Activation Codes and Methods, Hardware Details, Sniffing
justincase
Posts: 11
Joined: 06 May 2010, 13:27

Franklin R850?

Post by justincase » 18 Jul 2017, 22:20

I have been unable to find a modeswitch for this device, but it does appear to have one. Using the HiddenMenu (discussed here) I was able to usb tether from Windows. Unfortunately I have not had this success on any of my *nix boxes.

If you need additional information or can point me on how to sniff this I will be happy to try.

LOM
Posts: 1404
Joined: 11 Jul 2012, 15:14
Location: Koh Samui, TH

Re: Franklin R850?

Post by LOM » 19 Jul 2017, 02:56

I don't think Franklin has made this MiFi hotspot, they buy things, stamps their logo on them and resells them afaik.
Learning who the original mfgr is could help when guessing how to modeswitch the device so start with telling its USB Id (vid:pid) and give the verbose lsusb list for that Id (lsusb -vd vid:pid).

justincase
Posts: 11
Joined: 06 May 2010, 13:27

Re: Franklin R850?

Post by justincase » 08 Oct 2017, 04:32

You were correct, I spent a considerable amount of time trying to get this device to appear on GNU/Linux without much luck (hides from lsusb). However, snooping around on Windows revealed the vendor information.

It's a Franklin branded version of this:
1076:9082 GCT Semiconductor [GDM7243S]
http://www.gctsemi.com/html/news/pr050316.html

handsOn3425
Posts: 4
Joined: 11 Oct 2017, 03:10

Re: Franklin R850?

Post by handsOn3425 » 11 Oct 2017, 03:17

I would also very much appreciate a hand getting this device to tether in a *nix environment. The following is from a LEDE install:

logread gives me:

Code: Select all

Tue Oct 10 20:59:08 2017 kern.info kernel: [ 1524.380590] usb 1-1: new high-speed USB device number 6 using orion-ehci
Tue Oct 10 20:59:08 2017 kern.info kernel: [ 1524.539459] rndis_host 1-1:2.0 eth2: register 'rndis_host' at usb-f1050000.usb-1, RNDIS device, 00:0a:3b:ff:ff:01
Tue Oct 10 20:59:08 2017 user.notice Log Print : Driver Name : 1 rndis_host
Tue Oct 10 20:59:08 2017 user.notice Log Print : Driver Name : 2 rndis_host
Tue Oct 10 20:59:08 2017 kern.info kernel: [ 1524.701084] usb 1-1: USB disconnect, device number 6
Tue Oct 10 20:59:08 2017 kern.info kernel: [ 1524.706342] rndis_host 1-1:2.0 eth2: unregister 'rndis_host' usb-f1050000.usb-1, RNDIS device
Tue Oct 10 20:59:08 2017 user.notice usb-modeswitch: Add : 1-1: Manufacturer=Linux_3.10.0-uc0_with_gdm-udc Product=Multifunction_Composite_Gadget Serial=? 1076 9082
Tue Oct 10 20:59:08 2017 user.notice usb-modeswitch: *****************************************************************
Tue Oct 10 20:59:08 2017 user.notice usb-modeswitch: *
Tue Oct 10 20:59:08 2017 user.notice usb-modeswitch: * Start of Modem Detection and Connection Information
Tue Oct 10 20:59:08 2017 user.notice usb-modeswitch: *
Tue Oct 10 20:59:08 2017 user.notice usb-modeswitch: * Product=Multifunction_Composite_Gadget 1076 9082
Tue Oct 10 20:59:08 2017 user.notice usb-modeswitch: *
Tue Oct 10 20:59:08 2017 user.notice usb-modeswitch: *****************************************************************
Tue Oct 10 20:59:08 2017 user.notice usb-modeswitch: *****************************************************************
Tue Oct 10 20:59:08 2017 user.notice usb-modeswitch: *
Tue Oct 10 20:59:08 2017 user.notice usb-modeswitch: * This device does not have a switch data file
Tue Oct 10 20:59:08 2017 user.notice usb-modeswitch: *
Tue Oct 10 20:59:08 2017 user.notice usb-modeswitch: * Product=Multifunction_Composite_Gadget 1076 9082
Tue Oct 10 20:59:08 2017 user.notice usb-modeswitch: *
Tue Oct 10 20:59:08 2017 user.notice usb-modeswitch: *****************************************************************
Tue Oct 10 20:59:18 2017 user.notice usb-modeswitch: *****************************************************************
Tue Oct 10 20:59:18 2017 user.notice usb-modeswitch: *
Tue Oct 10 20:59:18 2017 user.notice usb-modeswitch: * Switched to : :
Tue Oct 10 20:59:18 2017 user.notice usb-modeswitch: *
Tue Oct 10 20:59:18 2017 user.notice usb-modeswitch: *****************************************************************
Tue Oct 10 20:59:18 2017 user.notice usb-modeswitch: *****************************************************************
Tue Oct 10 20:59:18 2017 user.notice usb-modeswitch: *
Tue Oct 10 20:59:18 2017 user.notice usb-modeswitch: * ProtoFind returns : 0
Tue Oct 10 20:59:18 2017 user.notice usb-modeswitch: *
Tue Oct 10 20:59:18 2017 user.notice usb-modeswitch: *****************************************************************
and with dmesg I see:

Code: Select all

[ 1384.319889] usb 2-2: new high-speed USB device number 11 using xhci_hcd
[ 1384.473256] rndis_host 2-2:1.0 usb0: register 'rndis_host' at usb-0000:01:00.0-2, RNDIS device, 2a:e2:ce:03:d0:e3
[ 1490.130552] usb 1-1: new high-speed USB device number 5 using orion-ehci
[ 1490.289188] rndis_host 1-1:2.0 eth2: register 'rndis_host' at usb-f1050000.usb-1, RNDIS device, 00:0a:3b:ff:ff:01
[ 1490.391528] usb 1-1: USB disconnect, device number 5
[ 1490.396794] rndis_host 1-1:2.0 eth2: unregister 'rndis_host' usb-f1050000.usb-1, RNDIS device
It appears to be disconnecting shortly after being connected...lsusb shows nothing after this initial activity. Thank you in advance for any direction.

Josh
Site Admin
Posts: 6570
Joined: 03 Nov 2007, 00:30

Re: Franklin R850?

Post by Josh » 11 Oct 2017, 19:18

A vanishing device points either to a firmware flaw or to a power supply problem, the latter of which is not uncommon on embedded systems.

Try to use it on a desktop computer running Linux if you can, or use an external power source when connecting it to the embedded system, like a powered USB hub.

handsOn3425
Posts: 4
Joined: 11 Oct 2017, 03:10

Re: Franklin R850?

Post by handsOn3425 » 11 Oct 2017, 19:53

Thank you very much for the tip Josh; a few pieces of data:
  • It tethers fine, and automatically, to a computer running Windows
  • It doesn't tether automatically to a computer running Ubuntu (or to one running Debian Stretch)--I haven't had time to get to the root of the problem here yet. The computer does recognize it, and I believe continues recognizing it as a USB device, but there's some problem that prevents it being recognized as a USB ethernet device. My guess is this is some sort of configuration issue with Linux.
  • It does have an internal battery, not sure what this means re power supply worries
Since it tethers fine on Windows, and it's at least recognized via Linux laptop, perhaps it is a power issue. I think I have a two-into-one USB to micro USB cable, I could try that. Alternately I can probably find a powered hub--I'll give it a shot and report back.

Thank you again for your help.

Josh
Site Admin
Posts: 6570
Joined: 03 Nov 2007, 00:30

Re: Franklin R850?

Post by Josh » 11 Oct 2017, 23:33

It would be of some help if you could post the output of

"sudo lsusb -v -d 1076:9082"

from one of those Linux installations, with the device attached.

handsOn3425
Posts: 4
Joined: 11 Oct 2017, 03:10

Re: Franklin R850?

Post by handsOn3425 » 12 Oct 2017, 04:25

I've just had a chance to try it with a Debian Stretch machine. It seems to be disconnecting as well! Perhaps my recollections were wrong, or perhaps something's different this time. I do clearly recall an unfamiliar networking icon.

Anyway, it disconnects so lsusb doesn't show anything.

dmesg shows:

Code: Select all

[45652.651595] usb 1-2: new high-speed USB device number 10 using xhci_hcd
[45652.792442] usb 1-2: New USB device found, idVendor=1076, idProduct=9082
[45652.792446] usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[45652.792448] usb 1-2: Product: Multifunction Composite Gadget
[45652.792450] usb 1-2: Manufacturer: Linux 3.10.0-uc0 with gdm-udc
[45652.796001] rndis_host 1-2:2.0 eth0: register 'rndis_host' at usb-0000:00:14.0-2, RNDIS device, 00:0a:3b:ff:ff:01
[45652.818776] rndis_host 1-2:2.0 enx000a3bffff01: renamed from eth0
[45652.853830] IPv6: ADDRCONF(NETDEV_UP): enx000a3bffff01: link is not ready
[45653.080666] usb 1-2: USB disconnect, device number 10
[45653.080925] rndis_host 1-2:2.0 enx000a3bffff01: unregister 'rndis_host' usb-0000:00:14.0-2, RNDIS device
This makes me think: maybe it's an ipv4 vs. ipv6 problem?
Or, perhaps network manager isn't waiting long enough for the device?

Josh
Site Admin
Posts: 6570
Joined: 03 Nov 2007, 00:30

Re: Franklin R850?

Post by Josh » 12 Oct 2017, 19:15

handsOn3425 wrote:This makes me think: maybe it's an ipv4 vs. ipv6 problem?
Or, perhaps network manager isn't waiting long enough for the device?
None of these would make a device vanish on the kernel level. Only a firmware crash, a mode switch or a loss of power supply would do that.

There are some known 'auto-switching' devices which do switch modes if some command sequence is not issued to them in time. Maybe it's something along these lines.
A 'sniff' on the entire plugging process under Windows would probably be able to lift the veil. I assume the thing useable with Windows?

handsOn3425
Posts: 4
Joined: 11 Oct 2017, 03:10

Re: Franklin R850?

Post by handsOn3425 » 12 Oct 2017, 19:57

I will check it out on Windows. It is usable on Windows, and it tethers automatically via USB as an ethernet device.

Can you offer any guidance as to what this "sniff" should entail, or perhaps point to a resource? I'm a linux user day-to-day, and what Windows experience I have is more and more dated.

i_eat_boogerz
Posts: 3
Joined: 12 Mar 2018, 00:41

Re: Franklin R850?

Post by i_eat_boogerz » 12 Mar 2018, 00:52

Hi I hope it is OK to resurrect this thread. I am running Manjaro (Arch) linux. I have done some experimenting with this device. One of the problems I've had is that when it's connected over USB to a powered port, it will power up without the battery no problem. But in the same powered hub, the device booting up runs into power issues and shuts down. It's essential that this device run without the battery as it's suffered battery bloat problems. Anyway, I am looking to buy a vetted power supply that works for Raspberry Pi's and hopefully that should fix that problem.

However even with the battery the device would be disconnected as mentioned in this thread. I was able to make a bit of progress. Noticed that rndis_host was involved when the device was disconnected. Hmm! I decided to blacklist this from being loaded by putting "install rndis_host /bin/false" into a conf file. Lo and behold a TTY device appears! But I can't do anything with it and network manager doesn't want to interact with it. At this point I did try usb_modeswitch like so: " usb_modeswitch -v 0x1076 -p 0x9082 -R" . This refreshes the device in networkmanager and shows up as a sprint mobile broadband device. But I did not get internet. I wonder if I would have to do some USB sniffing to get the message number for this device or if there is some other configuration I need to get this to work. It's confusing because network manager treats it like a normal modem (along with login info, etc) when it is really just a USB ethernet device and I wonder if that's where it's getting mixed up somehow. Also it's possible that killing rndis_host wasn't a good idea but I didn't yet try configuring dhcp etc. manually like here: https://stackoverflow.com/questions/154 ... get-device

As an aside the latest February firmware does lock some access to the /hidden menu (asking for a Sprint code), although you are still able to "enable port modem0" on one of the pages, and whatever settings I had with tethering survived the firmware update.

I was able to get lots of info on this device by spamming usb-devices etc while it's booting up, it will appear for a second and disconnect, but I no longer have those logs. However if someone else is curious and can't get the USB info on these that they need you can spam command line statements (including usb_modeswitch) before it goes down, even without disabling rndis_host.

If anyone has any ideas of where to go from here I'd appreciate it, guessing I would have to set up network stuff manually which I haven't done in a long time.

LOM
Posts: 1404
Joined: 11 Jul 2012, 15:14
Location: Koh Samui, TH

Re: Franklin R850?

Post by LOM » 12 Mar 2018, 07:03

i_eat_boogerz wrote:Hi I hope it is OK to resurrect this thread.
Yes it is ok, is the right place to post about this device.
Only problem is that Josh and I have not got the info we asked the other users to provide so none of us knows anything about the device. :(

Josh
Site Admin
Posts: 6570
Joined: 03 Nov 2007, 00:30

Re: Franklin R850?

Post by Josh » 12 Mar 2018, 09:10

i_eat_boogerz,

you can start by providing the output of the "lsusb -v" command as requested from "handsOn" some posts above.

Regarding power issues, you can use a powered USB hub with an AC adaptor, or can't you?

i_eat_boogerz
Posts: 3
Joined: 12 Mar 2018, 00:41

Re: Franklin R850?

Post by i_eat_boogerz » 12 Mar 2018, 11:13

Josh wrote:i_eat_boogerz,

you can start by providing the output of the "lsusb -v" command as requested from "handsOn" some posts above.

Regarding power issues, you can use a powered USB hub with an AC adaptor, or can't you?
Hey cool, I wasn't expecting to get a reply on this. I will provide that output lsusb -v soon. I hope users of the new firmware (or even myself?) aren't lost - I don't know what exactly enabled the tethering. As you can see here: https://www.dslreports.com/forum/r31368 ... -r850-hack
There were two options, tethering and modem0. You can still enable modem0 without the code in another window that isn't locked but this menu with the tethering option is locked with the February firmware. So maybe that's why I'm seeing a tty device? Don't know if I should see a usb lan instead.

That's what I thought but apparently I have a lot to learn about USB hubs, in particular that the usb3 ones can cause issues. I have one AC powered 3.0 hub and one Microusb powered hub and they both die during boot up at a certain point if the battery is not inserted. I am also using an older Thinkpad which has been finicky with usb3 in general.

I am going to try a Plugable brand USB hub listed here as it's known to work with another high powered USB device (raspberry pi) without issue:
https://plugable.com/2012/10/25/raspber ... e-devices/
As you can see not even all of their brands handled it without an issue, perhaps the device is actually being OVERPOWERED like the hub listed!

i_eat_boogerz
Posts: 3
Joined: 12 Mar 2018, 00:41

Re: Franklin R850?

Post by i_eat_boogerz » 12 Mar 2018, 17:26

Hi, here is the output of lsusb -v

Code: Select all

Bus 002 Device 004: ID 1076:9082 GCT Semiconductor, Inc. 
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass          239 Miscellaneous Device
  bDeviceSubClass         2 
  bDeviceProtocol         1 Interface Association
  bMaxPacketSize0        64
  idVendor           0x1076 GCT Semiconductor, Inc.
  idProduct          0x9082 
  bcdDevice            3.10
  iManufacturer           1 Linux 3.10.0-uc0 with gdm-udc
  iProduct                2 Multifunction Composite Gadget
  iSerial                 0 
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength          141
    bNumInterfaces          4
    bConfigurationValue     2
    iConfiguration          0 
    bmAttributes         0xe0
      Self Powered
      Remote Wakeup
    MaxPower              500mA
    Interface Association:
      bLength                 8
      bDescriptorType        11
      bFirstInterface         0
      bInterfaceCount         2
      bFunctionClass        224 Wireless
      bFunctionSubClass       1 Radio Frequency
      bFunctionProtocol       3 RNDIS
      iFunction               6 RNDIS
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass       224 Wireless
      bInterfaceSubClass      1 Radio Frequency
      bInterfaceProtocol      3 RNDIS
      iInterface              4 RNDIS Communications Control
      ** UNRECOGNIZED:  05 24 00 10 01
      ** UNRECOGNIZED:  05 24 01 00 01
      ** UNRECOGNIZED:  04 24 02 00
      ** UNRECOGNIZED:  05 24 06 00 01
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0008  1x 8 bytes
        bInterval               9
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 
      bInterfaceProtocol      0 
      iInterface              5 RNDIS Ethernet Data
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Association:
      bLength                 8
      bDescriptorType        11
      bFirstInterface         2
      bInterfaceCount         2
      bFunctionClass          2 Communications
      bFunctionSubClass       2 Abstract (modem)
      bFunctionProtocol       1 AT-commands (v.25ter)
      iFunction               9 CDC Serial
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        2
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      1 AT-commands (v.25ter)
      iInterface              7 CDC Abstract Control Model (ACM)
      CDC Header:
        bcdCDC               1.10
      CDC Call Management:
        bmCapabilities       0x00
        bDataInterface          3
      CDC ACM:
        bmCapabilities       0x02
          line coding and serial state
      CDC Union:
        bMasterInterface        2
        bSlaveInterface         3 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x86  EP 6 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x000a  1x 10 bytes
        bInterval               9
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        3
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 
      bInterfaceProtocol      0 
      iInterface              8 CDC ACM Data
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x84  EP 4 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x05  EP 5 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass          239 Miscellaneous Device
  bDeviceSubClass         2 
  bDeviceProtocol         1 Interface Association
  bMaxPacketSize0        64
  bNumConfigurations      1
can't get debug descriptor: Resource temporarily unavailable
Device Status:     0x0000
  (Bus Powered)

Post Reply