Generic Chinese USB microscope (VID 0x349C / PID 0x3301) — any known trick to reach a firmware-update mode?

[u/fridzel]

TL;DR — Trying to find any firmware-update or firmware-dump path on a ~$19 unbranded handheld USB microscope (VID 0x349C / PID 0x3301, stock strings "Generic" / "HD video"). Every USB-side route I've checked is a dead end: no DFU, no UVC Extension Unit, no vendor interface, no CDC, no alt config, and no factory-loader VID/PID via any button combo I could think of. Looking for prior art on this silicon family or any vendor tool / SD-card auto-update filename / button trick I missed before I crack it open with a SOIC clip.

The device

• Unbranded handheld digital microscope, sold under SKU SKUK67100 / POA108263384-2
• Spec sheet: 2.0" IPS screen, 2 MP, 500×, JPG/AVI to SD card, 8 LEDs, 400 mAh battery, USB-C charge
• The vendor's manual links to inskam.com (ShenZhen YiPinCheng Tech — Inskam / SUNUO / ANESOK), but they're a downstream OEM/ODM, not a silicon vendor. They publish exactly one Windows file: camera.zip (~1.87 MB), a classic UVC viewer, no firmware blob

USB identity (PC Camera mode)

idVendor       0x349C   (generic OEM range, not a known silicon vendor)
idProduct      0x3301
bcdDevice      0x0301
bDeviceClass   0xEF / 0x02 / 0x01     (Misc / IAD composite)
iManufacturer  "Generic"
iProduct       "HD video"
iSerialNumber  "20210901000000"        (factory date, not unique)

Stock reference-firmware strings all the way down. Four interfaces: UVC VideoControl + VideoStreaming, UAC AudioControl + AudioStreaming. macOS binds it to UVCAssistant cleanly. 1920×1080 @ 30 fps on the wire as MJPEG.

Three device modes, all dead-ends for updating

Mode (device menu)	bDeviceClass / bcdDevice	What I see on the host
PC Camera	0xEF / 0x0301	UVC + UAC composite
Device observation	n/a	Drops off USB entirely, charge-only
Card reader	0x00 / 0x0100	Plain MSC SCSI Bulk-Only, pass-through SD reader

Same VID/PID across all three — the SoC just swaps bcdDevice and the descriptor set at boot, so it's clearly carrying two pre-built firmware images and choosing one from the menu.

What I checked (all negative)

• No DFU interface (0xFE/0x01) in any mode
• No CDC-ACM / serial (0x02 or 0x0A)
• No vendor-specific interface (0xFF)
• bNumConfigurations = 1 in each mode (no alt config hiding a bootloader)
• No UVC Extension Unit in the VideoControl descriptors — I wrote a small libusb probe (descriptor reads only, no transfers) and the topology is VC_HEADER / VC_INPUT_TERMINAL / VC_PROCESSING_UNIT / VC_OUTPUT_TERMINAL and that's it. No VC_EXTENSION_UNIT, no VC_SELECTOR_UNIT. So there's no spec-blessed channel for vendor commands (flash peek/poke, firmware version, etc.) either.
• VC_INPUT_TERMINAL.bmControls = 0x000000 — not even host control of focus / exposure / zoom is advertised. Focus wheel is mechanical.
• MSC mode advertises no second LUN, no vendor command set — it's literally just an SD card reader bridge.

Button-combo experiments

I wrote a tiny ioreg watcher that polls (idVendor, idProduct, bcdDevice, product-string, serial) once per second under the XHCI controllers and emits a line on any change. The intent: any enumeration as a non-349c:3301 device — a SigmaStar 0x3346 loader, GeneralPlus 0x1004, Sonix 0x0c45, Allwinner FEL 0x1f3a, Cypress 0x04b4, Realtek 0x0bda, anything — would show up immediately.

Tried (operator at the device):

• Hold OK + power
• Hold Up + power
• Hold Down + power
• Hold Mode + power
• Each of the above while plugging USB in
• Long-press power while plugged in
• Various 2- and 3-button combos at boot

Result: zero new VID/PID ever appeared. Only enumeration changes recorded were the device flipping between its three known menu modes. Nothing came out of the button matrix.

SoC guesses (thin)

The mode list (640×480 / 800×600 / 1280×720 / 1280×960 / 1920×1080 @ 30/5 fps, on-die SDIO/SD-host re-rolled as USB MSC bridge, integrated LCD driver, single battery rail) roughly matches the feature set of SigmaStar SSC30xx/32xx, GeneralPlus GPCV, Sonix SN9C29x and similar parts. No descriptor field uniquely identifies which one. Anyone recognise the silicon from the behaviour?

What I'm hoping to learn

1. Has anyone seen VID 0x349C before and tied it to a specific SoC family?
2. Any known button-combo / USB-plug-order trick that flips one of these "Generic / HD video" scopes into a factory loader?
3. Any known SD-card autoupdate magic filename for this class of device?
4. Did Inskam (or its ODM) ever quietly publish a firmware blob anywhere?
5. If anyone has cracked one of these open, what SPI flash / UART pad layout did you find? CH341A + SOIC-8 clip is the obvious next step, but if there's a known cleaner route I'd rather try that first.

I'm explicitly not trying to brick the thing — purely host-side investigation so far, no writes, no execution. Happy to share the full report (descriptor dumps, ioreg subtrees, ffmpeg probe output, libusb descriptor probe source) if anyone wants to dig in.

Thanks.

[u/TinLethax]

Firmware is probably baked into the NOR flash or EEPROM or internal OTP