Trace: • xencelabs-quickkeys

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
notes:hw:xencelabs-quickkeys [2023/04/26 11:36] – maffnotes:hw:xencelabs-quickkeys [2023/06/26 14:17] (current) – maff
Line 86: Line 86:
  
 The FCC-published information about this device indicates that yes - this is simply bluetooth/BLE. The detailed emissions report includes a screenshot of nRFgo Studio, which suggests a Nordic Semiconductor nRF is being used for BLE transmission (which would make sense). The FCC-published information about this device indicates that yes - this is simply bluetooth/BLE. The detailed emissions report includes a screenshot of nRFgo Studio, which suggests a Nordic Semiconductor nRF is being used for BLE transmission (which would make sense).
 +
 +Diagnostic information in the software reports the dongle's firmware as ''ACD12-B 20201214094214 15.3.0''
  
 ===== Linux Drivers ===== ===== Linux Drivers =====
Line 123: Line 125:
   * Checks for updates to itself by calling ''{API server}/getLatestDriver?system_sign={mac|win|linux}&language={en|?}'' - returns a JSON payload   * Checks for updates to itself by calling ''{API server}/getLatestDriver?system_sign={mac|win|linux}&language={en|?}'' - returns a JSON payload
   * Checks for firmware updates by calling ''{API server}/getLatestFirmware?project_sign={?}'' - presumably returns a JSON payload, no idea what ''project_sign'' is though   * Checks for firmware updates by calling ''{API server}/getLatestFirmware?project_sign={?}'' - presumably returns a JSON payload, no idea what ''project_sign'' is though
 +
 +===== Notes during reverse-engineering =====
 +
 +Both the dongle and the direct USB connection expose a USB Usage with page FF0Ah
 +
 +Not 100% on packet/HID report format, but..
 +
 +  * All writes are 32-byte packets
 +  * Bytes 10-15 inclusive are the MAC address of the device, or zeroes if connected via USB instead of the dongle
 +  * Byte 0 is always 0x02 - this is the endpoint I think
 +  * Data is only sent from the device once it has been subscribed to:
 +  * 02b410 - Subscribes to battery change events
 +  * 02b004 - Subscribes to button press and wheel events
 +  * 02b801 - Subscribes to dongle connection events
 +
 +Commands/opcodes are as follows (an ampersand followed by a number indicates an argument/parameter)
 +
 +  * 02b40801&0 - Set the idle timeout in minutes between 0 and 255
 +  * 02b4040101&0 - Set the velocity (poll rate?) of the wheel (5 = slowest, 1 = fastest)
 +  * 02b10a01&0 - Set the display brightness (0 = off, 3 = highest)
 +  * 02b1&0 - Set the display rotation (0 = 0º, 3 = 270º)
 +  * 02b40101&0&1&2 - Set the RGB colour value of the ring around the wheel (0-255, 0-255, 0-255)
 +  * 02b100&000&1000000000000000000000000000000&2... - Set the label for one of the eight macro keys (arg0 is the key number from 1 to 8, arg1 is the length of the label text * 2, arg2 is the label text encoded as unicode/utf16le) - the device seems able to take a label length up to 24 characters but i've not identified how it receives characters after the 8th.
 +  * 02b1&0&100&2&3 - Display an "overlay" message (arg0 indicates if it is the first message, 5, or a continuation of the message, 6. arg1
  
 ===== Links ===== ===== Links =====
Navigation
  • Home