Bulk Command Reference

This page details the known bulk commands that the Alauda responds to.

Bulk commands seem to go out over endpoint 3, however endpoint 1 is used early on by the windows driver. Commands sent out of EP1 appear to be in a different format to the EP3 commands and their relevance is not yet known. This page details those sent out of EP3.

Notes on addressing:

These commands deal with addressing individual pages within a zone - the concept of 'physical block' is loose here.
To read the first page in PBA 1, you need to read page 32 in zone 0, i.e. page offset 0x0020 in zone 0.
PBA 2 starts at offset 0x0040, PBA 3 at 0x0060, etc.

9-byte format:

Byte 0 always seems to read 0x40 (mabe indicating host to device like USB BRequestType?)
Byte 1 indicates the command opcode
Byte 8 indicates which media the command is to be executed on. (0 = XD, 1 = SmartMedia)

Other bytes vary between commands.

It will help to relate some terminology mentioned here (e.g. "control data") to My XD Media notes

NOTE: This will be incomplete, especially as I'm only focusing on XD media right now.

GET_MEDIA_SIGNATURE (0x50)

Command: 40 50 00 00 00 00 04 00 PP

This appears to be the alternative command to read the media signature. The primary command is a control command called GET_XD_MEDIA_SIGNATURE

256mb XD result = 00 00 b5 00
16mb XD result = 98 73 b5 ba

BULK_54 (0x54)

Command: 40 54 00 00 00 00 1e 00 PP

The Windows driver sends this command is sent very early during initialization (before the media status has even been polled) to the SmartMedia port.

56_READ (0x56)

Command: 40 56 00 00 00 00 XX 00 PP

This appears to read something, the number of bytes to be read is written in byte 6. The requested amount of data shall be read from bulk in after this command has been executed. All of my tests so far return C0 01 – I am not sure what this means.

READ_PAGE (0x84)

Command: 40 84 XX XX 00 XX II 00 PP

Byte 2: Page offset [8:15]
Byte 3: Zone index
Byte 5: Page offset [0:7]

This command reads one page (sector) from the card. One page is 512 bytes, and is followed by a 16 bytes of structure/checksum info.

After this command is executed, 528 bytes shall be read from bulk input.

GET_PAGE_CONTROL_DATA (0x85)

Command: 40 85 XX XX 00 XX II 00 PP

Byte 2: Page offset [8:15]
Byte 3: Zone index
Byte 5: Page offset [0:7]

This command reads the control data for 1 page, including sector validity, LBA address, and checksums. After this command is executed, 16 bytes shall be read from bulk input.

READ_PAGE_HIDDEN (0x8D)

Command: 40 8D XX XX XX XX II 00 PP

This command behaves like READ_PAGE, but reveals the data behind PBA's 0 and 1 where CIS data is normally kept.

READ_BLOCK (0x94)

Command: 40 94 XX XX 00 XX XX 00 PP

Byte 2: Base page offset [8:15]
Byte 3: Zone index
Byte 5: Base page offset [0:7]
Byte 6: Number of pages to read

This command reads a number of pages from the device. Each page is 512 bytes. Each page is followed by an extra 64 bytes, the first 16 of which are control data, the following 48 of which are junk.

After executing this command, (byte(6)*576) bytes shall be read from bulk in.

RESET_MEDIA (0xE0)

Command: 40 E0 00 00 00 00 00 00 PP

This command resets the media