Hacking the Ex-Word Dataplus 2

I have now reached the stage where all electronic devices I own that are smarter than toaster have an USB port. The only device whose port is not usable in a cross platform fashion is the one of my electronic dictionary, a Ex-Word dataplus 2 by Casio. So I have started looking into writing some software to communicate to this device from my Mac. This is not an easy task, in many ways it is like solving a puzzle, or maybe doing archeology. The official Casio web site is useless, the dictionary is only present in the japanese site, and there is not a single mention of Mac OS X or Linux.

Full Speed device @ 4 (0x06200000):
 Composite device: "CESG502"
 Port Information: 0x001a
   Not Captive
   Attached to Root Hub
   External Device
   Connected
   Enabled
 Device Descriptor 
  Descriptor Version Number: 0x0100
  Device Class: 0 (Composite)
  Device Subclass: 0
  Device Protocol: 0
  Device MaxPacketSize: 8
  Device VendorID/ProductID: 0x07CF/0x6101 (Casio Computer Co., Ltd.)
  Device Version Number: 0x0100
  Number of Configurations: 1
  Manufacturer String: 1 "CASIO COMPUTER CO., LTD."
  Product String: 2 "CESG502"
  Serial Number String: 0 (none)
 Configuration Descriptor 
  Length (and contents): 39
   Raw Descriptor (hex) 0000: 0902270001010080320904000003FF00 
   Raw Descriptor (hex) 0010: FF000705820240000007050102400000 
   Raw Descriptor (hex) 0020: 07058303080002 
  Number of Interfaces: 1
  Configuration Value: 1
  Attributes: 0x80 (bus-powered)
  MaxPower: 100 ma
  Interface #0 - Vendor-specific 
   Alternate Setting 0
   Number of Endpoints 3
   Interface Class: 255 (Vendor-specific)
   Interface Subclass; 0 (Vendor-specific)
   Interface Protocol: 255
   Endpoint 0x82 - Bulk Input 
    Address: 0x82 (IN)
    Attributes: 0x02 (Bulk no synch. data endpoint)
    Max Packet Size: 64
    Polling Interval: 0 ms
   Endpoint 0x01 - Bulk Output 
    Address: 0x01 (OUT)
    Attributes: 0x02 (Bulk no synch. data endpoint)
    Max Packet Size: 64
    Polling Interval: 0 ms
   Endpoint 0x83 - Interrupt Input 
    Address: 0x83 (IN)
    Attributes: 0x03 (Interrupt no synch. data endpoint)
    Max Packet Size: 8
    Polling Interval: 2 ms

So what does the device tell on the USB port? Basically the device announce itself as a device named “CESG502” manufactured by Casio. It claims to draw its power from the USB bus (which is lie, the device runs on its own batteries) and draws 100 milli-amperes. The device has a single, vendor specific interface with three pipes: bulk-in, bulk-out and interrupt. Basically, this means that no standard driver, like USB mass storage will work. The only hint we have is this device name, “CESG502”.

Searching around on the web shows me that this string is also the name of a Windows driver used in various Casio devices with USB ports: Pocket Viewers and Graphing Calculators. I found some online documents about the protocol used:

I also found some open-source programs to communicate with such devices:

The last one has direct USB support and I managed to compile and run it on OS X. The problem is, the dictionary claims that this program uses an old protocol that is not supported and urges to switch to version 2.0. I get the same error message when running the Windows program for the French or the German dictionaries against my japanese model. Back to square one.

Time to go low level, I loaded a USB protocol sniffer and ran the Windows program for the japanese dictionary (the one that works) to get traces of the various operations. The first observation is that the functionality is very reduced, one can only upload text files and delete them, no download, and no other file format seems to be supported. The second observation is that the protocol is quite different from the one of the previous versions. Here is what I found out:

  • The device link needs to be activated in the same way as in previous versions, this means sending a USB control message on the interrupt pipe with request type 0x41 and request value 0x01 without this the device does not response to any packet.
  • Communication is still packet oriented, but the format used by the PC to send commands is different.
    Byte 0 is the sequence number, byte 1 is the packet type, byte 3 is the length of the packet.
  • Command packets have a type of form 0x8X. Byte 4-5 contains the number of 16 bit parameters that follow. The bytes following the integer parameters contains the command a string with 16 bit wide characters, the packet is terminated with one single byte field that contains zero. The string seems to be the actual command.
  • Ack/Response packets start with byte 0xA0, byte 2 contains the length of the packet. A simple ack packet is three byte long, answers have the same structure, with a payload starting at byte 3.
  • Nack packets have the same structure as Ack packets but start with 0xD0. As soon as an error occurs, the device sends a Nack packet, closes the connection and displays an error message.
  • Here are some of the command strings I found: _Model, _List, _Cap, _List, _Unlock, _CName, _CryptKey (this is not good).

I have some rudimentary code that open the channel with the device and get some raw bytes, I’ll post more information once I made some more progress… Edit: It’s OBEX

12 thoughts on “Hacking the Ex-Word Dataplus 2”

  1. Do you think it will ever be possible to hack the device in order to install custom dictionaries?
    I bet that there are millions of learners of Japanese who would love to put EDICT, the french JMdict or Wadoku.de on their devices…

  2. I’m making progress, but it’s slow. I now can get the directory of files in the device, and I see files that are not visible in the UI. The largest challenge is that I have not identified a command to read files from the device’s internal memory.

  3. What you’re doing is really cool. I’ve got a Korean Casio Ex Word with a trackpad. Being able to add more dictionaries to it would actually make it useful since I’m living in China now. Not sure if it uses the same protocols as the Dataplus 2 though. It’s already a decent e-reader with the SD card. Here’s wishing someone ports DSL linux to it when you figure out how to communicate with it.

  4. Very interesting, please don’t abandon your investigation !! At least, would it be possible to share your findings, for example by putting some code on a code repository ?
    I don’t know anything about programming usb devices or sniffing usb ports, but I’m a programmer and I am quite quite motivated to enter the device and be able to upload some dictionary. It would be great because all the dictionaries series that one can buy in Japan seems to be all the same, except for the dictionaries inside it.
    Be able to upload a specially formatted dictionary means that we can buy the least expensive electronic dictionary (we don’t need usually the majority of japanese dictionaries that are inside the most expensive ones) and fill it with our own dictionaries…

  5. hi! I have a Chinese-English dictionary EW-V2500L (probably Ex Word compatible) and I’m interested in reverse engineering. It would be really great to add some custom dictionaries to this pocket dic.
    I wish you success with your work!

  6. Awesome work, I came across to your site just searching for a way to convert old-SD type additional dictionaries to recent micro SD ones… I noticed that it has been 2 years since this post had been made but, was there any success afterward? I guess there is some thing that I can use for my aim so. Thanks!

  7. hello. I was wondering how to add additional dictonaries to my casio ex-word in a mac computer. I already have the dictionary I want to add in the following format: stardict-drae-2.4.2.bz2. Any idea how to add it? I think the software for adding dictionaries only works on windows. Please help.

    Thanks

  8. Hi,

    I´m absolutely new at electronic dictionaries, but I have some (or some more) experiences with different HandheldPCs. The Hardware of Casio Dictionaries seems very attractive to me (although there are nearly no infos about) – very good TFTs, quality made housings, good form factor, good sound systems… In my opinion it´s a waste to use/construct such devices only for reading digital papers. My dream would be to run Linux, Android or WindowsCE on them. I have EW-G7000E (german) and I really like its handling and I´m convinced, that changing the OS is possible…

  9. Can I get the user guide for the EX-word dataplus 2 please?

    I got a dictionary, but there is no user guide. So I dont know how to use it.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.