Skip to content

Home

Jump to bottom
Graham edited this page Mar 12, 2017 · 22 revisions

My stupid plan:

  • Windows 2000(!) VM + M-Crew
    • success! even though none of the installers seemed to work.
  • usb sniffing
  • some fiddling with pyUSB (because why not)
    • success! we have limited device control.
  • mapping functions, etc.
  • ...
  • profit? (lawyers: I'm joking)

There is bound to be a more intelligent way to do most of this stuff but I'm just stumbling around for fun.

PyUSB

The tutorial boilerplate seems to work...

DEVICE ID 054c:0034 on Bus 020 Address 012 =================
 bLength                :   0x12 (18 bytes)
 bDescriptorType        :    0x1 Device
 bcdUSB                 :  0x110 USB 1.1
 bDeviceClass           :   0xff Vendor-specific
 bDeviceSubClass        :    0x0
 bDeviceProtocol        :    0x0
 bMaxPacketSize0        :   0x40 (64 bytes)
 idVendor               : 0x054c
 idProduct              : 0x0034
 bcdDevice              :  0x100 Device 1.0
 iManufacturer          :    0x1 xxxx
 iProduct               :    0x2 PCLK-MN10
 iSerialNumber          :    0x0 
 bNumConfigurations     :    0x1
  CONFIGURATION 1: 100 mA ==================================
   bLength              :    0x9 (9 bytes)
   bDescriptorType      :    0x2 Configuration
   wTotalLength         :   0x20 (32 bytes)
   bNumInterfaces       :    0x1
   bConfigurationValue  :    0x1
   iConfiguration       :    0x2 PCLK-MN10
   bmAttributes         :   0x80 Bus Powered
   bMaxPower            :   0x32 (100 mA)
    INTERFACE 0: Reserved ==================================
     bLength            :    0x9 (9 bytes)
     bDescriptorType    :    0x4 Interface
     bInterfaceNumber   :    0x0
     bAlternateSetting  :    0x0
     bNumEndpoints      :    0x2
     bInterfaceClass    :    0x0 Reserved
     bInterfaceSubClass :    0x0
     bInterfaceProtocol :    0x0
     iInterface         :    0x0 
      ENDPOINT 0x1: Bulk OUT ===============================
       bLength          :    0x7 (7 bytes)
       bDescriptorType  :    0x5 Endpoint
       bEndpointAddress :    0x1 OUT
       bmAttributes     :    0x2 Bulk
       wMaxPacketSize   :   0x40 (64 bytes)
       bInterval        :    0x0
      ENDPOINT 0x82: Bulk IN ===============================
       bLength          :    0x7 (7 bytes)
       bDescriptorType  :    0x5 Endpoint
       bEndpointAddress :   0x82 IN
       bmAttributes     :    0x2 Bulk
       wMaxPacketSize   :   0x40 (64 bytes)
       bInterval        :    0x0

now what?

Some random commands that I sniffed seem to work when replayed:

write(0x00,0x60,0x00), read()

turns it on!

write([0x04,0x00,0x60,0xc0,0x2f]), read()
write([0x04,0x00,0x60,0x90,0x26]), read()
write([0x04,0x00,0x60,0xb0,0x26]), read()

(no more, no less) turns it off... is it mere coincidence that ASCII 0x4F, 0x46, 0x46 would read 'OFF'?

reading data

Output data from repeated read() seems at times almost completely random (though the first int clearly contains the message length) but it does have something to do with the state of the hifi device behind the link; the message length increases significantly I fiddle with the controls. I captured some output but lost the full log.

...

Lots more to discover. I can't get it to do anything else yet (source switching would be a good next win), but I've barely tried.

Clone this wiki locally