在固件更新模式下使用libusb与Nexus-4通信

时间:2015-12-09 02:57:53

标签: android linux libusb-1.0 android-firmware

我正在尝试开发一个简单的程序,以便在固件更新模式下与Nexus-4引导程序进行通信。 Nexus -4有三个usb接口。 Interface-1有两个2端点--2和131。

我编写了一个程序,通过端点2编写命令get-device-info,并在端点131监听回复。 (我尝试了所有接口和端点的排列!)。

程序成功将命令写入设备,但未从设备读取任何内容。

命令格式:标志(0x7e):CMD:数据(可变长度):CRC-16:标志(0x7e)

Get-device-info-command:0x7e 0x00 0x78 0xf0 0x7e

以下是该计划。

#include <stdio.h>
#include <stdlib.h>
#include <libusb-1.0/libusb.h>

#define INTERFACE 1
#define EP_OUT 2
#define EP_IN 131

int main() {

        libusb_device **devs; // retrieve a list of devices
    libusb_device_handle *dev_handle; // device handler
    libusb_context *ctx = NULL; //a libusb session

    int r, r2, i; 
    ssize_t cnt; //holding number of devices in list

    unsigned char data[30],read_data[512]; //data to write

    data[0]=0x7e;data[1]=0x00;data[2]=0x78;data[3]=0xf0;data[4]=0x7e; // get-device-info command in HLDC format

    int actual,read_actual; 

    r = libusb_init(&ctx); 

    if(r < 0) {
        printf("Init Error\n");
        return 1;
    }

    libusb_set_debug(ctx, 3); 

    cnt = libusb_get_device_list(ctx, &devs); //get the list of devices

    if(cnt < 0) {
        printf("Get Device Error\n");
        return 1;
    }
    printf("%d Devices in list\n",(int)cnt);

    dev_handle = libusb_open_device_with_vid_pid(ctx, 4100, 25371); //these are vendorID and productID I found for Nexus-4 firmware update

    if(dev_handle == NULL)
        printf("Cannot open device\n");
    else
        printf("Device opened\n");

    libusb_free_device_list(devs, 0); //free the device list


    if(libusb_kernel_driver_active(dev_handle, INTERFACE) == 1) { //find out if kernel driver is attached
        printf("Kernel Driver Active\n");
        if(libusb_detach_kernel_driver(dev_handle, INTERFACE) == 0) //detach it
            printf("Kernel Driver Detached!\n");
    }

    r = libusb_claim_interface(dev_handle, INTERFACE); //claim interface 1 Nexus-5/4 FUM
    if(r < 0) {
        printf("Cannot Claim Interface\n");
        printf("%s\n",libusb_error_name(r));
        return 1;
    }
    printf("Claimed Interface\n");

    printf("Data to be send -> %s\n",data); //just to see the data that we are writing 
    printf("Writing Data...\n");

    r = libusb_bulk_transfer(dev_handle, (EP_OUT | LIBUSB_ENDPOINT_OUT), data, 5, &actual, 0); 

    if(r == 0 && actual == 5){ //we wrote successfully 5 bytes to the device
        printf("Writing Successful!\n");

        printf("Waiting to read from device!\n");
        r2 = libusb_bulk_transfer(dev_handle, (EP_IN | LIBUSB_ENDPOINT_IN), read_data, 512, &read_actual, 5000); 

        if (r2 >=0){
            if (read_actual > 0){
                printf("Data received by bulk transfer\n");

                printf("Data is ");
                for (i=0; i<read_actual; i++)
                    printf("%x ",read_data[i]);
                printf("\n");
            }
            else{
                printf(stderr, "No data received in bulk transfer (%d)\n", r2);
                return -1;
            }
        }
        else{   
            fprintf(stderr, "Error receiving data via bulk transfer %d\n", r2);
            return r2;                                                      
        }
    }
    else
        printf("Write Error\n");

    r = libusb_release_interface(dev_handle, INTERFACE); //release the claimed interface
    if(r!=0) {
        printf("Cannot Release Interface\n");
        return 1;
    }
    printf("Released Interface\n");

    libusb_close(dev_handle); 
    libusb_exit(ctx); 

    return 0;
}

该程序能够将命令成功发送到手机,但无法从手机接收任何响应。当我运行程序时,我得到以下输出:

列表中的10个设备

设备已打开

内核驱动程序激活

内核驱动程序已分离!

声称的界面

要发送的数据 - &gt; 〜

写数据......

写作成功!

等待从设备上阅读!

通过批量传输接收数据时出错-7

我不确定没有得到回复的原因是因为错误的命令结构还是因为程序的实现?

0 个答案:

没有答案