Differences

This shows you the differences between two versions of the page.

--- web-u2 [2019/09/09 13:48] – [WITRN U2 104083] kingkevin
+++ web-u2 [2019/09/09 18:18] – [USB HID] kingkevin
@@ Line 135: / Line 135: @@
 ===== Software =====
-===== Support =====
+{{  :u2:software-screenshot.png?400|}}
+Here a couple of notes about the [[http://www.witrn.com/witrn/u2/WITRN_Software.zip|PC software]] (for Windows).
+The software is in Chinese, but you can change it by translating the words in the ''lang.ini'' file.
+Here the {{ :u2:lang.ini.zip |english lang.ini}} (works for versions 4.0, 4.1, 4.4).
+When started, the software will query [[http://www.witrn.com/updata/U2_NewVersion.pdf]] to get the latest version information.
+This is not a pdf. I think this is just to pass firewall (just like they use HTTP without SSL).\\
+This URL will return a short binary string, for example ''0x44 0x67 0x25 0x11 0x12 0x12 0x13 0x21'':
+  * ''0x44'': Software version 4.4
+  * ''0x67'': U2 Firmware version 6.7
+  * ''0x25'': X Firmware version 2.5
+  * ''0x11'': C3 Firmware version 1.1
+  * ''0x12'': C1 Firmware version 1.2
+  * ''0x12'': C0 Firmware version 1.2
+  * ''0x13'': C0s Firmware version 1.3
+  * ''0x21'': A0  Firmware version 2.1
+If will also query [[http://www.witrn.com/updata/U2_ad.pdf]], which is again not a pdf, but the text to display on the left side.\\
+Using the Network upgrade it will also download the Firmware for the U2 at [[http://www.witrn.com/updata/U2_FW_NEW.pdf]] and U2p at [[http://www.witrn.com/updata/U2_4KEYS_FW_NEW.pdf]] (raw binaries)
 ===== Communication =====
@@ Line 141: / Line 161: @@
 ==== USB HID ====
+When connected to USB, it appears as an {{ :u2:usb_hid.txt |HID}} (Human Interface Device).\\
+When powered while pressing on the OK button, it will boot in the DFU (Device Firmware Upgrade) mode, which allows flashing the firmware.
+But it is still an {{ :u2:usb_dfu.txt |HID}}, and does not use the DFU profile specified by USB.
+I've partially reversed the HID communication:
+  * the messages exchanged are 64 bytes long
+  * the host (e.g. software) starts by sending a message. Here an example of message sent (captured from the software):
+<code>
+"\xff\x55\x58\x8a\x13\x79\x06\x57\x1a\x01\x0a\x02\x00\x00\x00\x00" \
+"\x5e\x00\x00\x00\xff\x55\x2f\xb2\x8b\xdc\x5a\xd4\x1a\x2c\xa4\x00" \
+"\xa4\x40\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x74\x21\x4f\x40\x75" \
+"\x23\x19\x40\x75\xcc\x01\x01\x00\x02\x04\x00\x00\x5e\x00\xe7\x06";
+</code>
+  * this will cause the device (e.g. U2) to send measurements. Since it will only send a couple of messages, keep sending the message every couple of milliseconds (can be the same). Here an example measurement reply:
+<code>
+ff 55 13 b4 7f bf 50 ef 1a 2c d7 63 a0 40 0e 74 da 39 0e 74 da 39 0e 74 da 39 bb dd 08 3b 33 33 53 40 74 a8 6d 3c fe 98 f7 41 d2 34 91 c2 14 ae a0 40 0e 74 da 39 00 00 00 00 00 00 00 00 16 ae
+</code>
+here how to decode the measurements:
+^ index ^ byte(s) ^ format ^ meaning ^
+| 0-1 | ''ff 55'' | constant | probably a fixed header |
+| 2 | ''13'' | integer | number of second |
+| 3 | ''b4'' | integer | super fast incrementing number (but not related to other bytes) |
+| 4 | ''7f'' | integer | fast incrementing number (but not related to other bytes) |
+| 5 | ''bf'' | integer | incrementing number (but not related to other bytes) |
+| 6 | ''50'' | integer | 1/100th of byte 5 |
+| 7 | ''ef'' | integer | slow incrementing number (but not related to other bytes) |
+| 8-9 | ''1a 2c'' | constant | separates timing form measurement values |
+| 10-13 | ''d7 63 a0 40'' | float | VBUS voltage, in V (e.g. 5.0122 V) |
+| 14-17 | ''0e 74 da 39'' | float | VBUS current, in A (e.g. 0.0004 A) |
+| 18-21 | ''0e 74 da 39'' | float | VBUS current, in A (seems the same as previous current) |
+| 22-25 | ''0e 74 da 39'' | float | VBUS current, in A (sometimes slightly different for the other values, but I don't know why) |
+| 26-29 | ''bb dd 08 3b'' | float | VBUS power, in W (e.g. 0.0021 W ) |
+| 30-33 | ''33 33 53 40'' | float | D+ voltage, in V (e.g. 3.3000 V) |
+| 34-37 | ''74 a8 6d 3c'' | float | D- voltage, in V (e.g. 0.0145 V) |
+| 38-41 | ''fe 98 f7 41'' | float | In temperature (internal), in °C (e.g. 30.95 °C) |
+| 42-45 | ''d2 34 91 c2'' | float | Ex temperature (external, from IN Micro-USB probe), in °C (e.g. -72.60 °C, because not connected) |
+| 46-49 | ''14 ae a0 40'' | float | VBUS voltage (differs from first value, but I don't know how), in V (e.g. 5.0212 V) |
+| 50-53 | ''0e 74 da 39'' | float | VBUS current (sometimes slightly different for the other values, but I don't know why), in A (e.g. 0.0004 A) |
+| 54-61 | ''00 00 00 00 00 00 00 00'' | constant | seems always 0 |
+| 62 | ''16'' | integer | checksum (addition of bytes 8-61) |
+| 63 | ''ae'' | integer | checksum (addition of bytes 0-61) |
+There are other messages to get the device's serial number and firmware version, but I did not reverse those.
 ==== Bluetooth Serial ====