Help, can't connect to PM3 after upgrade to the latest code from icema

lasersword · 2017-10-06 08:34:10

Hi @iceman

I just leave this forum for a while and I used the last Dec code from your github for a year, but yesterday I upgrade to your latest code I find I can't connect to PM3 any more, I am using windows 10 home edition, the system prompts unknown usb device(can't assign device descriptor) when I plug in the usb cable, I tried kinds of way but not help. however, I burn to the old code base with JLink, it works fine.So I don't think it is due to any broken of my device but just wondering if you changed anything for the UART driver part? I searched for the post in this forum but cannot find solution(e.g any new drivers, any new configurations), can you show some hint for this problem? thanks a lot!

iceman · 2017-10-06 10:17:28

Sorry to say, but yes, iceman fork is quite unstable at the moment regarding USB/UART communication. I have fiddled around a bit.

I would think that if you go back 3 weeks for the common/usb_cdc.c (.h) files you will get a more stable version.
It could also be uart/uart_win32.c which is modified.

The rest should be fine.

iceman · 2017-10-13 11:01:45

The latest source is stable in one sense.

Lets start from the beginning.
The problem: Proxmark3 on windows needs a signed driver.
This has lead us to use "unsigned drivers" which is a more complicated way than what I think it should be.

The solution:
A) get a signed driver. costs a bit of money, like 4000$
B) Hidden MS OS feature descriptors (WCID) to install device as CDC ACM device based on microsofts own usbserial.inf

This last year I've been trying to use solution B, Microsoft OS feature descriptors or WCID, to make the proxmark device hook up to your computer. After endless amounts of flashing via JTAG, sniffing usb-traffic, and registry searches, not to mention hours searching reading on internet for information, I've now gotten the device source code to properly be identified as a USB device without drivers installed. Yeah. But before celebrations, there still exists two problems.

1) No assigned com port. WUT?
2) bootrom, flash-mode, doesn't follow usb timings,

No comport, well, as it is now, the device gets recognised as a WINUSB device. Which in turn doesn't expose a comport. However the feature descriptors says it should be able to override and make the device identifed as a usbserial.. This still a problem..

bootrom, flashmode, we have all seen it, the device seems not to be complying with usb specs, which it should. I'm looking at the initial usb communication when entering flashmode. Yeah, low-level sniffing is fun!

iceman · 2017-10-13 11:12:44

Running XUSB, shows a fully configure Feature descriptor usage

-->xusb -i 9ac4:4b8f
Using libusb v1.0.21.11156

Opening device 9AC4:4B8F...
libusb: error [init_device] device '\\.\USB#VID_046D&PID_C517&MI_01#8&178903F1&0&0001' is no longer connected!

Device properties:
        bus number: 1
         port path: 1->2 (from root hub)
             speed: 12 Mbit/s (USB FullSpeed)

Reading device descriptor:
            length: 18
      device class: 2
               S/N: 3
           VID:PID: 9AC4:4B8F
         bcdDevice: 0001
   iMan:iProd:iSer: 1:2:3
          nb confs: 1

Reading BOS descriptor: libusb: error [libusb_get_bos_descriptor] short BOS read 4/5
no descriptor

Reading first configuration descriptor:
             nb interfaces: 2
              interface[0]: id = 0
interface[0].altsetting[0]: num endpoints = 1
   Class.SubClass.Protocol: 02.02.01
       endpoint[0].address: 83
           max packet size: 0008
          polling interval: 02
              interface[1]: id = 1
interface[1].altsetting[0]: num endpoints = 2
   Class.SubClass.Protocol: 0A.00.00
       endpoint[0].address: 01
           max packet size: 0040
          polling interval: 00
       endpoint[1].address: 82
           max packet size: 0040
          polling interval: 00

Claiming interface 0...

Claiming interface 1...

Reading string descriptors:
   String (0x01): "proxmark.org"
   String (0x02): "PM3 Device"
   String (0x03): "88888888"
   String (0xEE): "MSFT100"

Reading Extended Compat ID OS Feature Descriptor (wIndex = 0x0004):

  00000000  28 00 00 00 00 01 04 00 01 00 00 00 00 00 00 00  (...............
  00000010  00 01 57 49 4e 55 53 42 00 00 00 00 00 00 00 00  ..WINUSB........
  00000020  00 00 00 00 00 00 00 00                          ........

Reading Extended Properties OS Feature Descriptor (wIndex = 0x0005):

  00000000  34 01 00 00 00 01 05 00 03 00 84 00 00 00 01 00  4...............
  00000010  00 00 28 00 44 00 65 00 76 00 69 00 63 00 65 00  ..(.D.e.v.i.c.e.
  00000020  49 00 6e 00 74 00 65 00 72 00 66 00 61 00 63 00  I.n.t.e.r.f.a.c.
  00000030  65 00 47 00 55 00 49 00 44 00 00 00 4e 00 00 00  e.G.U.I.D...N...
  00000040  7b 00 34 00 44 00 33 00 36 00 45 00 39 00 37 00  {.4.D.3.6.E.9.7.
  00000050  38 00 2d 00 45 00 33 00 32 00 35 00 2d 00 31 00  8.-.E.3.2.5.-.1.
  00000060  31 00 43 00 45 00 2d 00 42 00 46 00 43 00 31 00  1.C.E.-.B.F.C.1.
  00000070  2d 00 30 00 38 00 30 00 30 00 32 00 42 00 45 00  -.0.8.0.0.2.B.E.
  00000080  31 00 30 00 33 00 31 00 38 00 7d 00 00 00 40 00  1.0.3.1.8.}...@.
  00000090  00 00 01 00 00 00 0c 00 4c 00 61 00 62 00 65 00  ........L.a.b.e.
  000000a0  6c 00 00 00 26 00 00 00 41 00 77 00 65 00 73 00  l...&...A.w.e.s.
  000000b0  6f 00 6d 00 65 00 20 00 50 00 4d 00 33 00 20 00  o.m.e. .P.M.3. .
  000000c0  44 00 65 00 76 00 69 00 63 00 65 00 00 00 66 00  D.e.v.i.c.e...f.
  000000d0  00 00 02 00 00 00 0c 00 49 00 63 00 6f 00 6e 00  ........I.c.o.n.
  000000e0  73 00 00 00 4c 00 00 00 25 00 53 00 79 00 73 00  s...L...%.S.y.s.
  000000f0  74 00 65 00 6d 00 52 00 6f 00 6f 00 74 00 25 00  t.e.m.R.o.o.t.%.

Releasing interface 0...
Releasing interface 1...
Closing device...

lasersword · 2017-10-14 07:16:54

I have pull the 'a4b4a1a..77103e7' tag but still encounter the same problem. however, the interesting thing is I found if I erase the chip and only flash the bootrom image into PM3, 1 or 2 time of 3 plug in device , it could be recognized by the system and present a com port and fail one or more but it has some probability. however, if I flash the fullimage into it the device will lost com port conn . in another hand, if I flash the fullimage by JTAG, it will be dead on usb mount and not show up on comport as well

iceman · 2017-10-14 07:46:26

For a short moment yesterday, I got the device to be recognised as a com port (like it should) but it was faulty.
However since then I haven't managed to get to this stage anymore. *bummer*

To conclude:
The hidden MS feature descriptors, works. Three telltale signs of success.

got a (0xEE): "MSFT100"
got a Extended Compat ID OS Feature Descriptor (wIndex = 0x0004)
got a Extended Properties OS Feature Descriptor (wIndex = 0x0005)

You need to uninstall device in devicemanager after flashing it, in order for windows to re-enumerate it with all these new stuff.

...converting this WINUSB -> CDC ACM automatically, signs needed:
In the registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\VID_9AC4&PID_4B8F\88888888\

DeviceInterfaceGUID REG_SZ {4d36e978-e325-11ce-bfc1-08002be10318}
Label REG_SZ Awesome PM3 Device
Icons REG_EXPAND_SZ %SystemRoot%\system32\Shell32.dll,-13

The secret is number 1 in the above list. That GUID is the device GUID for Ports (LP & COM).

So problem now lays in configurationDescriptor which doesn't get identified as a proper CDC ACM device (look at previous post xusb output)...

Almost there.

lasersword · 2017-10-14 15:44:48

Looks so great, as you said, almost there....just one more small step:P

iceman wrote:

For a short moment yesterday, I got the device to be recognised as a com port (like it should) but it was faulty.
However since then I haven't managed to get to this stage anymore. *bummer*
To conclude:
The hidden MS feature descriptors, works. Three telltale signs of success.
got a (0xEE): "MSFT100"
got a Extended Compat ID OS Feature Descriptor (wIndex = 0x0004)
got a Extended Properties OS Feature Descriptor (wIndex = 0x0005)
You need to uninstall device in devicemanager after flashing it, in order for windows to re-enumerate it with all these new stuff.
...converting this WINUSB -> CDC ACM automatically, signs needed:
In the registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\VID_9AC4&PID_4B8F\88888888\
DeviceInterfaceGUID REG_SZ {4d36e978-e325-11ce-bfc1-08002be10318}
Label REG_SZ Awesome PM3 Device
Icons REG_EXPAND_SZ %SystemRoot%\system32\Shell32.dll,-13
The secret is number 1 in the above list. That GUID is the device GUID for Ports (LP & COM).
So problem now lays in configurationDescriptor which doesn't get identified as a proper CDC ACM device (look at previous post xusb output)...
Almost there.

iceman · 2017-10-15 02:33:17

interesting, I didn't think about it, but maybe my bootrom code is too big...
Something I have to look into,

zhuminggang · 2017-10-20 10:01:31

I test it,I have two laptops: one is thinkpad p50 usb3.0,one is thinkpad x220t usb2.0,
test iceman firmware:
20170928-2d283c42a668a350fb6e5d4ccbab39690618e454
20170929-41a2553b04f7f56fdefcbcbe408a3bc67e3fa45d
20171003-a4b4a1a9a2c0df76c7d2207529fc79f4bc3e5adf
20171005-feea1a45d9996b59448a43e2c79c98364083fb7b
20171010-f788ef51d1cc70ffc83839e617b65350cce7511e
20171013-77103e71cfdb5e42e0bfa5f99b1186d708b2b05a
I use j-link to flash it.
on x220t usb 2.0 both firmware is ok,laptop sometime can't find the pm3 com port,
plug several times laptop can find the pm3 com port.
on p50 usb 3.0 only 20170928-2d283c42a668a350fb6e5d4ccbab39690618e454 is ok,
other firmware laptop can not find the pm3 com port!
my laptop os is windows 10.
It is very funny!

Last edited by zhuminggang (2017-10-20 10:31:00)

iceman · 2017-10-20 10:33:34

yes,
iceman fork is unstable at the moment. I'll revert back some bootrom changes to match pm3 offical to make it stable again soon.

Until then I recommend using pm3 offical.

iceman · 2017-10-23 22:12:36

And now it should be ok again. Sorry for the inconvenience.

Proxmark3 community

Announcement

#1 2017-10-06 08:34:10

Help, can't connect to PM3 after upgrade to the latest code from icema

#2 2017-10-06 10:17:28

Re: Help, can't connect to PM3 after upgrade to the latest code from icema

#3 2017-10-13 11:01:45

Re: Help, can't connect to PM3 after upgrade to the latest code from icema

#4 2017-10-13 11:12:44

Re: Help, can't connect to PM3 after upgrade to the latest code from icema

#5 2017-10-14 07:16:54

Re: Help, can't connect to PM3 after upgrade to the latest code from icema

#6 2017-10-14 07:46:26

Re: Help, can't connect to PM3 after upgrade to the latest code from icema

#7 2017-10-14 15:44:48

Re: Help, can't connect to PM3 after upgrade to the latest code from icema

#8 2017-10-15 02:33:17

Re: Help, can't connect to PM3 after upgrade to the latest code from icema

#9 2017-10-20 10:01:31

Re: Help, can't connect to PM3 after upgrade to the latest code from icema

#10 2017-10-20 10:33:34

Re: Help, can't connect to PM3 after upgrade to the latest code from icema

#11 2017-10-23 22:12:36

Re: Help, can't connect to PM3 after upgrade to the latest code from icema

Board footer