0x0 Specified at interface
 bDeviceSubClass        :    0x0
 bDeviceProtocol        :    0x0
 bMaxPacketSize0        :   0x40 (64 bytes)
 idVendor               : 0x04b8
 idProduct              : 0x0638
 bcdDevice              :  0x100 Device 1.0
 iManufacturer          :    0x2 EPSON
 iProduct               :    0x3 TSE USB stick
 iSerialNumber          :    0x1 60202253FD0000FD
 bNumConfigurations     :    0x1
  CONFIGURATION 1: 100 mA ==================================
   bLength              :    0x9 (9 bytes)
   bDescriptorType      :    0x2 Configuration
   wTotalLength         :   0x20 (32 bytes)
   bNumInterfaces       :    0x1
   bConfigurationValue  :    0x1
   iConfiguration       :    0x0 
   bmAttributes         :   0x80 Bus Powered
   bMaxPower            :   0x32 (100 mA)
    INTERFACE 0: Mass Storage ==============================
     bLength            :    0x9 (9 bytes)
     bDescriptorType    :    0x4 Interface
     bInterfaceNumber   :    0x0
     bAlternateSetting  :    0x0
     bNumEndpoints      :    0x2
     bInterfaceClass    :    0x8 Mass Storage
     bInterfaceSubClass :    0x6
     bInterfaceProtocol :   0x50
     iInterface         :    0x0 
      ENDPOINT 0x81: Bulk IN ===============================
       bLength          :    0x7 (7 bytes)
       bDescriptorType  :    0x5 Endpoint
       bEndpointAddress :   0x81 IN
       bmAttributes     :    0x2 Bulk
       wMaxPacketSize   :  0x200 (512 bytes)
       bInterval        :    0x0
      ENDPOINT 0x1: Bulk OUT ===============================
       bLength          :    0x7 (7 bytes)
       bDescriptorType  :    0x5 Endpoint
       bEndpointAddress :    0x1 OUT
       bmAttributes     :    0x2 Bulk
       wMaxPacketSize   :  0x200 (512 bytes)
       bInterval        :    0x0
Wireshark:

Code: Select all

14737   2022-09-20 22:16:23,622982  host    1.10.0  USB 36  GET DESCRIPTOR Request DEVICE
14738   2022-09-20 22:16:23,623116  1.10.0  host    USB 46  GET DESCRIPTOR Response DEVICE
14739   2022-09-20 22:16:23,623131  host    1.10.0  USB 36  GET DESCRIPTOR Request CONFIGURATION
14740   2022-09-20 22:16:23,623268  1.10.0  host    USB 37  GET DESCRIPTOR Response CONFIGURATION
14741   2022-09-20 22:16:23,623281  host    1.10.0  USB 36  GET DESCRIPTOR Request CONFIGURATION
14742   2022-09-20 22:16:23,623393  1.10.0  host    USB 60  GET DESCRIPTOR Response CONFIGURATION
14743   2022-09-20 22:16:23,623404  host    1.10.0  USB 36  GET DESCRIPTOR Request STRING
14744   2022-09-20 22:16:23,623517  1.10.0  host    USB 30  GET DESCRIPTOR Response STRING[Malformed Packet]
14745   2022-09-20 22:16:23,623531  host    1.10.0  USB 36  GET DESCRIPTOR Request STRING
14746   2022-09-20 22:16:23,623624  1.10.0  host    USB 32  GET DESCRIPTOR Response STRING
14747   2022-09-20 22:16:23,623641  host    1.10.0  USB 36  GET DESCRIPTOR Request STRING
14748   2022-09-20 22:16:23,623753  1.10.0  host    USB 30  GET DESCRIPTOR Response STRING
14749   2022-09-20 22:16:23,623766  host    1.10.0  USB 36  GET DESCRIPTOR Request STRING
14750   2022-09-20 22:16:23,623879  1.10.0  host    USB 62  GET DESCRIPTOR Response STRING
14751   2022-09-20 22:16:23,624909  host    1.10.0  USB 36  SET CONFIGURATION Request
14752   2022-09-20 22:16:23,625292  1.10.0  host    USB 28  SET CONFIGURATION Response
14753   2022-09-20 22:16:23,625303  host    1.10.0  USB 36  SET INTERFACE Request
14754   2022-09-20 22:16:23,625565  1.10.0  host    USB 28  SET INTERFACE Response
14755   2022-09-20 22:16:23,625577  host    1.10.0  USBMS   36  GET MAX LUN Request
14756   2022-09-20 22:16:23,625692  1.10.0  host    USBMS   29  GET MAX LUN Response

14757   2022-09-20 22:16:23,625714  host    1.10.1  USBMS   58  SCSI: Inquiry LUN: 0x00 
14758   2022-09-20 22:16:23,625741  1.10.1  host    USB 27  URB_BULK out
14759   2022-09-20 22:16:23,625742  host    1.10.1  USB 27  URB_BULK in
14760   2022-09-20 22:16:23,656654  1.10.1  host    USBMS   63  SCSI: Data In LUN: 0x00 (Inquiry Response Data) [SCSI transfer limited due to allocation_length too small]
14761   2022-09-20 22:16:23,656669  host    1.10.1  USB 27  URB_BULK in
14762   2022-09-20 22:16:23,656688  1.10.1  host    USBMS   40  SCSI: Response LUN: 0x00 (Inquiry) (Good)
14763   2022-09-20 22:16:23,656715  host    1.10.1  USBMS   58  SCSI: Inquiry LUN: 0x00 
14764   2022-09-20 22:16:23,656757  1.10.1  host    USB 27  URB_BULK out
14765   2022-09-20 22:16:23,656758  host    1.10.1  USB 27  URB_BULK in
Frame 14751 SET CONFIGURATION Request

Code: Select all

Frame 14751: 36 bytes on wire (288 bits), 36 bytes captured (288 bits) on interface \\.\USBPcap1, id 0
    Interface id: 0 (\\.\USBPcap1)
        Interface name: \\.\USBPcap1
        Interface description: USBPcap1
    Encapsulation type: USB packets with USBPcap header (152)
    Arrival Time: Sep 20, 2022 22:16:23.624909000 Mitteleuropäische Sommerzeit
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1663704983.624909000 seconds
    [Time delta from previous captured frame: 0.001030000 seconds]
    [Time delta from previous displayed frame: 0.001030000 seconds]
    [Time since reference or first frame: 53.784593000 seconds]
    Frame Number: 14751
    Frame Length: 36 bytes (288 bits)
    Capture Length: 36 bytes (288 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: usb]
USB URB
    [Source: host]
    [Destination: 1.10.0]
    USBPcap pseudoheader length: 28
    IRP ID: 0xffffc307c9d7a010
    IRP USBD_STATUS: USBD_STATUS_SUCCESS (0x00000000)
    URB Function: URB_FUNCTION_SELECT_CONFIGURATION (0x0000)
    IRP information: 0x00, Direction: FDO -> PDO
        0000 000. = Reserved: 0x00
        .... ...0 = Direction: FDO -> PDO (0x0)
    URB bus id: 1
    Device address: 10
    Endpoint: 0x00, Direction: OUT
        0... .... = Direction: OUT (0)
        .... 0000 = Endpoint number: 0
    URB transfer type: URB_CONTROL (0x02)
    Packet Data Length: 8
    [Response in: 14752]
    Control transfer stage: Setup (0)
Setup Data
    bmRequestType: 0x00
        0... .... = Direction: Host-to-device
        .00. .... = Type: Standard (0x0)
        ...0 0000 = Recipient: Device (0x00)
    bRequest: SET CONFIGURATION (9)
    bConfigurationValue: 1
    wIndex: 0 (0x0000)
    wLength: 0
Frame 14753 Set Interface Request

Code: Select all

Frame 14753: 36 bytes on wire (288 bits), 36 bytes captured (288 bits) on interface \\.\USBPcap1, id 0
    Interface id: 0 (\\.\USBPcap1)
        Interface name: \\.\USBPcap1
        Interface description: USBPcap1
    Encapsulation type: USB packets with USBPcap header (152)
    Arrival Time: Sep 20, 2022 22:16:23.625303000 Mitteleuropäische Sommerzeit
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1663704983.625303000 seconds
    [Time delta from previous captured frame: 0.000011000 seconds]
    [Time delta from previous displayed frame: 0.000011000 seconds]
    [Time since reference or first frame: 53.784987000 seconds]
    Frame Number: 14753
    Frame Length: 36 bytes (288 bits)
    Capture Length: 36 bytes (288 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: usb]
USB URB
    [Source: host]
    [Destination: 1.10.0]
    USBPcap pseudoheader length: 28
    IRP ID: 0xffffc307c9d7a010
    IRP USBD_STATUS: USBD_STATUS_SUCCESS (0x00000000)
    URB Function: URB_FUNCTION_SELECT_INTERFACE (0x0001)
    IRP information: 0x00, Direction: FDO -> PDO
        0000 000. = Reserved: 0x00
        .... ...0 = Direction: FDO -> PDO (0x0)
    URB bus id: 1
    Device address: 10
    Endpoint: 0x00, Direction: OUT
        0... .... = Direction: OUT (0)
        .... 0000 = Endpoint number: 0
    URB transfer type: URB_CONTROL (0x02)
    Packet Data Length: 8
    [Response in: 14754]
    Control transfer stage: Setup (0)
Setup Data
    bmRequestType: 0x00
        0... .... = Direction: Host-to-device
        .00. .... = Type: Standard (0x0)
        ...0 0000 = Recipient: Device (0x00)
    bRequest: SET INTERFACE (11)
    bAlternateSetting: 0
    wInterface: 0
    wLength: 0
Frame 14755 Get Max Lun Request:

Code: Select all

Frame 14755: 36 bytes on wire (288 bits), 36 bytes captured (288 bits) on interface \\.\USBPcap1, id 0
    Interface id: 0 (\\.\USBPcap1)
        Interface name: \\.\USBPcap1
        Interface description: USBPcap1
    Encapsulation type: USB packets with USBPcap header (152)
    Arrival Time: Sep 20, 2022 22:16:23.625577000 Mitteleuropäische Sommerzeit
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1663704983.625577000 seconds
    [Time delta from previous captured frame: 0.000012000 seconds]
    [Time delta from previous displayed frame: 0.000012000 seconds]
    [Time since reference or first frame: 53.785261000 seconds]
    Frame Number: 14755
    Frame Length: 36 bytes (288 bits)
    Capture Length: 36 bytes (288 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: usb:usbms]
USB URB
    [Source: host]
    [Destination: 1.10.0]
    USBPcap pseudoheader length: 28
    IRP ID: 0xffffc307c9d7a010
    IRP USBD_STATUS: USBD_STATUS_SUCCESS (0x00000000)
    URB Function: URB_FUNCTION_CLASS_INTERFACE (0x001b)
    IRP information: 0x00, Direction: FDO -> PDO
        0000 000. = Reserved: 0x00
        .... ...0 = Direction: FDO -> PDO (0x0)
    URB bus id: 1
    Device address: 10
    Endpoint: 0x80, Direction: IN
        1... .... = Direction: IN (1)
        .... 0000 = Endpoint number: 0
    URB transfer type: URB_CONTROL (0x02)
    Packet Data Length: 8
    [Response in: 14756]
    Control transfer stage: Setup (0)
    [bInterfaceClass: Mass Storage (0x08)]
Setup Data
    bmRequestType: 0xa1
        1... .... = Direction: Device-to-host
        .01. .... = Type: Class (0x1)
        ...0 0001 = Recipient: Interface (0x01)
    USB Mass Storage
        bRequest: GET MAX LUN (0xfe)
        wValue: 0x0000
        wIndex: 0
        wLength: 1
I tried to normaly change the configuration. But there is only 1.

Code: Select all

import usb.core
import usb.util

dev=usb.core.find(idVendor=0x04b8, idProduct=0x0638)

if dev.is_kernel_driver_active(0x0):
    try:
        dev.detach_kernel_driver(0x0)
    except usb.core.USBError as e:
        sys.exit("Could not detatch kernel driver from interface({0}): {1}".format(i, str(e)))

dev.set_configuration(9)
Is usb_modeswitch the right way?
Do you need additional information?

Best regards
Thomas

Post Reply