Trace:

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
notes:hw:xencelabs-quickkeys [2023/04/24 18:20] – maffnotes:hw:xencelabs-quickkeys [2023/06/26 14:17] (current) – maff
Line 86: Line 86:
  
 The FCC-published information about this device indicates that yes - this is simply bluetooth/BLE. The detailed emissions report includes a screenshot of nRFgo Studio, which suggests a Nordic Semiconductor nRF is being used for BLE transmission (which would make sense). The FCC-published information about this device indicates that yes - this is simply bluetooth/BLE. The detailed emissions report includes a screenshot of nRFgo Studio, which suggests a Nordic Semiconductor nRF is being used for BLE transmission (which would make sense).
 +
 +Diagnostic information in the software reports the dongle's firmware as ''ACD12-B 20201214094214 15.3.0''
 +
 +===== Linux Drivers =====
 +
 +Somehow never occurred to me that the linux driver package might shed more light on how the software and hardware interact.
 +
 +The Linux download contains packages for RPM and dpkg-based distros, as well as a tarball with installation scripts - the most obvious point for examination. It contains normal XDG stuff for startup, application registration and so on, but also contains udev rules:
 +
 +<code text 10-xencelabs.rules>
 +KERNEL=="uinput",MODE:="0666",OPTIONS+="static_node=uinput"
 +SUBSYSTEMS=="usb",ATTRS{idVendor}=="28bd",MODE:="0666"
 +</code>
 +
 +It also contains the actual software and a set of Qt5 libraries. The application itself is invoked via a script which exports LD_LIBRARY_PATH beforehand.
 +
 +The application binary is (predictably) a dynamically-linked ELF built for amd64.
  
 ===== Plans ===== ===== Plans =====
Line 108: Line 125:
   * Checks for updates to itself by calling ''{API server}/getLatestDriver?system_sign={mac|win|linux}&language={en|?}'' - returns a JSON payload   * Checks for updates to itself by calling ''{API server}/getLatestDriver?system_sign={mac|win|linux}&language={en|?}'' - returns a JSON payload
   * Checks for firmware updates by calling ''{API server}/getLatestFirmware?project_sign={?}'' - presumably returns a JSON payload, no idea what ''project_sign'' is though   * Checks for firmware updates by calling ''{API server}/getLatestFirmware?project_sign={?}'' - presumably returns a JSON payload, no idea what ''project_sign'' is though
 +
 +===== Notes during reverse-engineering =====
 +
 +Both the dongle and the direct USB connection expose a USB Usage with page FF0Ah
 +
 +Not 100% on packet/HID report format, but..
 +
 +  * All writes are 32-byte packets
 +  * Bytes 10-15 inclusive are the MAC address of the device, or zeroes if connected via USB instead of the dongle
 +  * Byte 0 is always 0x02 - this is the endpoint I think
 +  * Data is only sent from the device once it has been subscribed to:
 +  * 02b410 - Subscribes to battery change events
 +  * 02b004 - Subscribes to button press and wheel events
 +  * 02b801 - Subscribes to dongle connection events
 +
 +Commands/opcodes are as follows (an ampersand followed by a number indicates an argument/parameter)
 +
 +  * 02b40801&0 - Set the idle timeout in minutes between 0 and 255
 +  * 02b4040101&0 - Set the velocity (poll rate?) of the wheel (5 = slowest, 1 = fastest)
 +  * 02b10a01&0 - Set the display brightness (0 = off, 3 = highest)
 +  * 02b1&0 - Set the display rotation (0 = 0º, 3 = 270º)
 +  * 02b40101&0&1&2 - Set the RGB colour value of the ring around the wheel (0-255, 0-255, 0-255)
 +  * 02b100&000&1000000000000000000000000000000&2... - Set the label for one of the eight macro keys (arg0 is the key number from 1 to 8, arg1 is the length of the label text * 2, arg2 is the label text encoded as unicode/utf16le) - the device seems able to take a label length up to 24 characters but i've not identified how it receives characters after the 8th.
 +  * 02b1&0&100&2&3 - Display an "overlay" message (arg0 indicates if it is the first message, 5, or a continuation of the message, 6. arg1
  
 ===== Links ===== ===== Links =====
Navigation
  • Home