BastilleResearch / mousejack

MouseJack device discovery and research tools
GNU General Public License v3.0
1.28k stars 254 forks source link

Unifying Dongle: Marking firmware complete takes 24 Seconds, doesn't boot into firmware mode #42

Open mkay100 opened 5 years ago

mkay100 commented 5 years ago

First of all: Thank you for the amazing work.

When flashing my unifying dongle (all preparations ahead no errors) i get the following results: 2019-05-07 07:52:11.419] Mark firmware update as completed Traceback (most recent call last): File "./prog/usb-flasher/logitech-usb-flash.py", line 61, in response = dongle.send_command(0x21, 0x09, 0x0200, 0x0000, "\x20\x00\x00\x01\x02" + "\x00"*27) File "/root/nrf/nrf-research-firmware/prog/usb-flasher/unifying.py", line 180, in send_command response = self.dongle.read(ep, 32, timeout=timeout) File "/usr/local/lib/python2.7/dist-packages/usb/core.py", line 988, in read self.get_timeout(timeout)) File "/usr/local/lib/python2.7/dist-packages/usb/backend/libusb1.py", line 851, in intr_read timeout) File "/usr/local/lib/python2.7/dist-packages/usb/backend/libusb1.py", line 936, in read _check(retval) File "/usr/local/lib/python2.7/dist-packages/usb/backend/libusb1.py", line 595, in _check raise USBError(_strerror(ret), ret, _libusb_errno[ret]) usb.core.USBError: [Errno 110] Operation timed out Makefile:33: recipe for target 'logitech_install' failed make: *** [logitech_install] Error 1

When i alter the usb_timeout in unifying.py from 2500 to 32500 it seems to work:

[2019-05-07 07:54:46.032] Mark firmware update as completed [2019-05-07 07:55:09.883] 24:00:00:00:00:6B:32:FF:FF:FF:FF:FF:FF:FF:32:FF:FF:FF:FF:FF:FF:6F:B7:FF:41:A0:B4:15:FB:7E:79:B3 [2019-05-07 07:55:09.884] Restarting dongle into research firmware mode [2019-05-07 07:55:09.886] 70:00:00:00:00:6B:32:FF:FF:FF:FF:FF:FF:FF:32:FF:FF:FF:FF:FF:FF:6F:B7:FF:41:A0:B4:15:FB:7E:79:B3

But the device still shows up as: Bus 001 Device 024: ID 046d:aaaa Logitech, Inc.

Any advice would be appreciated.

mkay100 commented 5 years ago

Additional info on the Device:

Unifying [bootloader-nordic] DeviceId: 8f98944e4c0d22c8a5b5b250eda4d3f037fc6fa7 Guid: 9d131a0c-a606-580f-8eda-80587250b8d6 Summary: A miniaturised USB wireless receiver (bootloader) Plugin: unifying Flags: updatable|supported|registered|is-bootloader Vendor: Logitech VendorId: USB:0x046D Version: RQR00.00_B0000 VersionBootloader: BOT01.04_B0016 Icon: preferences-desktop-keyboard Created: 2019-05-07

4dvn commented 5 years ago

I sovled this error by this step: Cd nrf (renamed folder after git clone from git) Cd prog Cd usb-flasher (You need to copy 4 files compiled from bin folder to this folder) Python logitech-usb-flash.py dongle_formated.bin dongle_formated.ihx ==> done Just retype lsusb to see the @result:

4dvn commented 5 years ago

98D2E12E-5D7E-4B9C-BAE4-D7F79253DC9B

mame82 commented 5 years ago

The last operation in Marc's USB flasher writes a single byte to flash address 0×0000.

This write triggers the CRC check for the whole firmware blob, and thus takes some seconds.

On dongles with latest bootloader, this additionally would trigger a signature check. The signature check would take longer and fail in any case, as the firmware just has no valid 256byte signature (which has to be send to the receiver with additional commands). Trying to flash a Nordic dongle which has a signed Bootloader, would wipe the firmware, although flashing fails. In such a case the dongle would be stuck in bootloader mode.

For Nordic dongles, signed bootloader start with version >=BOT01.04

So make sure you have <=BOT01.03 before trying to flash

ltsalvatore commented 5 years ago

damn.. where is my post from a couple of days ago?