osresearch / airbreak Goto Github PK

Error in ST32CubeProgrammer:
: UR connection mode is defined with the HWrst reset mode
: ST-LINK SN : 38FF6F06304E4B3020141243
: ST-LINK FW : V2J42S7
: Board : --
: Voltage : 3.23V
: Error: No STM32 target found! If your product embeds Debug Authentication, please perform a discovery using Debug Authentication

I also tried Visual Studio Code, I get this error message:
xPack OpenOCD x86_64 Open On-Chip Debugger 0.11.0+dev (2022-09-01-17:58)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
CDRTOSConfigure
Info : auto-selecting first available session transport "hla_swd". To override use 'transport select '.
Info : The selected transport took over low-level target control. The results might differ compared to plain JTAG/SWD
Info : Listening on port 50001 for tcl connections
Info : Listening on port 50002 for telnet connections
Info : clock speed 2000 kHz
Info : STLINK V2J42S7 (API v2) VID:PID 0483:3748
Info : Target voltage: 3.230406
Error: init mode failed (unable to connect to the target)

[2023-06-26T19:37:37.428Z] SERVER CONSOLE DEBUG: onBackendConnect: gdb-server session closed

I double-checked the connections and all the STM32 pins are connected in the right place, also including the ground pin too.

Feel free to use these pictures in the official documentation, I release them into the public domain. The only image I don't own is the R-Pi pinout diagram, that was sourced from Adafruit.

Ubuntu 20.04 Raspberry Pi 3 Image Download Link: https://ubuntu.com/download/raspberry-pi/thank-you?version=20.04&architecture=armhf+raspi

Hi! First, I'd like to thank you for such a massive effort!
Second, I'd like to preface that I am new to trying this out on my own and I've poked and prodded one of these machines I have for myself.

I've managed to dump the original firmware, but of course ... my hashes do not match to what is hard-coded in the script.

$ sha256sum stm32.bin
a5e7d77fc7b2fe38da82a7d99035cecd40749398da31f7e39634c002e7081cc7  stm32.bin

$ strings stm32.bin | grep SX
SX577-0200
SX567-0302
XSXSL

I am not sure what exact firmware version I have, so this is all the info I've managed to gather about the dump so far. I was wondering where I could go patching myself from here? The other pages in the docs still say "Coming soon..."

Does anyone have this stock firmware in their possession? If so can you leave an email or something where I can get in touch?

Is it safe to set a breakpoint in the breath control loop while the device is running live? Worried about damaging my device, thanks.

root@ubuntu:~/airbreak# head -n 4 tcl/airsense.cfg
source [find interface/raspberrypi2-native.cfg]
transport select swd
set WORKAREASIZE 0x2000
source [find target/stm32f4x.cfg]

root@ubuntu:~/airbreak# openocd -f ./tcl/airsense.cfg
Open On-Chip Debugger 0.10.0
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
BCM2835 GPIO nums: swclk = 25, swdio = 24
BCM2835 GPIO config: srst = 18
srst_only separate srst_gates_jtag srst_push_pull connect_deassert_srst
adapter speed: 2000 kHz
adapter_nsrst_delay: 100
srst_only separate srst_nogate srst_push_pull connect_deassert_srst
cortex_m reset_config sysresetreq
Info : BCM2835 GPIO JTAG/SWD bitbang driver
Info : SWD only mode enabled (specify tck, tms, tdi and tdo gpios to add JTAG mode)
Info : clock speed 2002 kHz
Info : SWD DPIDR 0x2ba01477
Info : stm32f4x.cpu: hardware has 6 breakpoints, 4 watchpoints
./tcl/airsense.cfg:78: Error: invalid command name "mrh"
in procedure 'script'
at file "embedded:startup.tcl", line 60
at file "./tcl/airsense.cfg", line 78

root@ubuntu:~/airbreak# cat /etc/os-release
NAME="Ubuntu"
VERSION="20.04 LTS (Focal Fossa)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 20.04 LTS"
VERSION_ID="20.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=focal
UBUNTU_CODENAME=focal

root@ubuntu:~/airbreak# uname -a
Linux ubuntu 5.4.0-1008-raspi #8-Ubuntu SMP Wed Apr 8 11:17:03 UTC 2020 armv7l armv7l armv7l GNU/Linux

Hi,

I am from Brazil and I am trying to patch a brazilian portuguese firmware.
I don't know the firmware version because it does not show it (there is no about screen)
Like everyone I first stopped at the checksum issue, my checksum is ad5486f5c4721448893bc4edcb5905ba38b034ee54f00205bfcbe075fefab8e7.

I checked some offsets from the code and they seemed to match, so I decided to give it a try.
I changed the checksum and continued, to see how far could I go and I stopped at other issue:

make: *** No rule to make target 'stm32.bin.xml', needed by 'stubs.S'. Stop.

Installed ghidra, analyzed using 'stm32 cortex little endian' , and generated XML and used it, but I am pretty sure this is not correct, since my guess is that the symbol names should come from somewhere else, and not auto generated, probably for offset matching. Then got stucked at:

undefined reference to 'tim_read_tim5

Trying to advance a little more, I commented the ghidrastubs part and flashed it.
Nothing looked different, no 'hacked' message, then I tried to enable 'all_menu' and some menu items in the menu changed, but no major feature enabled.

Original Screens:

I need some guidance about what are the correct steps to adapt my firmware. I read the github issues but I am a little confused by everything.
Do I have to look for offset matches in version 401 and change the script? (I don't have a 401 firmware, I only have mine, what now?)
What about this ghidra stuff? what I must do inside it? where the names came from?
A small tutorial saying "1-match all offsets of blah to bleh, 2-convert xxx..."

Thank you all for this incredible project.
The Brazilian health system is very precarious, you will be saving many lives.

Ricardo Andere de Mello (gandhi)

I'm sorry to ask a very newbie question, but given the relevance of the project would someone care to give some hints on how to compile the project? I was able to extract the firmware. Although the firmware version was the same, the checksum was different, fixed that, the compiler asks for breath.Bin and asks if I performed make, which I did without result. Another problem is stubs which says there is no target. How should I proceed, please?

root@ubuntu:~/airbreak# ./patch-airsense stm32.bin stm32-unlocked.bin
stm32.bin: FAILED
sha256sum: WARNING: 1 computed checksum did NOT match
stm32.bin: wrong hash

SW firmware version on my device is SX567-0306, it's been unplugged for about six months so I guess it did not receive the over the air updates to version SX567-0401. I don't know how to trigger the OTA firmware update process, I don't have a DME provider so I'm not even sure this unit can receive the update. The machine has one bar on the modem signal status. Is there a way to download the stock firmware update version SX567-0401 on the Internet?

root@ubuntu:~/airbreak# sha256sum stm32.bin
363a204ba217f31223e929365d58b8f5ce038a7681e362fe157e190c2eacbd30 stm32.bin

Some of the modes are missing important, even critical, settings.

In particular, ST, T, PAC are missing the ability to set a "Resp. Rate" or "Backup Rate".

Without those, one can't really use those modes, which are likely the most useful ones for COVID-19 patients.

Also, "Learn Targets" and "Height" are missing from the iVAPS menus.

I followed all the instructions, such an error came in the flashing part. device looped in "resmed" splash screen. Installing the backup 32.bin fixes it, but I couldn't hack it, can you help me? @nbritton @dblunk88 @enjrolas @redpath @osresearch @colinoflynn @graver @wormyrocks

https://gfycat.com/warpedreflectingbarasinga

`[root@fedora scripts]# telnet localhost 4444
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger

flash_new stm32-unlocked.bin
Unable to match requested speed 2000 kHz, using 1800 kHz
Unable to match requested speed 2000 kHz, using 1800 kHz
target halted due to debug-request, current mode: Thread
xPSR: 0x01000000 pc: 0x0800021c msp: 0x2000f000
Tickling watchdog...
device id = 0x10076413
flash size = 1024 kbytes
Resetting device...
Unable to match requested speed 2000 kHz, using 1800 kHz
Unable to match requested speed 2000 kHz, using 1800 kHz
target halted due to debug-request, current mode: Thread
xPSR: 0x01000000 pc: 0x0800021c msp: 0x2000f000
Overwriting flash memory...
device id = 0x10076413
flash size = 1024 kbytes
Verifying that flash was written properly...
Unable to match requested speed 2000 kHz, using 1800 kHz
Unable to match requested speed 2000 kHz, using 1800 kHz
target halted due to debug-request, current mode: Thread
xPSR: 0x01000000 pc: 0x0800021c msp: 0x2000f000
Resetting watchdog bit...
Unable to match requested speed 2000 kHz, using 1800 kHz
Unable to match requested speed 2000 kHz, using 1800 kHz
Writing magic numbers back into RCC memory...
Booting device...
tcl/airsense.cfg:63: Error: invalid command name "postboot"
in procedure 'flash_new'
at file "tcl/airsense.cfg", line 63
`

Hello, I'm just wondering if someone has the Aircurve Vauto firmware. I'm looking to flash my device for sleep apnea treatment. The reason for flashing is im having a real hard time trying to get a machine from the USA to Thailand.

Thanks in advance.

https://tools.usps.com/go/TrackConfirmAction?tLabels=CH096760102US&utm_source=expected&utm_medium=email&utm_content=delivery-options&utm_campaign=trackingnotify

Is their a Slack/IRC channel for collaboration?

Hi there:

I followed the steps to flash, and it shows successful. However, when I started to use it, I noticed that there is no EPR option in autoset/for her/APAP mode. Is this normal? Did I miss any steps? thanks

I used Windows tools to dump the firmware. My SHA256 hash was: aa79d2e4f9114f8f9162b52a321eb4cf4d123db9ad55d4c2e08b5716fcaea25f

The firmware version is SX567-401 but the hash is different(!)

Edited this issue since many things have been discovered:

• Linux flasher does extra steps to soft reset the device that Windows one does not, Windows one does not work (that's fine, just use Linux instead, w/e). Windows one "bricks" the device without the extra steps the Linux one does.
• The tamper check causes the device LCD to flash on and off (assuming this is the "we've detected tampering" behavior)
• The tamper check has been moved from F0 to F2 on this firmware (please confirm, happy to send the dump for educational / academic research purposes)... this is where the bne instruction is.
• I can get past the tamper check by nooping F2 instead of F0. However, the other modes (BiPap, etc.) simply do not work on my device when I patch with the mode bit vector set to all 1's (FF FF) instead of 3 and the tamper check bne instruction at F2 replaced with a noop.
• With full patcher, some of the extra menu options such as Ti and Breathe Easy cannot be modified. The options show up but the scroll wheel does not work.
• No air gets blown with BiPap mode.

Reverting back to stock firmware for now. Time to purchase a BiPap.

Hello,
I'm looking for the firmware of the Aircurve 10 Vauto US firmware which provides access to the trigger parameter.
If somebody have it and can share it with me.
Thank you

Edit: never mind, the issue was I had the wrong firmware version. This issue can be deleted.

Hi, I have an ASV and I'm trying to jailbreak it so I can set the maxPS value to 5 while keeping the minPS at 3.
Would I be able to achieve this by following the standard firmware patching instructions?
(By patching the official firmware of my ASV device)
Will it still function the same way, but with more freedom to set maxPS?

For more context, the ASV has solved my CA events but I've noticed my heart rate goes up whenever the PS ramps up
Thanks :)

Mt Sinai reports:

The device has an automatic shut-off when the pressures exceed 30 cmH2O for >6 sec OR 40 cmH2O for >1 sec. We were able to recreate this by:

• Setting the device on a high pressure AND
• Adding in >20LPM O2 AND
• Almost completely occluding the exhalation port

This limit might live in the configuration section along with the GUI limits, or it might be implemented in code in the therapy manager.

I tried using ruri-baka's 0302 patch script form here. I get the HACKED! message on the screen, but it did not unlock any of the extra modes. The hash on the code I have is c7d16d912816b3e5b40158b695aaff629abc9f20bb4639943748bf2ae0d8b768
I assume since this hash is difference that the offsets are different? Any guidance how how to determine the offsets on the code I have?

I managed to import the function names from stubs.S into Ghidra, as well as disassemble and name some extra functions.

I'd like to export and generate a new stubs file, but I have no idea how to generate the stm32.bin.xml file containing the symbols.

Opening an issue to collect notes on building monitor into accessory port. According to pinout added with #11 USART3 routes to acc port.

It looks like the USART3 IRQ (vector table relocated to 08040200 according to VTOR, so USART3 entry is at 080402DC) is pointing to a stub, so seems likely USART3 could be re-used easily.

A simple serial monitor could allow rx/tx of memory to get readings out of the device (such as dumped right now via JTAG), but without JTAG cable attached.

More advanced would be looking at integrating MRI or other remote GDB debugging stub/monitor. But may have code spaces and other issues with larger monitor.

Here is a direct comparisons between the 401 firmware and the 306 firmware on where relevant offsets might be located at:
https://docs.google.com/spreadsheets/d/1qbU6NUodvUV6fAwwDyLvVt8z9bPQDE-5WTuzRmKDYVc/edit?usp=sharing

About to do a pull request to share the code. The original can be found on my fork and could be used for other firmware:
https://github.com/dblunk88/airbreak/blob/master/offset_locator.py

Usage:
First do a xxd on the 401 firmware and whatever firmware you are trying to compare it with, like so:
"xxd file.bin > file.hex"
Then run the program as so:
"python list_offset_diff.py hexfile1 hexfile2"
Since this Github is primarily focused on programming for 401, hexfile1 should be the xxd of the 401 firmware

Output will be a CSV which can be imported easily into Excel (to easily CTRL+F).
It only lists the offset if they are different (so if the offset isn't listed, it is implied to be the same).
There may be multiple matching offsets, since this is a list of ALL matching offsets. If there is no match, then that does not mean that it is completely lost, it is just not found in sectors split by 0-F's and a tighter search may be the recommended action (could just be 1 value that has changed in the entire block).

This should make compatibility easier between all versions :)
Note: It's not very efficient. Bring some time and coffee. If there is a high demand (doubt it, since this technically could be run once and it should mostly suffice), then I could see if I can build in a SQLite search via query (which should speed things up a LOT).

I'm getting this message when I run make:

root@ubuntu:~/airbreak# make
make: *** No rule to make target 'stm32.bin.xml', needed by 'stubs.S'. Stop.

root@ubuntu:~/airbreak# make breath
arm-none-eabi-gcc --nostdlib --no-dynamic-linker --Ttext 0x80bb734 --entry start breath.o -o breath
arm-none-eabi-gcc: error: 0x80bb734: No such file or directory
arm-none-eabi-gcc: error: unrecognized command line option '--nostdlib'; did you mean '-nostdlib'?
arm-none-eabi-gcc: error: unrecognized command line option '--no-dynamic-linker'
arm-none-eabi-gcc: error: unrecognized command line option '--Ttext'; did you mean '-Ttext'?
make: *** [: breath] Error 1

root@ubuntu:~/airbreak# make graph
arm-none-eabi-gcc -g -O3 -mcpu=cortex-m4 -mhard-float -mthumb -W -Wall -nostdlib -nostdinc -c -o graph.o graph.c
arm-none-eabi-gcc --nostdlib --no-dynamic-linker --Ttext 0x80fd000 --entry start graph.o -o graph
arm-none-eabi-gcc: error: 0x80fd000: No such file or directory
arm-none-eabi-gcc: error: unrecognized command line option '--nostdlib'; did you mean '-nostdlib'?
arm-none-eabi-gcc: error: unrecognized command line option '--no-dynamic-linker'
arm-none-eabi-gcc: error: unrecognized command line option '--Ttext'; did you mean '-Ttext'?
make: *** [: graph] Error 1

root@ubuntu:~/airbreak# cat /etc/os-release
NAME="Ubuntu"
VERSION="20.04 LTS (Focal Fossa)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 20.04 LTS"
VERSION_ID="20.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=focal
UBUNTU_CODENAME=focal

root@ubuntu:~/airbreak# uname -a
Linux ubuntu 5.4.0-1008-raspi #8-Ubuntu SMP Wed Apr 8 11:17:03 UTC 2020 armv7l armv7l armv7l GNU/Linux

For context, I am a Sleep Disordered Breathing patient, and active in a community where we discuss treatment and surrounding research.

It's a major grievance to many of us that whereas PAP machines are generally sufficient treatment in older men, younger people, women, and milder cases(where no degeneration of arousal mechanisms is present) experience only very limited benefit - of which some is inherent to the limitations of NIV, while some is regrettably down to algorithmic matters, with ResMed doing much worse than its competitor, Phillips Respironics.

Specifically, the following features would likely make a large difference:

• Exhale Support - something similar to Phillips Respironics FLEX features, which essentially reduce pressure during exhale to alleviate expiratory overpressure buildup contributing to exhalatory intolerance without compromising the capacity of treatment to stent airways open. This would especially be important for a large share of patients who have narrow nasal cavities.
• Pressure support waveform contour modification - while ResMed's EasyBreathe is very tolerable, it is not as effective as steeper pressure support curves, both in terms of preventing the need for the body to escalate respiratory effort, and in terms of elevating airway pressure during inhalation to maintain the capacity of treatment to stent the airway.
• Disabling ASV mode backup rate - persistent, neurological central apnea is rare in SDB patients, whereas treatment-emergent central apneas diminish and disappear as the body adjusts to treatment, with the backup rate instead picking up post-arousal drops in ventilation caused by a drop in CO2, and preventing transition back to voluntary breathing control.
• Making it possible to use a narrower min and max PS range in ASV mode, rather than mandating max PS to be at least min PS plus 5cmH2O

Of course, this is not a finite list, and much more could be improved, but past the above, I'm not sure if there's anything I'd guess likely to be possible to easily integrate into existing firmware via reverse engineering.

Does anyone have this stock firmware?

Hi all,

has someone had a look at the AirSense 11? It has two debug-ports on the board, one looks identical to the one on the S10, and a second one, a bit smaller with only 3 holes, near the (now soldered on :-@) modem...

Would be interesting, if this one also has more than the official modes, if bluetooth can be used for something usefull (other than pairing their sh***y cloud-app), and if it's possible to disable the modem without board-surgery.

Regards,

/hp

Hi, the firmware differences are obviously holding this project back as there are so many slightly different versions of the device. Are there plans to check whether one device can be operated with a firmware labeled for another device version?

Please consider creating a repo of your website so that a copy could be saved for off-line use, and insurance from takedown notices.

Opening an issue to track this so someone doesn't recreate the work. Ongoing Python-based patch script is available at https://github.com/colinoflynn/airbreak/blob/master/patch-airsense.py .

Will do PR once it's a little more cleaned up, for now just copied (most but not all) of functionality from existing script plus some CRC validation stuff into one main file.

Will copy over code to patch images as well to this from my existing script.

I have no experience with programming. Just wondering if its possible to patch stm32 bin with airsense-patch script in windows or can it only be done in Linux. Tried using Tortoise Merge, GIT gui and some other programs, but it seems the patch needs to be in *.patch of *.diff format. Thanks.

Hi,
I hope one of you may be able to help: using the fake ST-Link v2 and win10, running ST-link_cli.exe app in admin console, it is unable to connect to the target board. Do I need to specify JTAG or SWD, low power, frequency, reset etc. modes ?
This is the error I keep getting in st-link_cli.exe : https://photos.app.goo.gl/Gaor4gBgodj7Kgpq9
and I get this when using openocd (win): https://photos.app.goo.gl/ZBCrPUFSPL8a3L6J9
Also, my sw is SX567-0306. Is the patch-airsense script going to fail with this sw version ?
Thanks

Open On-Chip Debugger 0.10.0
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
Info : auto-selecting first available session transport "hla_swd". To override use 'transport select '.
Info : The selected transport took over low-level target control. The results might differ compared to plain JTAG/SWD
adapter speed: 2000 kHz
adapter_nsrst_delay: 100
none separate
Info : Unable to match requested speed 2000 kHz, using 1800 kHz
Info : Unable to match requested speed 2000 kHz, using 1800 kHz
Info : clock speed 1800 kHz
Info : STLINK v2 JTAG v29 API v2 SWIM v7 VID 0x0483 PID 0x3748
Info : using stlink api v2
Info : Target voltage: 3.101916
Info : stm32f4x.cpu: hardware has 6 breakpoints, 4 watchpoints
tcl/airsense.cfg:75: Error: invalid command name "mrh"
in procedure 'script'
at file "embedded:startup.tcl", line 60
at file "tcl/airsense.cfg", line 75

Anyone know if there is a way to use the OpenOCD utility to trigger the machine to check for a firmware update and/or download it?

I see in the decompiled source code functions for handling the update process.

How is firmware pushed OTA on the cellular network? If it's a data tcp/ip http connection there is probably some URL that the machine points to that will fetch a list of which firmware file to download.

Please add a license so that users can know their rights regarding this project.

The main chip on my AirSense 10 AutoSet is a STMicroelectronics STM32F405ZGT6. This is an ARM Cortex-M4 32-bit ISA, however the Internet says the Cortex-M series only supports the 16-bit Thumb ISA.

STM32F405ZG Datasheet:
https://www.st.com/resource/en/datasheet/stm32f405zg.pdf

16-bit Thumb ISA Quick Reference:
http://infocenter.arm.com/help/topic/com.arm.doc.qrc0006e/QRC0006_UAL16.pdf

High-res photos of the front and back of the main board in the AirSense 10 AutoSet: http://imgur.com/a/01iV4kP

I was able to successfully disassemble and decompile functions into C source code using Ghidra, below are the steps that I followed:

https://ghidra-sre.org
https://www.oracle.com/java/technologies/javase-jdk14-downloads.html

Hi, does anyone know how to access the EEPROM data? The product information that gets written out to the SD card within the file Identification.tgt appears to be coming from an EEPROM chip, "mmc:0:EEPROM" is what shows up in the decompiled source. I have my device in ASVAuto mode but ResScan v5.9 and OSCAR still show an AirSense device and one or both of those utilities appears to be getting confused about the device statistics because the stats are widely different.

I tried changing the following but it didn't have any effect about which device model was transcribed onto the SD card.

# Changes PCD value to 37216
printf '\x33\x37\x32\x31\x36\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' | patch 0x4020
# Changes product name to AirCurve 10 ASV
printf '\x41\x69\x72\x43\x75\x72\x76\x65\x20\x31\x30\x20\x41\x53\x56\x00' | patch 0x4030
printf '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' | patch 0x4040 

Here is the contents of my Identification.tgt file:

#IMF 0001
#VIR 0064
#RIR 0064
#PVR 0064
#PVD 001A
#CID <cellular device id? redacted>
#RID 000D
#VID 0027
#SRN <serial number redacted>
#SID SX567-0306
#PNA AirSense_10_AutoSet
#PCD 37028
#PCB (90)R370-7421(91)T2(21)85247141
#MID 0024
#FGT 24_M36_V39
#BID SX577-0200

I think it would be interesting to compile a list of output from the Identification.tgt file, in particular the PCB, PCD, and SID values. I belive PCB is the mainboard revision, PCD is the Device ID (i.g. 37216 is AirCurve 10 ASV machine), and SID is the firmware of course.

PCD Device ID Table:

USA: 37203, Canada: 37398 - AirSense 10 CPAP with HumidAir
USA: 37204, Canada: 37399 - AirSense 10 CPAP with HumidAir and ClimateLineAir
USA: 37205, Canada: 37400 - AirSense 10 Elite with HumidAir
USA: 37206, Canada: 37401 - AirSense 10 Elite with HumidAir and ClimateLineAir
USA: 37207, Canada: 37402 - AirSense 10 AutoSet with HumidAir
USA: 37208, Canada: 37403 - AirSense 10 AutoSet with HumidAir and ClimateLineAir
USA: 37209, Canada: 37404 - AirSense 10 AutoSet for Her with HumidAir
USA: 37210, Canada: 37405 - AirSense 10 AutoSet for Her with HumidAir and ClimateLineAir
USA: 37213, Canada: 37408 - AirCurve 10 S with HumidAir
USA: 37214, Canada: N/A - AirCurve 10 S with HumidAir and ClimateLineAir
USA: 37306, Canada: 37412 - AirCurve 10 ST with HumidAir
USA: 37307, Canada: N/A - AirCurve 10 ST with HumidAir and ClimateLineAir
USA: 37211, Canada: 37406 - AirCurve 10 VAuto with HumidAir
USA: 37212, Canada: N/A - AirCurve 10 VAuto with HumidAir and ClimateLineAir
USA: 37215, Canada: 37410 - AirCurve 10 ASV with HumidAir
USA: 37216, Canada: N/A - AirCurve 10 ASV with HumidAir and ClimateLineAir
USA: 28210, Canada: 28219 - AirCurve 10 ST-A with HumidAir
USA: 28211, Canada: N/A - AirCurve 10 ST-A with HumidAir and ClimateLineAir

Source: https://www.resmed.com/us/dam/documents/articles/1017667-ResMed-AirSolutions-device-and-accessories-guide.pdf

Several people have asked about the very low end AirStart 10 support. I don't have access to one to verify compatibility, but opening this issue for tracking it.

root@ubuntu:~/airbreak/tcl# telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger

dump
Dumping stm32.bin, 0x100000 bytes at 0x08000000...
dumped 1048576 bytes in 3.943746s (259.652 KiB/s)
Done.
flash_new stm32-unlocked.bin
adapter speed: 2002 kHz
target halted due to debug-request, current mode: Thread
xPSR: 0x01000000 pc: 0x0800021c msp: 0x2000f000
Tickling watchdog...
device id = 0x10076413
flash size = 1024kbytes
stm32f2x write options complete.
INFO: a reset or power cycle is required for the new settings to take effect.
Resetting device...
adapter speed: 2002 kHz
target halted due to debug-request, current mode: Thread
xPSR: 0x01000000 pc: 0x0800021c msp: 0x2000f000
Overwriting flash memory...
auto erase enabled
device id = 0x10076413
flash size = 1024kbytes
wrote 1048576 bytes from file stm32-unlocked.bin in 24.636749s (41.564 KiB/s)
Verifying that flash was written properly...
flash verify_bank bank_id filename offset
./tcl/airsense.cfg:42: Error:
at file "./tcl/airsense.cfg", line 42

catch is at line 42 in my file:

proc check_image {path} {
if [catch {find $path}] {
echo "File $path not found!"
return 1
}
return 0
}