[Hardware Hacking General] saperski:
I need help to identify USB interfaces of MSM8905 (Snapdragon 205) device (Nokia 8110 4G) running KaiOS (Boot 2 Gecko aka FirefoxOS clone, uses many Android features such as ADB).

Here are the interfaces I have found so far, details follow:

Vendor:Product 0x18d1:d001 - adb sideload

Vendor:Product 0x05c6:0xf003 - MTP storage access

Vendor:Product 0x05c6:0xf00e - USB tethering

Vendor:Product 0x05c6:0x9092 - generic interface

adb sideload from recovery

I managed to switch the device to the Recovery mode (middle key up + power, then again power) - no ADB interface present, but there is an "Apply update from ADB" option and after this it presents this interface:

ugen7.2: <QUALCOMM Nokia 8110 4G> at usbus7, cfg=0 md=HOST spd=HIGH (480Mbps) pwr=ON (500mA)

bLength = 0x0012
bDescriptorType = 0x0001
bcdUSB = 0x0200
bDeviceClass = 0x0000 <Probed by interface class>
bDeviceSubClass = 0x0000
bDeviceProtocol = 0x0000
bMaxPacketSize0 = 0x0040
idVendor = 0x18d1
idProduct = 0xd001
bcdDevice = 0x0310
iManufacturer = 0x0001 <QUALCOMM>
iProduct = 0x0002 <Nokia 8110 4G>
iSerialNumber = 0x0003 <99887766>
bNumConfigurations = 0x0001

Configuration index 0

bLength = 0x0009
bDescriptorType = 0x0002
wTotalLength = 0x0020
bNumInterfaces = 0x0001
bConfigurationValue = 0x0001
iConfiguration = 0x0000 <no string>
bmAttributes = 0x0080
bMaxPower = 0x00fa

Interface 0
bLength = 0x0009
bDescriptorType = 0x0004
bInterfaceNumber = 0x0000
bAlternateSetting = 0x0000
bNumEndpoints = 0x0002
bInterfaceClass = 0x00ff <Vendor specific>
bInterfaceSubClass = 0x0042
bInterfaceProtocol = 0x0001
iInterface = 0x0004 <ADB Interface>

Endpoint 0
bLength = 0x0007
bDescriptorType = 0x0005
bEndpointAddress = 0x0001 <OUT>
bmAttributes = 0x0002 <BULK>
wMaxPacketSize = 0x0200
bInterval = 0x0000
bRefresh = 0x0000
bSynchAddress = 0x0000

Endpoint 1
bLength = 0x0007
bDescriptorType = 0x0005
bEndpointAddress = 0x0081 <IN>
bmAttributes = 0x0002 <BULK>
wMaxPacketSize = 0x0200
bInterval = 0x0000
bRefresh = 0x0000
bSynchAddress = 0x0000

Indeed, adb seems to see the device.

Unfortunately, I cannot seem to be able to switch to the fastboot interface (this seems to be possible on a very similar Reliance JioPhone) - there is no option in the recovery menu to do this and other middle buttons do not seem to work as expected.

MTP storage interface

When switching USB storage access one gets MTP device like this:

bLength = 0x0012
bDescriptorType = 0x0001
bcdUSB = 0x0200
bDeviceClass = 0x0000 <Probed by interface class>
bDeviceSubClass = 0x0000
bDeviceProtocol = 0x0000
bMaxPacketSize0 = 0x0040
idVendor = 0x05c6
idProduct = 0xf003
bcdDevice = 0x0310
iManufacturer = 0x0001 <Android>
iProduct = 0x0002 <Android>
iSerialNumber = 0x0003 <99887766>
bNumConfigurations = 0x0001

Configuration index 0

bLength = 0x0009
bDescriptorType = 0x0002
wTotalLength = 0x0027
bNumInterfaces = 0x0001
bConfigurationValue = 0x0001
iConfiguration = 0x0000 <no string>
bmAttributes = 0x0080
bMaxPower = 0x00fa

Interface 0
bLength = 0x0009
bDescriptorType = 0x0004
bInterfaceNumber = 0x0000
bAlternateSetting = 0x0000
bNumEndpoints = 0x0003
bInterfaceClass = 0x00ff <Vendor specific>
bInterfaceSubClass = 0x00ff
bInterfaceProtocol = 0x0000
iInterface = 0x0006 <MTP>

Endpoint 0
bLength = 0x0007
bDescriptorType = 0x0005
bEndpointAddress = 0x0081 <IN>
bmAttributes = 0x0002 <BULK>
wMaxPacketSize = 0x0200
bInterval = 0x0000
bRefresh = 0x0000
bSynchAddress = 0x0000

Endpoint 1
bLength = 0x0007
bDescriptorType = 0x0005
bEndpointAddress = 0x0001 <OUT>
bmAttributes = 0x0002 <BULK>
wMaxPacketSize = 0x0200
bInterval = 0x0000
bRefresh = 0x0000
bSynchAddress = 0x0000

Endpoint 2
bLength = 0x0007
bDescriptorType = 0x0005
bEndpointAddress = 0x0082 <IN>
bmAttributes = 0x0003 <INTERRUPT>
wMaxPacketSize = 0x001c
bInterval = 0x0006
bRefresh = 0x0000
bSynchAddress = 0x0000

This appears to work as a expected.

USB tethering interface

When switching USB tethering on

ugen7.2: <Android Android> at usbus7, cfg=0 md=HOST spd=HIGH (480Mbps) pwr=ON (500mA)

bLength = 0x0012
bDescriptorType = 0x0001
bcdUSB = 0x0200
bDeviceClass = 0x0000 <Probed by interface class>
bDeviceSubClass = 0x0000
bDeviceProtocol = 0x0000
bMaxPacketSize0 = 0x0040
idVendor = 0x05c6
idProduct = 0xf00e
bcdDevice = 0x0310
iManufacturer = 0x0001 <Android>
iProduct = 0x0002 <Android>
iSerialNumber = 0x0003 <99887766>
bNumConfigurations = 0x0001

Configuration index 0

bLength = 0x0009
bDescriptorType = 0x0002
wTotalLength = 0x004b
bNumInterfaces = 0x0002
bConfigurationValue = 0x0001
iConfiguration = 0x0000 <no string>
bmAttributes = 0x0080
bMaxPower = 0x00fa

Additional Descriptor

bLength = 0x08
bDescriptorType = 0x0b
bDescriptorSubType = 0x00
RAW dump:
0x00 | 0x08, 0x0b, 0x00, 0x02, 0xe0, 0x01, 0x03, 0x08

Interface 0
bLength = 0x0009
bDescriptorType = 0x0004
bInterfaceNumber = 0x0000
bAlternateSetting = 0x0000
bNumEndpoints = 0x0001
bInterfaceClass = 0x00e0 <Wireless controller>
bInterfaceSubClass = 0x0001
bInterfaceProtocol = 0x0003
iInterface = 0x0006 <RNDIS Communications Control>

Additional Descriptor

bLength = 0x05
bDescriptorType = 0x24
bDescriptorSubType = 0x00
RAW dump:
0x00 | 0x05, 0x24, 0x00, 0x10, 0x01

Additional Descriptor

bLength = 0x05
bDescriptorType = 0x24
bDescriptorSubType = 0x01
RAW dump:
0x00 | 0x05, 0x24, 0x01, 0x00, 0x01

Additional Descriptor

bLength = 0x04
bDescriptorType = 0x24
bDescriptorSubType = 0x02
RAW dump:
0x00 | 0x04, 0x24, 0x02, 0x00

Additional Descriptor

bLength = 0x05
bDescriptorType = 0x24
bDescriptorSubType = 0x06
RAW dump:
0x00 | 0x05, 0x24, 0x06, 0x00, 0x01

Endpoint 0
bLength = 0x0007
bDescriptorType = 0x0005
bEndpointAddress = 0x0082 <IN>
bmAttributes = 0x0003 <INTERRUPT>
wMaxPacketSize = 0x0008
bInterval = 0x0009
bRefresh = 0x0000
bSynchAddress = 0x0000

Interface 1
bLength = 0x0009
bDescriptorType = 0x0004
bInterfaceNumber = 0x0001
bAlternateSetting = 0x0000
bNumEndpoints = 0x0002
bInterfaceClass = 0x000a <CDC-data>
bInterfaceSubClass = 0x0000
bInterfaceProtocol = 0x0000
iInterface = 0x0007 <RNDIS Ethernet Data>

Endpoint 0
bLength = 0x0007
bDescriptorType = 0x0005
bEndpointAddress = 0x0081 <IN>
bmAttributes = 0x0002 <BULK>
wMaxPacketSize = 0x0200
bInterval = 0x0000
bRefresh = 0x0000
bSynchAddress = 0x0000

Endpoint 1
bLength = 0x0007
bDescriptorType = 0x0005
bEndpointAddress = 0x0001 <OUT>
bmAttributes = 0x0002 <BULK>
wMaxPacketSize = 0x0200
bInterval = 0x0000
bRefresh = 0x0000
bSynchAddress = 0x0000

One of those interfaces gets detected as the RNDIS interfaces and gives me Ethernet.

Default interfaces

If neither tethering not storage is enabled, the device presents itself as a set of 3 interfaces:

ugen7.2: <Android Android> at usbus7, cfg=0 md=HOST spd=HIGH (480Mbps) pwr=ON

bLength = 0x0012
bDescriptorType = 0x0001
bcdUSB = 0x0200
bDeviceClass = 0x0000 <Probed by interface class>
bDeviceSubClass = 0x0000
bDeviceProtocol = 0x0000
bMaxPacketSize0 = 0x0040
idVendor = 0x05c6
idProduct = 0x9092
bcdDevice = 0x0310
iManufacturer = 0x0001 <Android>
iProduct = 0x0002 <Android>
iSerialNumber = 0x0003 <99887766>
bNumConfigurations = 0x0001

Configuration index 0

bLength = 0x0009
bDescriptorType = 0x0002
wTotalLength = 0x006f
bNumInterfaces = 0x0003
bConfigurationValue = 0x0001
iConfiguration = 0x0000 <no string>
bmAttributes = 0x0080
bMaxPower = 0x00fa

Interface 0
bLength = 0x0009
bDescriptorType = 0x0004
bInterfaceNumber = 0x0000
bAlternateSetting = 0x0000
bNumEndpoints = 0x0002
bInterfaceClass = 0x00ff <Vendor specific>
bInterfaceSubClass = 0x00ff
bInterfaceProtocol = 0x00ff
iInterface = 0x0000 <no string>

Endpoint 0
bLength = 0x0007
bDescriptorType = 0x0005
bEndpointAddress = 0x0081 <IN>
bmAttributes = 0x0002 <BULK>
wMaxPacketSize = 0x0200
bInterval = 0x0000
bRefresh = 0x0000
bSynchAddress = 0x0000

Endpoint 1
bLength = 0x0007
bDescriptorType = 0x0005
bEndpointAddress = 0x0001 <OUT>
bmAttributes = 0x0002 <BULK>
wMaxPacketSize = 0x0200
bInterval = 0x0000
bRefresh = 0x0000
bSynchAddress = 0x0000

Interface 1
bLength = 0x0009
bDescriptorType = 0x0004
bInterfaceNumber = 0x0001
bAlternateSetting = 0x0000
bNumEndpoints = 0x0003
bInterfaceClass = 0x00ff <Vendor specific>
bInterfaceSubClass = 0x0000
bInterfaceProtocol = 0x0000
iInterface = 0x0000 <no string>

Additional Descriptor

bLength = 0x05
bDescriptorType = 0x24
bDescriptorSubType = 0x00
RAW dump:
0x00 | 0x05, 0x24, 0x00, 0x10, 0x01

Additional Descriptor

bLength = 0x05
bDescriptorType = 0x24
bDescriptorSubType = 0x01
RAW dump:
0x00 | 0x05, 0x24, 0x01, 0x00, 0x00

Additional Descriptor

bLength = 0x04
bDescriptorType = 0x24
bDescriptorSubType = 0x02
RAW dump:
0x00 | 0x04, 0x24, 0x02, 0x02

Additional Descriptor

bLength = 0x05
bDescriptorType = 0x24
bDescriptorSubType = 0x06
RAW dump:
0x00 | 0x05, 0x24, 0x06, 0x00, 0x00

Endpoint 0
bLength = 0x0007
bDescriptorType = 0x0005
bEndpointAddress = 0x0083 <IN>
bmAttributes = 0x0003 <INTERRUPT>
wMaxPacketSize = 0x000a
bInterval = 0x0009
bRefresh = 0x0000
bSynchAddress = 0x0000

Endpoint 1
bLength = 0x0007
bDescriptorType = 0x0005
bEndpointAddress = 0x0082 <IN>
bmAttributes = 0x0002 <BULK>
wMaxPacketSize = 0x0200
bInterval = 0x0000
bRefresh = 0x0000
bSynchAddress = 0x0000

Endpoint 2
bLength = 0x0007
bDescriptorType = 0x0005
bEndpointAddress = 0x0002 <OUT>
bmAttributes = 0x0002 <BULK>
wMaxPacketSize = 0x0200
bInterval = 0x0000
bRefresh = 0x0000
bSynchAddress = 0x0000

Interface 2
bLength = 0x0009
bDescriptorType = 0x0004
bInterfaceNumber = 0x0002
bAlternateSetting = 0x0000
bNumEndpoints = 0x0003
bInterfaceClass = 0x00ff <Vendor specific>
bInterfaceSubClass = 0x00ff
bInterfaceProtocol = 0x00ff
iInterface = 0x0000 <no string>

Endpoint 0
bLength = 0x0007
bDescriptorType = 0x0005
bEndpointAddress = 0x0085 <IN>
bmAttributes = 0x0003 <INTERRUPT>
wMaxPacketSize = 0x0008
bInterval = 0x0009
bRefresh = 0x0000
bSynchAddress = 0x0000

Endpoint 1
bLength = 0x0007
bDescriptorType = 0x0005
bEndpointAddress = 0x0084 <IN>
bmAttributes = 0x0002 <BULK>
wMaxPacketSize = 0x0200
bInterval = 0x0000
bRefresh = 0x0000
bSynchAddress = 0x0000

Endpoint 2
bLength = 0x0007
bDescriptorType = 0x0005
bEndpointAddress = 0x0003 <OUT>
bmAttributes = 0x0002 <BULK>
wMaxPacketSize = 0x0200
bInterval = 0x0000
bRefresh = 0x0000
bSynchAddress = 0x0000

Those look like proprietary interfaces. I have hacked adb to force it to talk to those endpoints with its protocol, but there is no reply after two initial packets.

I have been reading excellent posts from like MSM8960 Info, Architecture and Bootloader(s) by [MENTION=4372730]E:V:A[/MENTION] and [R&D][QUALCOMM] Using QDL, EHostDL and DIAG interfaces & feature by [MENTION=2663515]SouL Shadow[/MENTION] and I suspect those are proprietary interfaces used by QPST.

My questions:

Are those product:vendor numbers something new?

Are my guesses correct? If yes, which interface should I try poke with HDLC packets?