I have this tablet to learn to draw with, but it is currently unusable as the drivers do not work. So, in the process of learning what I need to re Linux USB HID drivers, this repo contains the information I have discovered about this device.
$ lsusb|grep -i huion
Bus 001 Device 065: ID 256c:006d HUION Huion Tablet_HS610If you have a device with the same VID:PID as above, can you open an issue here with the details of the device?
On flashing the device under a Windows VM, you are prompted to press buttons 1 and 5 on the device as you plug it in, this puts the device into a new mode for flashing.
I flashed to the latest version, it all seemed a bit weird the way it worked, but the following is the version I have, I don't know if it's the same as it was before, as according to the HUION website.
This prompted me to do the same on Linux and see what lsusb produced, interestingly, it gave the following:
$ lsusb
Bus 001 Device 041: ID 28e9:0189 GDMicroelectronics GD32 DFU Bootloader (Longan Nano)The output of dmesg shows this on adding the device in flash mode:
[ +4.934932] usb 1-4.4: USB disconnect, device number 45
[ +4.517608] usb 1-4.4: new full-speed USB device number 46 using ehci-pci
[ +0.292254] usb 1-4.4: New USB device found, idVendor=28e9, idProduct=0189, bcdDevice= 1.00
[ +0.000006] usb 1-4.4: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ +0.000002] usb 1-4.4: Product: GD32 USB DFU in FS Mode
[ +0.000002] usb 1-4.4: Manufacturer: GigaDevice
[ +0.000001] usb 1-4.4: SerialNumber: 䌵䜸If you cannot read the SerialNumber, that's because they are CJK characters, I don't know what that translates to, Google was useless here.
I don't know what it means by FS mode, unless it means the extensions added by ST Micro-Electronics in DfuSe?
# lsusb -v -d 28e9:0189
Bus 001 Device 048: ID 28e9:0189 GDMicroelectronics GD32 DFU Bootloader (Longan Nano)
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x28e9 GDMicroelectronics
idProduct 0x0189 GD32 DFU Bootloader (Longan Nano)
bcdDevice 1.00
iManufacturer 1 GigaDevice
iProduct 2 GD32 USB DFU in FS Mode
iSerial 3 䌵䜸
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x001b
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 0
bInterfaceClass 254 Application Specific Interface
bInterfaceSubClass 1 Device Firmware Update
bInterfaceProtocol 2
iInterface 0
Device Firmware Upgrade Interface Descriptor:
bLength 9
bDescriptorType 33
bmAttributes 11
Will Detach
Manifestation Intolerant
Upload Supported
Download Supported
wDetachTimeout 255 milliseconds
wTransferSize 2048 bytes
bcdDFUVersion 1.1a
can't get device qualifier: Resource temporarily unavailable
can't get debug descriptor: Resource temporarily unavailable
Device Status: 0x0002
(Bus Powered)
Remote Wakeup EnabledThe USB descriptor above shows the DFU version to be 1.1a, which matches that of the DfuSe, as there is no USB DFU 1.1a document that I can find.
As I now know the chip in use her, this sent me looking for information on it, there are many by this company and I originally thought it was a RISC-V, as the dfu-util from gd32-utils shows:
$ ~/opt/gd32-dfu-utils/bin/dfu-util -l
dfu-util 0.9
Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2016 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/
Found Runtime: [0a5c:21e8] ver=0112, devnum=18, cfg=1, intf=3, path="1-2.3", alt=0, name="UNKNOWN", serial="5CF37093A853"
Found DFU: [28e9:0189] ver=0100, devnum=43, cfg=1, intf=0, path="1-4.4", alt=0, name="UNKNOWN", serial="5C8GNGN"
Found Runtime: [1235:800a] ver=0125, devnum=2, cfg=1, intf=5, path="8-1", alt=0, name="Scarlett 2i4 USB-DFU", serial="UNKNOWN"
Found Runtime: [1235:800a] ver=0125, devnum=2, cfg=1, intf=5, path="8-1", alt=0, name="Scarlett 2i4 USB-DFU", serial="UNKNOWN"The other two devices were also interesting to find, the last two devices are the same just listed twice, again for some unknown reason.
There are multiple versions of this tool, not one of them can download the firmware from the device as can be seen here:
~/opt/gd32-dfu-utils/bin/dfu-util -a 0 -v -U fw.dfu -d 256c:006d
dfu-util 0.9
Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2016 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/
Opening DFU capable USB device...
ID 28e9:0189
Run-time device DFU version 011a
Claiming USB DFU Interface...
Setting Alternate Setting #0 ...
dfu-util: Cannot set alternate interfaceThis led to a bit of searching and I managed to grab the tool shown here and run it on Windows:
As can be see by the first window, gives us the MCU part number, GD32F350C8T6
I have sniffed the http/s traffic from the firmware application and got a number of requests sent:
POST http://zyz.huion.cn/api/device.php HTTP/1.1
nReferer: zyz.huion.cn
Content-Type: application/x-www-form-urlencoded
Accept: */*
User-Agent: HuionFirmware
Host: zyz.huion.cn
Content-Length: 6
Pragma: no-cache
id=allGET http://zyz.huion.cn/api/search.php?token= HTTP/1.1
nReferer: zyz.huion.cn
Content-Type: application/x-www-form-urlencoded
Accept: */*
User-Agent: HuionFirmware
Host: zyz.huion.cn
Pragma: no-cacheGET http://wx.huion.cn/api/Propelling/getInfo/?region=GB&sys_type=win HTTP/1.1
nReferer: wx.huion.cn
Content-Type: application/x-www-form-urlencoded
Accept: */*
Host: wx.huion.cn
Pragma: no-cache
Cookie: FIFMWARE=8001e659212cd459f063ea7691e0dae7By sending the following command:
$ wget --no-cookies --header "Cookie: FIFMWARE=8001e659212cd459f063ea7691e0dae7" http://zyz.huion.cn/api/search.php?token=I was able to get a list of firmware binaries with url's for various devices. I have downloaded that file and the gd32-prefix/suffix tools don't recognise the files:
$ ~/opt/gd32-dfu-utils/bin/dfu-prefix -c c831532b0621e8ff9510fdc18ebe00d1.bin
dfu-prefix (dfu-util) 0.9
Copyright 2011-2012 Stefan Schmidt, 2014 Uwe Bonnes
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/
dfu-prefix: Invalid DFU suffix signature
dfu-prefix: A valid DFU suffix will be required in a future dfu-util release!!!
$ ~/opt/gd32-dfu-utils/bin/dfu-suffix -c c831532b0621e8ff9510fdc18ebe00d1.bin
dfu-suffix (dfu-util) 0.9
Copyright 2011-2012 Stefan Schmidt, 2013-2014 Tormod Volden
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/
dfu-suffix: Invalid DFU suffix signature
dfu-suffix: Valid DFU suffix neededSo, it could be an encrypted file, or they have a modified toolset for their devices.
The JSON file returned from the query above has a 30-digit md5sum hash contained, it misses off the last 2 digits of the hash, i.e.:
$ md5sum HS610_HUION_T194_190307.bin
b552a20d0dab09dcf1dbfafea3ab4b21 HS610_HUION_T194_190307.bin
b552a20d0dab09dcf1dbfafea3ab4b # Hash from the JSON file for this binary.
$ md5sum HS610_HUION_T194_191023.bin
9257fe18bf62426a6c5a412cc74e2bd0 HS610_HUION_T194_191023.bin
9257fe18bf62426a6c5a412cc74e2b # Hash from the JSON file for this binary.$ sudo libinput list-devices
event4 - HUION Huion Tablet_HS610 Touch Ring: libinput bug: missing tablet capabilities: pen btn-stylus resolution. Ignoring this device.
event5 - HUION Huion Tablet_HS610 Dial: libinput bug: missing tablet capabilities: pen btn-stylus resolution. Ignoring this device.
event1 - HUION Huion Tablet_HS610 Keyboard: libinput bug: missing tablet capabilities: xy pen btn-stylus resolution. Ignoring this device.
# Non-related devices removed.
Device: HUION Huion Tablet_HS610
Kernel: /dev/input/event2
Group: 7
Seat: seat0, default
Size: 254x159mm
Capabilities: tablet
Tap-to-click: n/a
Tap-and-drag: n/a
Tap drag lock: n/a
Left-handed: n/a
Nat.scrolling: n/a
Middle emulation: n/a
Calibration: n/a
Scroll methods: none
Click methods: none
Disable-w-typing: n/a
Accel profiles: none
Rotation: n/a
Device: HUION Huion Tablet_HS610 Pad
Kernel: /dev/input/event3
Group: 7
Seat: seat0, default
Capabilities: tablet-pad
Tap-to-click: n/a
Tap-and-drag: n/a
Tap drag lock: n/a
Left-handed: n/a
Nat.scrolling: n/a
Middle emulation: n/a
Calibration: n/a
Scroll methods: none
Click methods: none
Disable-w-typing: n/a
Accel profiles: n/a
Rotation: n/a
Pad:
Rings: 0
Strips: 0
Buttons: 13
Mode groups: 1 (1 modes)So, what's the point of all this? Well, it would be nice to be able to update firmware without a Windows or Mac machine. Yes I can do it in a virtual machine (KVM), and it works, but some people don't and won't.
The issue is this, the firmware isn't distributed with the firmware tool, it's downloaded and from a (now) known location. It would be nice to be able to have this location publicly available or even just a link to the DFU binary.
The manufacturer also doesn't want people to reverse engineer their firmware, well, unfortunately, that is beyond their control, people will do it, 1) because they can, 2) because it's a challenge and 3) because at some point the tablet will be unsupported and people will still own one and there may be bugs that need fixing.
Any help in writing the firmware with open tools to the device will be gratefully received and merged into this repository.
If anyone does this, I'll need to change the name of the repository.
If you want to see if your tablet enters a new mode for flashing, do the following:
dmesg -Hwin a terminal.- Check the site for firmware instructions, if any.
- Hold down the buttons one at a time and insert the USB cable, try combinations of buttons.
- Note down what dmesg prints if it prints anything.
- Create an issue here with those details and I'll create a new page for that tablet.
- Find links to the datasheets I can link into a new document.
- Trace networking/USB on Windows or Mac using a tool as you insert the cable into the tablet in case the driver is checking for firmware updates.
- Note down any URL's grabbed.
- Test these URL's with wget, see above, and see what comes down, add these files to the issue.
I'm interested in anything you can find relating to flashing the ROM or reading from the ROM on the MCU inside the tablet, datasheets of the MCU, etc.