Project

General

Profile

D-Link DWM-222 stick » History » Version 5

domi, 08/15/2018 07:18 PM

1 1 domi
h1. D-Link DWM-222 stick
2
3 5 domi
4
5 1 domi
!{width:300px}dwm222_pic.jpg!
6
7 5 domi
8
9 3 domi
This stick is available at multiple operators and it is quite cheap. If you want to get into Linux-based Qualcomm dongles that are easier to attach to your laptop than Quectel modems (no messing around with mini-PCIe to USB adapters and what not) it might be a way to go.
10 4 domi
11 1 domi
*WARNING!
12
Current version of the DWM-222 does NOT expose ADB, so accessing the underlying Linux is currently not possible! HOWEVER there might be ways to enable this functionality, so keep reading, but BE AWARE BEFORE PUCHASING!*
13
14
It is just a D-Link branded version of cheaper dongles made in China. Some of them are WiFi access points with LTE backhaul using [[QCMAP]].
15
Example of devices that are closely related:
16
* PTCL Charji Wingle R660
17
* (?)D-Link DWR 901 (unsure, FIXME)
18
19
20 5 domi
21
22 1 domi
h2. Hardware
23
24 5 domi
25 1 domi
!{width:500px}pcb_pic.jpg!
26 5 domi
27 1 domi
28
Opening the stick requires just removing the back cover (which reveals the standard size SIM slot and the microSD card reader), then unscrewing the 3 screws.
29
The stick is based on the Qualcomm MDM9225 chipset. It is closely related to the MDM9625 apparently (based on the firmware analysis).
30
There are two antenna connectors (U.FL) exposed on the PCB.
31
32
h2. Software
33
34
The dongle is a typical USB WWAN modem. It requires usb_modeswitch to change from mass_storage mode (enables installation of driver) to modem mode.
35
Mass storage mode USB id: *2001:ab00*
36
WWAN USB id: *2001:7e35*
37
38
After the switch you'll see 4 @ttyUSB@ devices appearing in @/dev@. For me these devices only started to work after telling the @option@ driver about the USB id of the device:
39
<pre>
40
echo "2001 7e35" > /sys/bus/usb-serial/drivers/option1/new_id
41
</pre>
42
43
The devices are:
44
<pre>
45
/dev/ttyUSB0  --> DIAG
46
/dev/ttyUSB1  --> AT commands
47
/dev/ttyUSB2
48
/dev/ttyUSB3
49
/dev/cdc-wdm0 --> QMI
50
</pre>
51
52
h3. Drivers
53
54
If in mass_storage mode there is a Windows driver available with D-Link Connection Manager. It basically just switches the device to modem mode, and then provides a GUI to establish a connection.
55
Surprisingly D-Link provides Linux support for the dongle. A page is dedicated to guide you through the installation. https://eu.dlink.com/uk/en/support/faq/routers/mobile-routers/how-to-install-my-dwm-222-on-ubuntu
56
However it is not recommended to follow the instructions, because the 'driver' is just a collection of bash scripts that tries to configure PPP daemon. Interestingly it has a complete collection of MCC, MNC, APN triples for all operators around the world. Based on the IMSI queried from the SIM card it tries to find the right settings and feed them to pppd.
57
58
h2. Firmware
59
60
There are 2 firmware versions available for download currently: 2.0.1 and 2.0.8. https://eu.dlink.com/uk/en/products/dwm-222-4g-lte-usb-adapter#support
61
The dongle that I had came with an older version, 1.7.9. It doesn't really work for me, so I upgraded to 2.0.8:
62
63
h3. Upgrade process
64
65
Upgrade can only be done from Windows. The file provided is a self-extracting executable. After extracting the contents it turned out to be quite interesting: a collection of executables and batch files, as well as MBN and yaffs2 images.
66
After tracing the upgrade process I've established its steps roughly:
67
68
<pre>
69
Start 1key.bat -> Installs drivers (ADB, QDLoader, Fastboot) -> Runs dl.exe -> Device goes into QDL mode -> MBN files are flashed -> Device reboots.
70
</pre>
71
72
Now comes the tricky part: the bat files tries to reboot the device into @fastboot@ mode using ADB shell. However D-Link requested ADB to be turned off for the device, so the @fastboot@ part fails. Basically you'll end up with a device that has new DSP software, but the Android part is unchanged. Fortunately the device stays operational after the failed update, only its LED is stuck on white instead of different colors/blinking.
73
So the complete upgrade cycle would look like this (based on reading the bat files):
74
75
<pre>
76
Start 1key.bat -> Installs drivers (ADB, QDLoader, Fastboot) -> Runs dl.exe -> Device goes into QDL mode -> MBN files are flashed -> Device reboots
77
-> ADB shell to reboot into fastboot mode -> Android images are flashed using fastboot (rootfs, usr) -> Device rebooted again, check if it is not stuck in bootloader -> Done.
78
</pre>
79
80
h3. Analyzing the firmware
81
82
Since it is just YAFFS2 it was easy to unpack the firmware and poke around it. No encryption/signatures/etc. was in place.
83
It is, as suspected, Linux.
84 2 domi
They supply 2 YAFFS2 images: one is the @rootfs@, the other is @/usr@
85 1 domi
86 2 domi
File list of @rootfs@
87
88 1 domi
<pre>
89
# ls -lha
90
total 84K
91
drwxr-xr-x 20 root root 4,0K aug   10 14:58 .
92
drwxr-xr-x  5 root root 4,0K aug   10 15:30 ..
93
drwxr-xr-x  2 root root 4,0K aug   10 14:58 bin
94
drwxr-xr-x  2 root root 4,0K aug   10 14:58 boot
95
-rw-r--r--  1 root root   47 aug   10 14:58 build.prop
96
drwxr-xr-x  2 root root 4,0K aug   10 14:58 cache
97
drwxr-xr-x  2 root root 4,0K aug   10 14:58 dev
98
drwxr-xr-x 30 root root 4,0K aug   10 14:58 etc
99
drwxr-xr-x  3 root root 4,0K aug   10 14:58 home
100
drwxr-xr-x  5 root root 4,0K aug   10 14:58 lib
101
lrwxrwxrwx  1 root root   12 aug   10 14:58 linuxrc -> /bin/busybox
102
drwxr-xr-x 10 root root 4,0K aug   10 14:58 media
103
drwxr-xr-x  2 root root 4,0K aug   10 14:58 mnt
104
drwxr-xr-x  2 root root 4,0K aug   10 14:58 proc
105
drwxr-xr-x  2 root root 4,0K aug   10 14:58 sbin
106
lrwxrwxrwx  1 root root   11 aug   10 14:58 sdcard -> /media/card
107
drwxr-xr-x  3 root root 4,0K aug   10 14:58 share
108
drwxr-xr-x  2 root root 4,0K aug   10 14:58 sys
109
drwxr-xr-x  2 root root 4,0K aug   10 14:58 tmp
110
drwxr-xr-x  2 root root 4,0K aug   10 14:58 usr
111
drwxr-xr-x  8 root root 4,0K aug   10 14:58 var
112
drwxr-xr-x  3 root root 4,0K aug   10 14:58 WEBSERVER
113
drwxr-xr-x  5 root root 4,0K aug   10 14:58 www
114
</pre>
115
116 2 domi
The @WEBSERVER@ and @www@ directory are there for the WiFi router versions which use a web-based interface for settings.
117 1 domi
118
I was mainly curious about ADB, so I followed the @/etc/init.d/usb@ script. It saves the USB device id of the device to a file, then based on the id it starts a bash script located in @/usr/bin/usb/compositions@
119
120
<pre>
121
ls -lha bin/usb/compositions/
122
total 228K
123
drwxr-xr-x 2 root root 4,0K aug   10 14:58 .
124
drwxr-xr-x 3 root root 4,0K aug   10 14:28 ..
125
-rw-r--r-- 1 root root 3,8K aug   10 14:28 2033
126
-rw-r--r-- 1 root root 4,0K aug   10 14:28 2034
127
-rw-r--r-- 1 root root 4,4K aug   10 14:28 2037
128
-rw-r--r-- 1 root root 3,8K aug   10 14:28 3443
129
-rw-r--r-- 1 root root 4,4K aug   10 14:28 3444
130
-rw-r--r-- 1 root root 4,4K aug   10 14:28 4030
131
-rw-r--r-- 1 root root 3,8K aug   10 14:58 7e35
132
-rw-r--r-- 1 root root 4,6K aug   10 14:28 7e35A
133
-rw-r--r-- 1 root root 4,4K aug   10 14:28 7e37
134
-rw-r--r-- 1 root root 4,4K aug   10 14:28 7e38
135
-rw-r--r-- 1 root root 4,4K aug   10 14:28 7e39
136
-rw-r--r-- 1 root root 4,4K aug   10 14:28 7e3c
137
-rw-r--r-- 1 root root 3,8K aug   10 14:28 7e3d
138
-rw-r--r-- 1 root root 2,3K aug   10 14:28 9002
139
-rw-r--r-- 1 root root 2,2K aug   10 14:28 901C
140
-rw-r--r-- 1 root root 2,8K aug   10 14:28 901D
141
-rw-r--r-- 1 root root 3,4K aug   10 14:28 9021
142
-rw-r--r-- 1 root root 3,4K aug   10 14:28 9022
143
-rw-r--r-- 1 root root 2,7K aug   10 14:28 9024
144
-rw-r--r-- 1 root root 3,6K aug   10 14:28 9025
145
-rw-r--r-- 1 root root 3,5K aug   10 14:28 9026
146
-rw-r--r-- 1 root root 2,7K aug   10 14:28 902A
147
-rw-r--r-- 1 root root 2,7K aug   10 14:28 902B
148
-rw-r--r-- 1 root root 2,7K aug   10 14:28 902C
149
-rw-r--r-- 1 root root 2,8K aug   10 14:28 902D
150
-rw-r--r-- 1 root root 3,9K aug   10 14:28 902E
151
-rw-r--r-- 1 root root 3,3K aug   10 14:28 9043
152
-rw-r--r-- 1 root root 3,0K aug   10 14:28 9046
153
-rw-r--r-- 1 root root 2,4K aug   10 14:28 9047
154
-rw-r--r-- 1 root root 3,5K aug   10 14:28 9049
155
-rw-r--r-- 1 root root 2,2K aug   10 14:28 904A
156
-rw-r--r-- 1 root root 3,6K aug   10 14:28 9056
157
-rw-r--r-- 1 root root 2,7K aug   10 14:28 9057
158
-rw-r--r-- 1 root root 2,9K aug   10 14:28 9059
159
-rw-r--r-- 1 root root 3,2K aug   10 14:28 905A
160
-rw-r--r-- 1 root root 3,0K aug   10 14:28 905B
161
-rw-r--r-- 1 root root 2,2K aug   10 14:28 9060
162
-rw-r--r-- 1 root root 3,2K aug   10 14:28 9063
163
-rw-r--r-- 1 root root 4,4K aug   10 14:28 9064
164
-rw-r--r-- 1 root root 4,0K aug   10 14:28 9067
165
-rw-r--r-- 1 root root 3,0K aug   10 14:28 9083
166
-rw-r--r-- 1 root root 3,0K aug   10 14:28 9084
167
-rw-r--r-- 1 root root 3,1K aug   10 14:28 9085
168
-rw-r--r-- 1 root root  127 aug   10 14:28 empty
169
-rw-r--r-- 1 root root    2 aug   10 14:28 hsic_next
170
-rw-r--r-- 1 root root    5 aug   10 14:28 hsusb_next
171
</pre>
172
173
Looking into the file @7e35@ (the id of the D-Link device) reveals why ADB is missing - the Android USB Gadget is configured without ADB:
174
175
<pre>
176
# cat bin/usb/compositions/7e35
177
178
#!/bin/sh
179
#
180
# Copyright (c) 2012, The Linux Foundation. All rights reserved.
181
#
182
# Redistribution and use in source and binary forms, with or without
183
# modification, are permitted provided that the following conditions are met:
184
#     * Redistributions of source code must retain the above copyright
185
#       notice, this list of conditions and the following disclaimer.
186
#     * Redistributions in binary form must reproduce the above copyright
187
#       notice, this list of conditions and the following disclaimer in the
188
#       documentation and/or other materials provided with the distribution.
189
#     * Neither the name of The Linux Foundation nor the names of its
190
#       contributors may be used to endorse or promote products derived from
191
#       this software without specific prior written permission.
192
#
193
# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
194
# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY,
195
# FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT ARE DISCLAIMED.  IN NO
196
# EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
197
# INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
198
# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
199
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
200
# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
201
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
202
# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
203
204
# DESCRIPTION: DIAG + MODEM + AT + NMEA + QMI_RMNET + ADB + Mass Storage (Android)
205
206
echo "Switching to composition number 0x7e35"
207
208
if [ "$1" = "y" ]; then
209
	num="1"
210
else
211
	num="0"
212
fi
213
214
echo 0 > /sys/class/android_usb/android$num/enable
215
if [ "$2" = "y" ]; then 
216
	echo 0xAB00 > /sys/class/android_usb/android$num/idProduct
217
	echo 0x2001 > /sys/class/android_usb/android$num/idVendor
218
	echo mass_storage > /sys/class/android_usb/android$num/functions
219
	echo 1 > /sys/class/android_usb/android$num/enable
220
else
221
	run_9x15() {
222
		echo 0x7e35 > /sys/class/android_usb/android$num/idProduct
223
		echo 0x2001 > /sys/class/android_usb/android$num/idVendor
224
		echo diag > /sys/class/android_usb/android0/f_diag/clients
225
		echo smd,smd,tty > /sys/class/android_usb/android0/f_serial/transports
226
		echo SMD,BAM2BAM > /sys/class/android_usb/android0/f_rmnet/transports
227
		echo diag,serial,rmnet,mass_storage > /sys/class/android_usb/android$num/functions
228
 		echo 1 > /sys/class/android_usb/android$num/enable
229
  	}
230
231
	run_9x25() {
232
		echo 0x7e35 > /sys/class/android_usb/android$num/idProduct
233
		echo 0x2001 > /sys/class/android_usb/android$num/idVendor
234
		echo diag > /sys/class/android_usb/android0/f_diag/clients
235
		echo smd,smd,tty > /sys/class/android_usb/android0/f_serial/transports
236
		echo SMD,BAM2BAM_IPA > /sys/class/android_usb/android0/f_rmnet/transports
237
		echo diag,serial,rmnet,mass_storage > /sys/class/android_usb/android$num/functions
238
 		echo 1 > /sys/class/android_usb/android$num/enable
239
	}
240
241
	run_9x25_v2() {
242
		echo 0x7e35 > /sys/class/android_usb/android$num/idProduct
243
		echo 0x2001 > /sys/class/android_usb/android$num/idVendor
244
		echo 0123456789ABCDEF > /sys/class/android_usb/android$num/iSerial
245
		echo diag > /sys/class/android_usb/android0/f_diag/clients
246
		echo smd,smd,tty > /sys/class/android_usb/android0/f_serial/transports
247
		echo QTI,BAM2BAM_IPA > /sys/class/android_usb/android0/f_rmnet/transports
248
		echo diag,serial,rmnet,mass_storage > /sys/class/android_usb/android$num/functions
249
 		echo 1 > /sys/class/android_usb/android$num/enable
250
	}
251
252
	case `source /usr/bin/usb/target` in
253
		*9x15* )
254
			run_9x15 &
255
			;;
256
		*9x25* )
257
			case `cat /sys/devices/soc0/revision` in
258
				*1.0* )
259
					run_9x25 &
260
					;;
261
				*2.* )
262
					run_9x25_v2 &
263
					;;
264
				* )
265
					run_9x25 &
266
					;;
267
			esac
268
			;;
269
		* )
270
			run_9x15 &
271
			;;
272
  	esac
273
fi
274
275
</pre>
276
277 2 domi
Simple adding @adb@ to the echos should be enough, based on the other script files. So I added the string @adb@ to the right places in the file, re-packed the @usr@ YAFFS2 image just to find out that because I could not get it into fastboot mode...so if someone could find a way to put the dongle into fastboot mode then simply installing a patched firmware file would enable ADB on the device.
278 1 domi
279
So now the question arises: what kind of dongle would you need to buy that has ADB out of the box? I could tell you the USB device id of such devices:
280
281
<pre>
282
grep -r adb .
283
./905A:	echo diag,adb,usb_mbim:ecm_qc > /sys/class/android_usb/android$num/functions
284
./905A:	echo diag,adb,usb_mbim:ecm_qc > /sys/class/android_usb/android$num/functions
285
./9025:	echo diag,adb,serial,rmnet,mass_storage > /sys/class/android_usb/android$num/functions
286
./9025:	echo diag,adb,serial,rmnet,mass_storage > /sys/class/android_usb/android$num/functions
287
./9025:	echo diag,adb,serial,rmnet,mass_storage > /sys/class/android_usb/android$num/functions
288
./9022:	echo diag,adb,rmnet > /sys/class/android_usb/android$num/functions
289
./9022:	echo diag,adb,rmnet > /sys/class/android_usb/android$num/functions
290
./9022:	echo diag,adb,rmnet > /sys/class/android_usb/android$num/functions
291
./9059:	echo rndis_qc,diag,adb:ecm_qc > /sys/class/android_usb/android$num/functions
292
./9059:	echo rndis,diag,adb:ecm_qc > /sys/class/android_usb/android$num/functions
293
./9064:	echo diag,adb,serial,rmnet:ecm_qc:usb_mbim > /sys/class/android_usb/android$num/functions
294
./9064:	echo diag,adb,serial,rmnet:ecm:usb_mbim > /sys/class/android_usb/android$num/functions
295
./9064:	echo diag,adb,serial,rmnet:ecm_qc:usb_mbim > /sys/class/android_usb/android$num/functions
296
./9046:	echo diag,adb,serial,rmnet,mass_storage > /sys/class/android_usb/android$num/functions
297
./9046:	echo diag,adb,serial,rmnet,mass_storage > /sys/class/android_usb/android$num/functions
298
./9024:	echo rndis_qc,adb > /sys/class/android_usb/android$num/functions
299
./9024:	echo rndis,adb > /sys/class/android_usb/android$num/functions
300
./9049:	echo diag,adb,serial,rmnet,mass_storage,qdss > /sys/class/android_usb/android$num/functions
301
./9049:	echo diag,adb,serial,rmnet,mass_storage,qdss > /sys/class/android_usb/android$num/functions
302
./9049:	echo diag,adb,serial,rmnet,mass_storage,qdss > /sys/class/android_usb/android$num/functions
303
./902D:	echo rndis_qc,diag,adb > /sys/class/android_usb/android$num/functions
304
./902D:	echo rndis,diag,adb > /sys/class/android_usb/android$num/functions
305
./901D:	echo diag,adb > /sys/class/android_usb/android$num/functions
306
./901D:	echo diag,adb > /sys/class/android_usb/android$num/functions
307
./9084:	echo diag,qdss,adb,rmnet > /sys/class/android_usb/android$num/functions
308
./9084:	echo diag,qdss,adb,rmnet > /sys/class/android_usb/android$num/functions
309
./902B:	echo rndis_qc,adb,mass_storage > /sys/class/android_usb/android$num/functions
310
./902B:	echo rndis,adb,mass_storage > /sys/class/android_usb/android$num/functions
311
./9085:	echo diag,adb,usb_mbim,gps > /sys/class/android_usb/android$num/functions
312
./9085:	echo diag,adb,usb_mbim,gps > /sys/class/android_usb/android$num/functions
313
./2034:	echo rndis_qc,diag,serial,adb,mass_storage > /sys/class/android_usb/android$num/functions
314
./2034:	echo rndis,diag,serial,adb,mass_storage > /sys/class/android_usb/android$num/functions
315
./2034:	echo rndis,diag,serial,adb,mass_storage > /sys/class/android_usb/android$num/functions
316
./9060:	echo diag,qdss,adb > /sys/class/android_usb/android$num/functions
317
./9056:	echo diag,adb,serial,rmnet,mass_storage,audio > /sys/class/android_usb/android$num/functions
318
./9056:	echo diag,adb,serial,rmnet,mass_storage,audio > /sys/class/android_usb/android$num/functions
319
./9056:	echo diag,adb,serial,rmnet,mass_storage,audio > /sys/class/android_usb/android$num/functions
320
</pre>
321
322 2 domi
It would be great to find out the actual vendor of these, so we can tell people exactly what to buy. I'm assuming Chinese LTE dongles from eBay are prime candidates, but that's just a guess.
Add picture from clipboard (Maximum size: 48.8 MB)