Personal View site logo

User Tools

Site Tools


sony-hack:usbinfo

The Nex contains a number of USB Descriptors, these are all contained in the libusb.so file

These are:

  • PTP
  • MSC (Mass storage)
  • SEN (could be some sort of console access but uses the 0xFF class codes at the interface level. This implies that it is not a simple usb-serial bridge, but a proprietary protocol created by Sony which could make it harder to use as a vector for testing/hacking)

The method for changing modes is currently unknown. If anyone knows how Sony cameras change modes to ptp mode please advise as it will help with working out how the other modes may be accessed

On the nex-5r you can just select it in menu. Also if you go to the sony appstore you can change the camera to ptp mode by clicking some button on the website. That's also the mode while an app is transfered to the camera. Here's a usbcapture of this change_to_ptp_mode.pcap.zip In beginning the Device is 35 in Mass storage mode and after change to ptp mode its 36

There are a couple more, will update this page soon with more details.

lsusb output from an nex5r

HID Charger
 Device: ID 054c:05b2 Sony Corp. 
 Device Descriptor:
   bLength                18
   bDescriptorType         1
   bcdUSB               2.00
   bDeviceClass            0 (Defined at Interface level)
   bDeviceSubClass         0 
   bDeviceProtocol         0 
   bMaxPacketSize0         8
   idVendor           0x054c Sony Corp.
   idProduct          0x05b2 
   bcdDevice            1.00
   iManufacturer           0 
   iProduct                1 USB Charger 
   iSerial                 0 
   bNumConfigurations      1
   Configuration Descriptor:
     bLength                 9
     bDescriptorType         2
     wTotalLength           34
     bNumInterfaces          1
     bConfigurationValue     1
     iConfiguration          0 
     bmAttributes         0x80
       (Bus Powered)
     MaxPower              500mA
     Interface Descriptor:
       bLength                 9
       bDescriptorType         4
       bInterfaceNumber        0
       bAlternateSetting       0
       bNumEndpoints           1
       bInterfaceClass         3 Human Interface Device
       bInterfaceSubClass      0 No Subclass
       bInterfaceProtocol      0 None
       iInterface              0 
         HID Device Descriptor:
           bLength                 9
           bDescriptorType        33
           bcdHID               1.11
           bCountryCode            0 Not supported
           bNumDescriptors         1
           bDescriptorType        34 Report
           wDescriptorLength      35
          Report Descriptors: 
            ** UNAVAILABLE **
       Endpoint Descriptor:
         bLength                 7
         bDescriptorType         5
         bEndpointAddress     0x81  EP 1 IN
         bmAttributes            3
           Transfer Type            Interrupt
           Synch Type               None
           Usage Type               Data
         wMaxPacketSize     0x0001  1x 1 bytes
         bInterval              32
 Device Status:     0x0000
   (Bus Powered)
Mass Storage
 Device: ID 054c:066e Sony Corp. 
 Device Descriptor:
   bLength                18
   bDescriptorType         1
   bcdUSB               2.00
   bDeviceClass            0 (Defined at Interface level)
   bDeviceSubClass         0 
   bDeviceProtocol         0 
   bMaxPacketSize0        64
   idVendor           0x054c Sony Corp.
   idProduct          0x066e 
   bcdDevice            2.00
   iManufacturer           1 Sony
   iProduct                2 NEX-5R
   iSerial                 3 C921B04E61C5
   bNumConfigurations      1
   Configuration Descriptor:
     bLength                 9
     bDescriptorType         2
     wTotalLength           32
     bNumInterfaces          1
     bConfigurationValue     1
     iConfiguration          0 
     bmAttributes         0xc0
       Self Powered
     MaxPower                2mA
     Interface Descriptor:
       bLength                 9
       bDescriptorType         4
       bInterfaceNumber        0
       bAlternateSetting       0
       bNumEndpoints           2
       bInterfaceClass         8 Mass Storage
       bInterfaceSubClass      6 SCSI
       bInterfaceProtocol     80 Bulk-Only
       iInterface              0 
       Endpoint Descriptor:
         bLength                 7
         bDescriptorType         5
         bEndpointAddress     0x81  EP 1 IN
         bmAttributes            2
           Transfer Type            Bulk
           Synch Type               None
           Usage Type               Data
         wMaxPacketSize     0x0200  1x 512 bytes
         bInterval               0
       Endpoint Descriptor:
         bLength                 7
         bDescriptorType         5
         bEndpointAddress     0x02  EP 2 OUT
         bmAttributes            2
           Transfer Type            Bulk
           Synch Type               None
           Usage Type               Data
         wMaxPacketSize     0x0200  1x 512 bytes
         bInterval               0
 Device Qualifier (for other device speed):
   bLength                10
   bDescriptorType         6
   bcdUSB               2.00
   bDeviceClass            0 (Defined at Interface level)
   bDeviceSubClass         0 
   bDeviceProtocol         0 
   bMaxPacketSize0        64
   bNumConfigurations      1
 Device Status:     0x0001
   Self Powered
PTP
 Device: ID 054c:06a8 Sony Corp. 
 Device Descriptor:
   bLength                18
   bDescriptorType         1
   bcdUSB               2.00
   bDeviceClass            0 (Defined at Interface level)
   bDeviceSubClass         0 
   bDeviceProtocol         0 
   bMaxPacketSize0        64
   idVendor           0x054c Sony Corp.
   idProduct          0x06a8 
   bcdDevice            1.00
   iManufacturer           1 Sony
   iProduct                2 NEX-5R
   iSerial                 3 C921B04E61C5
   bNumConfigurations      1
   Configuration Descriptor:
     bLength                 9
     bDescriptorType         2
     wTotalLength           39
     bNumInterfaces          1
     bConfigurationValue     1
     iConfiguration          0 
     bmAttributes         0xc0
       Self Powered
     MaxPower                2mA
     Interface Descriptor:
       bLength                 9
       bDescriptorType         4
       bInterfaceNumber        0
       bAlternateSetting       0
       bNumEndpoints           3
       bInterfaceClass         6 Imaging
       bInterfaceSubClass      1 Still Image Capture
       bInterfaceProtocol      1 Picture Transfer Protocol (PIMA 15470)
       iInterface              0 
       Endpoint Descriptor:
         bLength                 7
         bDescriptorType         5
         bEndpointAddress     0x81  EP 1 IN
         bmAttributes            2
           Transfer Type            Bulk
           Synch Type               None
           Usage Type               Data
         wMaxPacketSize     0x0200  1x 512 bytes
         bInterval               0
       Endpoint Descriptor:
         bLength                 7
         bDescriptorType         5
         bEndpointAddress     0x02  EP 2 OUT
         bmAttributes            2
           Transfer Type            Bulk
           Synch Type               None
           Usage Type               Data
         wMaxPacketSize     0x0200  1x 512 bytes
         bInterval               0
       Endpoint Descriptor:
         bLength                 7
         bDescriptorType         5
         bEndpointAddress     0x83  EP 3 IN
         bmAttributes            3
           Transfer Type            Interrupt
           Synch Type               None
           Usage Type               Data
         wMaxPacketSize     0x0020  1x 32 bytes
         bInterval               7
 Device Qualifier (for other device speed):
   bLength                10
   bDescriptorType         6
   bcdUSB               2.00
   bDeviceClass            0 (Defined at Interface level)
   bDeviceSubClass         0 
   bDeviceProtocol         0 
   bMaxPacketSize0        64
   bNumConfigurations      1
 Device Status:     0x0001
   Self Powered

Update Mode

 Device: ID 054c:03e2 Sony Corp.·
 Device Descriptor:
   bLength                18  
   bDescriptorType         1   
   bcdUSB               2.00
   bDeviceClass            0 (Defined at Interface level)
   bDeviceSubClass         0·  
   bDeviceProtocol         0·  
   bMaxPacketSize0        64  
   idVendor           0x054c Sony Corp.
   idProduct          0x03e2·
   bcdDevice            1.00
   iManufacturer           1 Sony
   iProduct                2 Sony USB Device
   iSerial                 3 C921B04E61C5
   bNumConfigurations      1   
   Configuration Descriptor:
     bLength                 9   
     bDescriptorType         2   
     wTotalLength           32  
     bNumInterfaces          1   
     bConfigurationValue     1   
     iConfiguration          0·  
     bmAttributes         0xc0
       Self Powered
     MaxPower                2mA 
     Interface Descriptor:
       bLength                 9   
       bDescriptorType         4   
       bInterfaceNumber        0   
       bAlternateSetting       0   
       bNumEndpoints           2   
       bInterfaceClass         8 Mass Storage
       bInterfaceSubClass      6 SCSI
       bInterfaceProtocol     80 Bulk-Only
       iInterface              0·  
       Endpoint Descriptor:
         bLength                 7   
         bDescriptorType         5   
         bEndpointAddress     0x81  EP 1 IN
         bmAttributes            2   
           Transfer Type            Bulk
           Synch Type               None
           Usage Type               Data
         wMaxPacketSize     0x0200  1x 512 bytes
         bInterval               0   
       Endpoint Descriptor:
         bLength                 7   
         bDescriptorType         5   
         bEndpointAddress     0x02  EP 2 OUT 
         bmAttributes            2   
           Transfer Type            Bulk
           Synch Type               None
           Usage Type               Data
         wMaxPacketSize     0x0200  1x 512 bytes
         bInterval               0
 Device Qualifier (for other device speed):
   bLength                10
   bDescriptorType         6
   bcdUSB               2.00
   bDeviceClass            0 (Defined at Interface level)
   bDeviceSubClass         0·
   bDeviceProtocol         0·
   bMaxPacketSize0        64
   bNumConfigurations      1
 Device Status:     0x0001
   Self Powered
sony-hack/usbinfo.txt · Last modified: 2015/08/10 13:13 by vitaliy_kiselev