PRS-500 reverse engineering the Reader USB protocol - Page 9

Michael Pemulis · 01-28-2007, 04:19 AM

Hi, and thank you Kovid for all of this work! This question may have already been addressed in another form (I think maybe chrissam had a similar problem above) but I've installed everything and yet prs500 won't recognize my reader, at least not in any meaningful way--I assume this has something to do with the USB connect via OSX, since I get different errors when entering the command several times within a short span (though the errors are different from chrissam's)... I'm working on a new MacBook Core2duo if that helps anything.

Here's the most common error message:

Books in main memory:
Traceback (most recent call last):
File "/Library/Frameworks/Python.framework/Versions/Current/bin/prs500", line 8, in <module>
load_entry_point('libprs500==0.3.6', 'console_scripts', 'prs500')()
File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/cli/main.py", line 210, in main
File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/communicate.py", line 167, in run_session
File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/communicate.py", line 256, in open
File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/communicate.py", line 317, in send_validated_command
File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/communicate.py", line 301, in _send_command
File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/prstypes.py", line 643, in __init__
libprs500.errors.PacketError: Response packets must have their number set to 0x1000

though this one pops up too:

prs500 books
prs500 booksBooks in main memory:

Traceback (most recent call last):
File "/Library/Frameworks/Python.framework/Versions/Current/bin/prs500", line 8, in <module>
load_entry_point('libprs500==0.3.6', 'console_scripts', 'prs500')()
File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/cli/main.py", line 210, in main
File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/communicate.py", line 167, in run_session
File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/communicate.py", line 268, in open
File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/communicate.py", line 317, in send_validated_command
File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/communicate.py", line 301, in _send_command
File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/libusb.py", line 229, in control_msg
libprs500.libusb.Error: Could not read 32 bytes on the control bus. Read: -60 bytes.

Any suggestions? I've tried "hammering" the command over and over to get the USB to say something more interesting, but to no avail. I'm new to this so it might be totally easy and stupid, but: Any suggestions?

Thanks!
Mikey P.

kovidgoyal · 01-28-2007, 11:44 AM

Hmm when you get this type of error, try reconnecting the reader. (Unplug and reconnect it). Also do you always get errors or are they intermittent?

Michael Pemulis · 01-28-2007, 04:35 PM

Yeah, I tried reconnecting it (in any number of comically hopeful/absurd ways), but it happens all the time. Do those errors mean that my mac's simply not even recognizing the reader at all, or is it something else?

kovidgoyal · 01-28-2007, 07:24 PM

No its finding the reader, the reader is just not responding like it should. Can you try the commands with the --log-packets option.

Michael Pemulis · 01-28-2007, 09:54 PM

Thanks Kovid, I tried it with the --log-packets option, and it logged some packets, one of which mentioned unlocking the reader... which made me think to turnoff the screen-lock on the Reader (under Settings). Then it took a couple times to find the Reader, and then it worked.

OK, now to embark on the gui...

kovidgoyal · 01-29-2007, 01:19 PM

I've taken a look at the RTF spec and added support for reading RTF metadata in SVN. (There's an rtf-meta command). However, it's going to have problems with non-english characters.

I've also decided not to implement write support for the metadata as RTF is a bloody mess and I don't feel like writing a full-fledged RTF parser. You don't really need metadata support as if you transfer files to the reader via the GUI, the GUI automatically sets the title and author.

If however someone feels they really need RTF metadata write support, I encourage them to look at rtf.py and extend it.

I would appreciate some testing from those of you that use RTF. It worked fine for the few RTF files I have.

kovidgoyal · 01-29-2007, 09:31 PM

Quote:

Originally Posted by Michael Pemulis

Thanks Kovid, I tried it with the --log-packets option, and it logged some packets, one of which mentioned unlocking the reader... which made me think to turnoff the screen-lock on the Reader (under Settings). Then it took a couple times to find the Reader, and then it worked.

OK, now to embark on the gui...

I've added support for unlocking the device in version 0.3.8

Alexander Turcic · 01-30-2007, 03:04 AM

Quote:

Originally Posted by kovidgoyal

I've taken a look at the RTF spec and added support for reading RTF metadata in SVN. (There's an rtf-meta command). However, it's going to have problems with non-english characters.

You rock! I'll try tonight one more time to compile the gui on my Ubuntu installation.

Xenophon · 01-30-2007, 11:46 AM

Quote:

Originally Posted by kovidgoyal

I've taken a look at the RTF spec and added support for reading RTF metadata in SVN. (There's an rtf-meta command). However, it's going to have problems with non-english characters.

I've also decided not to implement write support for the metadata as RTF is a bloody mess and I don't feel like writing a full-fledged RTF parser. You don't really need metadata support as if you transfer files to the reader via the GUI, the GUI automatically sets the title and author.

If however someone feels they really need RTF metadata write support, I encourage them to look at rtf.py and extend it.

I would appreciate some testing from those of you that use RTF. It worked fine for the few RTF files I have.

I don't think I need metadata write support for RTF, I just want to avoid re-entering all the metadata I just fixed up. I'll try out the latest version and let you know how it does.

scotty1024 · 02-09-2007, 01:53 PM

After the upgrade... Macbook Pro Mac OS X 10.4.8...

Code:

scotty$ prs500 --log-packets ls /
1 Command Type: GetUSBProtocolVersion
00000000: 0000 0000 0100 0000 0000 0000 0400 0000    ................
00000010: 0000 0000                                  ....
--
2 Response Type: Response
00000000: 0010 0000 0100 0000 0000 0000 0c00 0000    ................
00000010: 0000 0000 0000 0000 0000 0000 0000 0000    ................
--
3 Answer d->h Type: USBProtocolVersion
00000000: 0500 0100 0000 0000 0000 0000 0800 0000    ................
00000010: 3031 3030 3030 3030                        01000000
--
4 Command Type: AcknowledgeBulkRead
00000000: 0010 0000 0000 0000 0000 0000 1000 0000    ................
00000010: 0500 0100 0000 0000 0000 0000 0000 0000    ................
--
5 Response Type: Response
00000000: 0010 0000 0000 0000 0000 0000 0c00 0000    ................
00000010: 0000 0000 0000 0000 0000 0000 0000 0000    ................
--
6 Command Type: SetBulkSize
00000000: 0701 0000 0100 0000 0000 0000 0400 0000    ................
00000010: 0080 0200                                  ....
--
7 Response Type: Response
00000000: 0010 0000 0100 0000 0000 0000 0c00 0000    ................
00000010: 0701 0000 0000 0000 0000 0000 0000 0000    ................
--
8 Command Type: UnlockDevice
00000000: 0601 0000 0100 0000 0000 0000 0400 0000    ................
00000010: 2d31 0000                                  -1..
--
9 Response Type: Response
00000000: 0010 0000 0100 0000 0000 0000 0c00 0000    ................
00000010: 0601 0000 0000 0000 0000 0000 0000 0000    ................
--
10 Command Type: SetTime
00000000: 0401 0000 0100 0000 0000 0000 1c00 0000    ................
00000010: 20fe ffff d707 0000 0200 0000 0900 0000     ...............
00000020: 1200 0000 3300 0000 0f00 0000              ....3.......
--
11 Response Type: Response
00000000: 0010 0000 0100 0000 0000 0000 0c00 0000    ................
00000010: 0401 0000 0000 0000 0000 0000 0000 0000    ................
--
12 Command Type: PathQuery
00000000: 1800 0000 0100 0000 0000 0000 0500 0000    ................
00000010: 0100 0000 2f                               ..../
--
13 Response Type: ListResponse
00000000: 0010 0000 0100 0000 0000 0000 0c00 0000    ................
00000010: 1800 0000 d6ff ffff 0000 0000 0000 0000    ................
--
14 Answer d->h Type: FileProperties
00000000: 0300 0100 0000 0000 0000 0000 1800 0000    ................
00000010: 0000 0000 0000 0000 0000 0000 0000 0000    ................
00000020: 0000 0000 0000 0000                        ........
--
15 Command Type: AcknowledgeBulkRead
00000000: 0010 0000 0000 0000 0000 0000 1000 0000    ................
00000010: 0300 0100 0000 0000 0000 0000 0000 0000    ................
--
16 Response Type: Response
00000000: 0010 0000 0000 0000 0000 0000 0c00 0000    ................
00000010: 1800 0000 d6ff ffff 0000 0000 0900 0000    ................
--
17 Command Type: EndSession
00000000: 0100 0000 0100 0000 0000 0000 0400 0000    ................
00000010: 0000 0000                                  ....
--
18 Response Type: Response
00000000: 0010 0000 0100 0000 0000 0000 0c00 0000    ................
00000010: 0100 0000 0000 0000 0000 0000 0000 0000    ................
--
 has an unknown error. Code: 0xffffffd6L

My prs500 FUSE filesystem is still working...

Hmm make that my regression tests were working. They evidently don't like a path query on / anymore. I like that nice clean file property they're returning now though.

NatCh · 02-09-2007, 02:08 PM

Good news! From discussions with them both at the Bloggers Day and the Book Festival in October, I'm not really surprised that they didn't lock you out, but it's good to have it confirmed, regardless.

kovidgoyal · 02-09-2007, 03:27 PM

Looks like they deny permission for ls, get requests for any path that doesn't begin with /Data. Doesn't break ebook transfer. And I suspect that you just have to unlock the rest via a new USB command. Unfortunately, I don't have the time right now.

scotty1024 · 02-09-2007, 03:38 PM

You are correct.

I was in the process of tweaking my code to have 3 directories (based on feed back from my wife):

Root
Internal
Card

I guess I'll just have two for now.

Reversing this will probably require disassembly of the Reader code since I sincerely doubt the Connect software ever needs to examine the root filesystem...

Alexander Turcic · 02-09-2007, 03:41 PM

Quote:

Originally Posted by scotty1024

Reversing this will probably require disassembly of the Reader code since I sincerely doubt the Connect software ever needs to examine the root filesystem...

Likewise you could log the USB communication of the updater tool to find out how they get around the limitation (perhaps kovidgoyal is right and they just use a new USB command).

kovidgoyal · 02-09-2007, 03:45 PM

I've updated libprs500 to 0.3.9 so that it correctly handles permission denied errors. I'll look into figuring out how to unlock it as soon as I get a little free time.

EDIT: Hmm we may have to wait for the next updater as this updater didn't need to unlock.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
KDK Reverse Engineering - For Those who Cannot wait...	DairyKnight	Kindle Developer's Corner	0	05-14-2010 12:29 AM
Reverse-engineering the .IMP format	nrapallo	IMP	23	02-12-2009 01:44 PM
Reverse engineering the Cybook hard-/software	srml	Gen3 Developer's Corner	8	07-07-2008 04:27 PM
PC sync protocol	dumky	Which one should I buy?	2	01-04-2008 01:33 PM
Introduction to Reverse Engineering Software	Colin Dunstan	Deals and Resources (No Self-Promotion or Affiliate Links)	0	05-25-2004 11:31 AM

01-28-2007, 04:19 AM	#121
Michael Pemulis Junior Member Posts: 3 Karma: 10 Join Date: Jan 2007 Device: Sony Reader	Hi, and thank you Kovid for all of this work! This question may have already been addressed in another form (I think maybe chrissam had a similar problem above) but I've installed everything and yet prs500 won't recognize my reader, at least not in any meaningful way--I assume this has something to do with the USB connect via OSX, since I get different errors when entering the command several times within a short span (though the errors are different from chrissam's)... I'm working on a new MacBook Core2duo if that helps anything. Here's the most common error message: Books in main memory: Traceback (most recent call last): File "/Library/Frameworks/Python.framework/Versions/Current/bin/prs500", line 8, in <module> load_entry_point('libprs500==0.3.6', 'console_scripts', 'prs500')() File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/cli/main.py", line 210, in main File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/communicate.py", line 167, in run_session File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/communicate.py", line 256, in open File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/communicate.py", line 317, in send_validated_command File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/communicate.py", line 301, in _send_command File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/prstypes.py", line 643, in __init__ libprs500.errors.PacketError: Response packets must have their number set to 0x1000 though this one pops up too: prs500 books prs500 booksBooks in main memory: Traceback (most recent call last): File "/Library/Frameworks/Python.framework/Versions/Current/bin/prs500", line 8, in <module> load_entry_point('libprs500==0.3.6', 'console_scripts', 'prs500')() File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/cli/main.py", line 210, in main File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/communicate.py", line 167, in run_session File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/communicate.py", line 268, in open File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/communicate.py", line 317, in send_validated_command File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/communicate.py", line 301, in _send_command File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/libprs500-0.3.6-py2.5.egg/libprs500/libusb.py", line 229, in control_msg libprs500.libusb.Error: Could not read 32 bytes on the control bus. Read: -60 bytes. Any suggestions? I've tried "hammering" the command over and over to get the USB to say something more interesting, but to no avail. I'm new to this so it might be totally easy and stupid, but: Any suggestions? Thanks! Mikey P.

01-28-2007, 11:44 AM	#122
kovidgoyal creator of calibre Posts: 45,604 Karma: 28548974 Join Date: Oct 2006 Location: Mumbai, India Device: Various	Hmm when you get this type of error, try reconnecting the reader. (Unplug and reconnect it). Also do you always get errors or are they intermittent?

01-28-2007, 04:35 PM	#123
Michael Pemulis Junior Member Posts: 3 Karma: 10 Join Date: Jan 2007 Device: Sony Reader	Yeah, I tried reconnecting it (in any number of comically hopeful/absurd ways), but it happens all the time. Do those errors mean that my mac's simply not even recognizing the reader at all, or is it something else?

01-28-2007, 07:24 PM	#124
kovidgoyal creator of calibre Posts: 45,604 Karma: 28548974 Join Date: Oct 2006 Location: Mumbai, India Device: Various	No its finding the reader, the reader is just not responding like it should. Can you try the commands with the --log-packets option.

01-28-2007, 09:54 PM	#125
Michael Pemulis Junior Member Posts: 3 Karma: 10 Join Date: Jan 2007 Device: Sony Reader	Thanks Kovid, I tried it with the --log-packets option, and it logged some packets, one of which mentioned unlocking the reader... which made me think to turnoff the screen-lock on the Reader (under Settings). Then it took a couple times to find the Reader, and then it worked. OK, now to embark on the gui...

01-29-2007, 01:19 PM	#126
kovidgoyal creator of calibre Posts: 45,604 Karma: 28548974 Join Date: Oct 2006 Location: Mumbai, India Device: Various	I've taken a look at the RTF spec and added support for reading RTF metadata in SVN. (There's an rtf-meta command). However, it's going to have problems with non-english characters. I've also decided not to implement write support for the metadata as RTF is a bloody mess and I don't feel like writing a full-fledged RTF parser. You don't really need metadata support as if you transfer files to the reader via the GUI, the GUI automatically sets the title and author. If however someone feels they really need RTF metadata write support, I encourage them to look at rtf.py and extend it. I would appreciate some testing from those of you that use RTF. It worked fine for the few RTF files I have.

02-09-2007, 02:08 PM	#131
NatCh Gizmologist Posts: 11,615 Karma: 929550 Join Date: Jan 2006 Location: Republic of Texas Embassy at Jackson, TN Device: Pocketbook Touch HD3	Good news! From discussions with them both at the Bloggers Day and the Book Festival in October, I'm not really surprised that they didn't lock you out, but it's good to have it confirmed, regardless.

02-09-2007, 03:27 PM	#132
kovidgoyal creator of calibre Posts: 45,604 Karma: 28548974 Join Date: Oct 2006 Location: Mumbai, India Device: Various	Looks like they deny permission for ls, get requests for any path that doesn't begin with /Data. Doesn't break ebook transfer. And I suspect that you just have to unlock the rest via a new USB command. Unfortunately, I don't have the time right now.

02-09-2007, 03:38 PM	#133
scotty1024 Banned Posts: 1,300 Karma: 1479 Join Date: Jul 2006 Location: Peoples Republic of Washington Device: Reader / iPhone / Librie / Kindle	You are correct. I was in the process of tweaking my code to have 3 directories (based on feed back from my wife): Root Internal Card I guess I'll just have two for now. Reversing this will probably require disassembly of the Reader code since I sincerely doubt the Connect software ever needs to examine the root filesystem...

02-09-2007, 03:45 PM	#135
kovidgoyal creator of calibre Posts: 45,604 Karma: 28548974 Join Date: Oct 2006 Location: Mumbai, India Device: Various	I've updated libprs500 to 0.3.9 so that it correctly handles permission denied errors. I'll look into figuring out how to unlock it as soon as I get a little free time. EDIT: Hmm we may have to wait for the next updater as this updater didn't need to unlock.