Adding Support for Verizon CR1000A

For Developers
36

image
image1100×2418 537 KB

some progress with decoding the logic analyzer dump

EDIT: here are labels for all the 11 traces, in case somebody finds it useful:

image
image802×1218 30 KB

and a piece of Swift code I used to find the correct permutation:

import Foundation
import Algorithms

let names = (0...7).map { "D\($0)" }
let files = try names.map { try Data(contentsOf: URL(filePath: "/Users/user/Downloads/\($0)_csd.bin")) }
let bits = files.map { Array($0.map { $0 == 0x1 }.dropFirst().prefix(512)) }

var permutations = Array(Array(names.enumerated()).permutations())

func checkPermutation(_ p: [(offset: Int, element: String)],
                      range: ClosedRange<Int>,
                      pattern: [UInt8]) -> Bool {
  var samples = [UInt8](repeating: 0x0, count: range.count)
  
  for index in range {
    for laneIndex in p.indices {
      let lane = p[laneIndex]
      let laneBit = UInt8(bits[lane.offset][index] ? 0x1 : 0x0)
      let shiftedBit = laneBit << UInt8(laneIndex)

      // this might need endianness swap when running on x86, I'm on M1 so I didn't bother
      samples[index - range.lowerBound] |= shiftedBit
    }
  }
  
  return samples == pattern
}

func narrow(range: ClosedRange<Int>, pattern: [UInt8]) {
  var newPermutations = type(of: permutations).init()

  for p in permutations {
    if checkPermutation(p, range: range, pattern: pattern) {
      newPermutations.append(p)
    }
  }

  permutations = newPermutations
}

narrow(range: 16...16, pattern: [0x09])
narrow(range: 17...17, pattern: [0x03])
narrow(range: 18...21, pattern: [0x00, 0x00, 0x76, 0x00])
narrow(range: 60...60, pattern: [0x0a])
narrow(range: 63...63, pattern: [0x01])
narrow(range: 130...130, pattern: [0x01])
narrow(range: 157...159, pattern: [0xd8, 0x01, 0x00])
narrow(range: 160...160, pattern: [0x07])
narrow(range: 166...166, pattern: [0x05])
narrow(range: 167...167, pattern: [0x1f])

for permutation in permutations {
  print(permutation.map { $0.element })
}

this relies on capturing 8x 513 byte data blocks sent after CMD8 (SEND_IF_COND): Send interface condition to card, and then taking values of Extended CSD Register from datasheet and putting them into the narrow function until you're left with a single permutation.

2 Likes