Invalid CSW signature provided by payload injectors.

[rdmrocha]

A lot of the current payload injectors support UF2 for flashing. UF2 exposes itself to machines as a FAT filesystem but they are currently not supported by libusbhsfs. As far as my reasearch went, it appears that UF2 implementations expose this fake FS via FAT16 MSC. How hard would it be to implement support for such filesystems? Maybe using some POC code like https://github.com/MightyPork/fat16?

This way we can tap into homebrews that update our payload injectors by simply getting them into UF2 mode and flash them straight from the Switch itself.

Thanks

[DarkMatterCore]

If you can get me a Wireshark USB packet dump from one of these payload injectors, I should be able to implement UF2 support myself.

Back when I started this project, the only payload injector I had was a RCMloader One, which does expose itself as a UMS device with a FAT12 partition.

[rdmrocha]

I'll plug it into my Mac today and will try to provide you with such capture. Thanks for the fast reply

[DarkMatterCore]

@rdmrocha Always a pleasure. I'll be waiting for it. :)

[rdmrocha]

Here's the capture straight from Wireshark+MacOS Monterey
It's a Trinket M0 based device with UF2. Plugged into USB, started the capture, hit the reset switch twice on the TRINKET so it enters in the UF2 mode. I can also capture copying a from FROM and TO the device if needed.

Thanks

entering_uf2_mode.pcapng.zip

[rdmrocha]

This attachment contains 4 different captures taken on Ubuntu 21.04:

• connecting the device into the USB port
• mounting the device
• copying a file from the device
• copying a file to the device (since this is a flasher filesystem, copying the file will ultimately result in an attended device reboot and disconnect from usb)

Hope it helps
ubuntu_captures.zip

[DarkMatterCore]

@rdmrocha Please run this NRO on your Switch and use your payload injector. Send me the logfile afterwards (it should be located on the SD card root).

libusbhsfs-example.zip

[rdmrocha]

@DarkMatterCore
Ran the app (23:59:32)
waited around 5 seconds, plugged the device in (nothing on the log)
waited another ~10 seconds, reseted the device into UF2 mode (23:59:47)
waited ~10 seconds, reseted the device (nothing on the log)
waited another ~10 seconds, reseted the device into UF2 mode (00:00:07)

Hope the timings and repetitions help
libusbhsfs.log

[DarkMatterCore]

@rdmrocha Excellent, thanks. Please test this new NRO and send me the logfile. Let me know how it goes.

libusbhsfs-example.zip

[DarkMatterCore]

@rdmrocha Yeah, my thoughts exactly. There's no temporary branch yet, but feel free to use this patch - just apply it to the latest commit.

diff --git a/example/Makefile b/example/Makefile
index 8ac8c74..51366b6 100644
--- a/example/Makefile
+++ b/example/Makefile
@@ -67,7 +67,7 @@ ASFLAGS		:=	-g $(ARCH)
 LDFLAGS		=	-specs=$(DEVKITPRO)/libnx/switch.specs -g $(ARCH) -Wl,-Map,$(notdir $*.map)
 
 # Use -lusbhsfsd instead of -lusbhsfs to use the library build with debug logging enabled
-LIBS		:=	-lusbhsfs
+LIBS		:=	-lusbhsfsd
 
 ifeq ($(filter $(MAKECMDGOALS),clean),)
     # Check BUILD_TYPE flag
diff --git a/source/usbhsfs_scsi.c b/source/usbhsfs_scsi.c
index 5ae3c8a..7e1dfee 100644
--- a/source/usbhsfs_scsi.c
+++ b/source/usbhsfs_scsi.c
@@ -985,7 +985,7 @@ static bool usbHsFsScsiTransferCommand(UsbHsFsDriveContext *drive_ctx, ScsiComma
             if (receive && rest_size == sizeof(ScsiCommandStatusWrapper))
             {
                 memcpy(&csw, xfer_buf, sizeof(ScsiCommandStatusWrapper));
-                if (csw.dCSWSignature == __builtin_bswap32(SCSI_CSW_SIGNATURE) && csw.dCSWTag == cbw->dCBWTag)
+                if ((csw.dCSWSignature == SCSI_CSW_SIGNATURE || csw.dCSWSignature == __builtin_bswap32(SCSI_CSW_SIGNATURE)) && csw.dCSWTag == cbw->dCBWTag)
                 {
                     USBHSFS_LOG_DATA(&csw, sizeof(ScsiCommandStatusWrapper), "Data from unexpected CSW (interface %d, LUN %u):", drive_ctx->usb_if_id, cbw->bCBWLUN);
                     
@@ -1150,7 +1150,7 @@ static bool usbHsFsScsiReceiveCommandStatusWrapper(UsbHsFsDriveContext *drive_ct
     USBHSFS_LOG_DATA(csw, sizeof(ScsiCommandStatusWrapper), "Data from received CSW (interface %d, LUN %u):", drive_ctx->usb_if_id, cbw->bCBWLUN);
     
     /* Check CSW signature. */
-    if (csw->dCSWSignature != __builtin_bswap32(SCSI_CSW_SIGNATURE))
+    if (csw->dCSWSignature != SCSI_CSW_SIGNATURE && csw->dCSWSignature != __builtin_bswap32(SCSI_CSW_SIGNATURE))
     {
         USBHSFS_LOG_MSG("Invalid CSW signature! (0x%08X) (interface %d, LUN %u).", __builtin_bswap32(csw->dCSWSignature), drive_ctx->usb_if_id, cbw->bCBWLUN);
         goto end;

[rdmrocha]

Thanks a lot. I'll give it a shot and will report back.

[DarkMatterCore]

Always a pleasure. I'll be waiting. :)

[rdmrocha]

My code is crappy but I have working POC that can successfully update the dongle. Thanks for the awesome help!

[DarkMatterCore]

Glad to know it worked. Always a pleasure!

Feel free to let me know if you end up publishing your work to a new repository. I may be able to lend you a hand to polish your current code.

In the meantime, I'm just gonna release a new version.

[DarkMatterCore]

https://github.com/DarkMatterCore/libusbhsfs/releases/tag/v0.2.6

Done! I'll lock this conversation and mark it as resolved. Feel free to open a new discussion/issue if needed.