A mildly annoying trend over recent years has been for USB hardware devices to expose a CD-ROM drive containing their drivers for Windows users. Of course there’s no real CD in there, instead the software lives on a piece of flash memory. It’s usually not a problem as they also appear on the USB bus as their true calling, but not always.
[Martijn Braam] found himself the lucky owner of a USB network adapter which seemed to see its only purpose in life to be such a drive, and since he wasn’t anxious to make another piece of e-waste, he broke it open to see if the fake CD drive could be disabled.
Inside the flimsy case he found a CoreChips SR9700 Ethernet controller, a chip for which there seems to be very little data in the wild. On the underside of the PCB was a flash chip, and as expected disabling this caused the CD drive to disappear to be replaced by the expected network card.
It’s a simple but useful hack, but there’s a little bonus for those unaware in the write-up. There’s a piece of software called USB_modeswitch that can perform this task on many cards, which is worth storing away in the event that it’s needed.
If you’re using Linux, I’d recommend trying “usb_modeswitch”. This is a common tactic for USB WiFi adapters (which I found out the hard way) to include their Windows (and rubbish Linux) drivers without adding a driver disc. This software kicks the device in such a way that it switches back to its other mode, that of being a network interface.
However, the technique of just taking said flash chip off entirely is far more reliable, and works on every platform.
Though I’m curious whether it works for every USB network device. Due to the odd setup of the house I currently live in, I went through about three USB WiFi devices, and had to take them out of their plastic housing, hoping to keep them cooler. I didn’t notice any flash chips on any of these WiFi devices. Maybe I need to check part numbers again.
I had to use USB_modeswitch to get a Realtek USB wireless adapter working, bit of a pain.
Some devices also use the flash to store their firmware. Often there is a default firmware in rom but it will be an older version.
I recall trying to use USB modeswitch years ago, with a phone that would only behave like a CD-ROM drive, making it impossible to copy files to or from the internal storage. I don’t remember getting anywhere with it.
Now that is a hack I’d love to see.
The storage that mobiles provide to pc is infuriatingly unaddressable especially when trying to sync music, for which I’ve happily defaulted to adb.exe to achieve file transfer.
Perhaps I’m better off
The author of the hack mentions in his article that usb_modeswitch didn’t work with this particular chip. The correct way to handle it would be reverse engineering the communication between the Windows driver and the device, then patching usb_modeswitch. But just disabling the SPI flash chip is a quick and easy hack.
I’m working as IT Support in company and we recently install HP 4103 Printer. For some reason Windows 10 detect them as USB Media Player and our antivirus blocks it’s. It’s still showing as Media Player in Devices and Printers but HP setup didn’t detect it. The only solution is to remove it from Devices and Printers and unplug the USB cable and replug. Then only HP setup detect it.
Does it have an SD card reader on it or USB reader on it even? If so, that’s why.
Would these chips have the image written to them before assembly or is there a way to write to the flash ?
They’re written and can be updated in situ on at least some devices.
I’m confused. If the USB devices aren’t working along the flash module doing CD-ROM simulation in first place, then why they are even made/sold?
The prototype didn’t magically build itself without any doing, after all.
A person must have been designing and testing the USB device before it reached serial production.
That whole scenario makes no sense to me,
unless we’re talking about a bug/ software limitation on the PC side. Like Linux.
So disabling the flash makes the important USB device component visible,
which means it’s a workaround for a faulty OS?
Yes, the driver on the CD-ROM that probably only runs on some outdated version on Windows will execute a command to enable actual USB-Ethernet functionality. The USB-Ethernet part will follow some common interface such as RNDIS or CDC-ECM.
It may be possible to do the same on modern Linux using usb-modeswitch. Modern Windows and Mac may be out of luck if the manufacturer hasn’t released updated drivers for them.
Now I understand, thank you very much for the explanation! 😃👍
They most likely use some “clever” hack to determine if the connected pc has the needed driver, and if not show the “cdrom”.
A better approach would be to always expose both devices, or always Ethernet and “be clever” for the CD.
Such clever hacks seem to inevitable give rise/need for clever antihacks, such as USB modeswich…
There really should be a better way to define and handle drivers and device identification.
Can confirm what One says … When I worked on the blackberry X device that’s how it worked
* Driver is installed? Perfect. Driver does the necessary handshake to kick the device into rndis mode
* Driver is not installed? K, you get the n00b drive.
IIRC, the handshake contents are up to driver/device manufacturers. Some have used remote keyservers to sign the handshake message upon driver init, which introduced ‘always online’ requirements to plug your device into your PC.
*Interesting* stuff, for sure, but definitely not a particularly good UX – although, better in a lot of ways than what came before (in terms of convenience and accessibility). The desire to completely lock users out of their own devices was definitely in full swing, a poor attempt at retaining control over users’ data.
A simple, yet satisfying fix.
I’ve never seen this. I do like the idea of hardware containing it’s own driver. Though not as much as I like the idea of hardware presenting a standard interface to the computer that works with a generic driver… as if manufacturers would actually do that…
Well, anyway…
Do these things really present as CDROM drives? Is it the CD-ROM icon that Windows shows you, not the USB stick one? I would have expected them to be more like a USB memory stick. Why pretend to be spinny mechanical stuff? It seems like that would be more complicated as well as more confusing to the end user who probably sees the similarity between that USB ethernet dongle and a USB memory stick but increasingly may have been born too late to really feel familiar with a CDROM. (Yes, I feel old too, deal with it) And certainly everything needed to be a USB-memory stick has been implemented a million times on a chip already. It’s not like every factory is popping out USB connected CDROM drives these days and hardly anyone is making a USB memory stick.
I don’t get it.
Well CD-ROM is a ROM memory.
Presenting to the OS as a flash drive would mean that the memory has to be writable…
That’s a good point and sone security policies might not allow… Or report you for plugging in something that identified itself as a flash drive.
My memory is that the convention of pretending to be CD drive rather than a flash drive is based on how autorun is/was handled with default windows settings some years back; with CD drives being somewhat more likely to have autorun honored(since, in The Before Times, an autorun.inf on CD meant that you were at least dealing with someone who had a CD pressing budget; while autorun on writeable media could be anybody and probably was).
I think that has been tightened up gradually, so the old vision of having your lousy driver install utility get EZ-launched on insertion isn’t really there anymore; but it seems to have been retained; if only to make it easier to distinguish the driver virtual storage device from any actual flash drives plugged in.
Ah, nice! That makes sense.
I’m still very surprised that if this is so common I haven’t seen it. Is it possible that I have devices that do this but Linux recognizes them for what they are and switches their mode automatically so I never even notice? Would that be something built into stock UDEV rules or something like that?
Those devices were common in the times of Windows 2000/XP – so not very common any more. I had to deal with a ton of PCMCIA cards acting like this. Most of the UMTS and/or UMTS/WIFI combo cards manufactured by Option (google pictures of: OPTION GT 3G+ EMEA UMTS-Karte PCMCIA) had this crap enabled. The whole concept is sort of stupid (outdated drivers, limited OS support etc.) except for one scenario: You have a UMTS modem (or WIFI/LAN) card which is supposed to connect you to the internet but you have no internet to download the driver. But this scenario is valid only if you have a device that has no other LAN/WAN adapter at all. Think of laptops with no such device onboard delivered with Windows XP pre-installed. You find them right next to the dino-bones…
It emulates a CD-ROM drive as to make m Windows read AUTORUN.INF and open a dialog (or automatically start a program back in the day) for the user to take an action.
It’s also a simple way of indicating it is a read-only file system and ISO 9660 is/was guaranteed to be implemented in every OS out there.
autorun was a file written to the cd rom itself it was not stored in the firmware of the device
My guess would be that it’s showing up as a USB Mass Storage Class device, with a CD ROM subclass. How very quaint. How the OS responds to the subclass is implementation dependent, some details on Windows here:
https://learn.microsoft.com/en-us/windows-hardware/drivers/install/identifiers-generated-by-usbstor-sys
The only such device I’ve run into was the Motorola Droid 2 smartphone. Plug it in and up pops a small USB drive with the Windows software installer. Run that and you’re connected to the phone’s internal memory and SD card.
Not having class drivers for USB mass storage and many other devices is a thing I don’t miss about Windows 98. There are a couple of ports/packages of Windows Me USB drivers for 98SE and one for 98 First Edition. Makes things so much easier when it doesn’t need a driver installed for every single USB stick and many other devices.
Dunno why Microsoft repeated with USB the method they’d done with PCMCIA cards for DOS and Windows 3.x.
There was the base support, Card and Socket Services to handle the controller and ISA or PCI (For CardBus) interface. Then there were Class Drivers that worked with many devices of the same type that used the same protocol etc, like flash or DRAM cards. Lastly there were Point Drivers which handled a single device like a sound card or Zoomed Video card.
Loading more than 2 or 3 drivers for PC Cards was quite a tricky business, especially with all the other hardware that needed DOS drivers, since it couldn’t do dynamic loading of PC Card device drivers.
Windows 95 fixed that mess and it was good. One could have a dozen PC Cards and swap them in and out with no problems.
Then Windows 95OSR2 + USB addon went right back to the old base+class+point model, but with very few class type drivers capable of operating more than a single device.
Since Windows Me Microsoft has been stuffing more and more USB device support into the drivers included with Windows. Performance of devices that manufacturers elect to let Microsoft take care of tends to vary.
My Huawei P20 Pro and P30 Pro both did the same thing. Plug them into USB, and they appear as a CD-ROM drive with the Huawei Windows software. Enable mass storage device access from the phone, and the internal flash appears as a mass storage device, in addition to the software CD-ROM. (I never installed the software on the PC.)
I don’t like how this device apparently needs to modeswitch to actually work, but I like having certain things with the ability to masquerade as a cd-rom. “U2F” drives used that trick, and it was hackable to let you have bootable iso’s entirely isolated from the exposed files on the drive. It’d show a second device at the exact same time which would be recognized by even an older bios as a bootable CD. It was helpful a few times troubleshooting things. For awhile, windows computers would also be willing to autorun things only from a CD but not from a flash drive, so that was neat to repurpose.
s/U2F/U3
I still have an “U3” usb drive i bought decades ago that does the whole usb-stick-cd-drive thing slightly better, installed some firmware on it that just combines the partitions into one and lets me plop an iso on the usb drive for the cd drive to start appearing, still a VERY valuable tool.
I still love reading these articles even tho my knowledge has been left in the dust. I used to love and know ahoy things. LoL
I bought a WIFI+BT combo adapter from aliexpress. It has the Realtek RTL8851BU and also presents itself as a cd-rom drive when first connected. Ejecting the drive will make it change to it’s intended purpose.
I scanned the setup files on Hybrid Analysis and they came back as malware (they aren’t even signed and give the yellow ribbon in UAC), both the one inside the adapter and a different one on a real cd that came with with the adapter.
Installing the drivers manually through device manager works and the device works fine, the problem is that it doesn’t do the switch automatically from the CD-ROM mode. I’m guessing that the setup file installs something special that does this but i’m not going to gamble on installing malware on my computer.
I tried disabling the flash IC by lifting the VCC leg but it was still showing as a CD-ROM drive and presenting me the drivers (i double checked the schematic for my chip and traced the pad with a multimeter and it was indeed VCC).
I ended up removing the chip completely and now i have a brick. The adapter still presents itself as a mass storage device but after trying to mount itself for 10 seconds, it fails and shows a warning sign on device manage. I have no way now of switching modes and stupid me thought he wasn’t going to use the chip anymore so i threw it away and can’t find it anymore.
Don’t disable the flash chip on realtek devices, it doesn’t help.