A year ago, I bought a
Logitech Wireless Solar Keyboard
K750. I'm
particularly picky on keyboards, but this one is good. It has an incredible
useful feature: while being wireless, it has no need for disposable or
rechargeable batteries, it uses solar power!
My problem is that there's obviously no way to know the battery status from
Linux, the provided application only working on Windows.
And one dark night, while fragging on QuakeLive, my keyboard stopped
working: it had no battery left. This activity being quite energy consuming,
it emptied the whole battery.
Someone should write code to get the battery status and light meter from
Linux: challenge accepted!
How the keyboard works
This keyboard, like many of the new wireless devices from Logitech, uses the
Unifying interface. It's an USB receiver that can be attached up to 6
differents devices (mouse, keyboards ). On old Linux kernel, the
Unifying
receiver is recognized as only one keyboard and/or one mouse device.
Recently, a driver called
hid-logitech-dj has been added to the Linux
kernel. With this driver, each device attached to the receiver is recognized
as one different device.
What the Logitech application does
The Logitech application under Windows works that way: you launch it, and it
displays the battery charge level. On the keyboard, there's a special
"light" button (up right). When pressed, a LED will light up on the
keyboard: green if the keyboard is receiving enough light and is charging,
red if the keyboard does not receive enough light and is therefore
discharging. Pushing this same button while the application is running will
makes the light meter activated: the application will tell you how much
lux your keyboard is receiving.
Let's reverse engineer this
As far as I know, there's nothing in the USB HID protocol that handles this
kind of functionality (battery status, light meter ) in a standard way. So
the first task to accomplish is, unfortunately, to reverse engineer the
program.
I discovered a bit too late that
Drew Fisher did a good presentation on USB
reverse engineering at 28c3.
You might want to take a look at it if you want to reverse engineer on USB.
I did not need it, but I learned a few things.
Anyway, my plan was the following: run the Logitech application inside a
virtual machine running Windows, give it direct access to the USB keyboard,
and sniff what happens on the USB wire.
To achieve that, you need a virtual machine emulator that can do USB
pass-through. Both
KVM and
VirtualBox can do that, but VirtualBox works
much better with USB and allow hot(un)plugging of devices, so I used it.
To sniff what happens on the USB, you need to load the
usbmon Linux kernel
module. Simply doing
modprobe usbmon will work. You can then
use
Wireshark which know how to use
usbmon
devices and understand the USB protocol.
USB stuff you need to know
You don't need to know much about USB to understand what I'll write about
below, but for the sake of comprehensibility I'll write a couple of things
here before jumping in.
To communicate with an USB device, we communicate with one of its
endpoints. Endpoints are regrouped into an
interface. Interfaces are
regrouped into a
configuration. A device might contains one or several
configurations.
There's also several types of packets in the USB wire protocol, and at least
two of them interest us there, they are:
- Interrupt packets, a packet send spontaneously;
- Controls packets, used for command and status operations.
All of this and more is well (and better) explained in the
chapter
13 of
Linux Device Drivers, Third
Edition.
Sniffed data
Once everything was set-up, I ran my beloved Wireshark. There's a
an
URB of type
interrupt sent each
time you press any key with some data in it. Therefore I advise you to plug
another keyboard (or use the laptop keyboard if you're doing this on a
laptop), otherwise you'll get crazy trying to sniff the keyboard you're
typing on.
At this point, just launching the application does a bunch of USB traffic.
Pressing the "light" button on the keyboard makes even more USB packets
coming in and out. Here's the interesting packets that I noticed once I
excluded the noise:
- When pressing the "light" button, an URB of type interrupt is sent by the
keyboard to the computer;
- An URB control packet is sent by the computer to the keyboard in
response;
- Regularly URB interrupt packets are sent just after.
With all this, the next step was clear: understand the packets and reproduce
that exchange under Linux.
What the packets mean
The "go for the light meter" packet
The packet sent from the computer to the keyboard is the following.
<figure>
Frame 17: 71 bytes on wire (568 bits), 71 bytes captured (568 bits)
Frame Length: 71 bytes (568 bits)
Capture Length: 71 bytes (568 bits)
USB URB
URB id: 0xffff880161997240
URB type: URB_SUBMIT ('S')
URB transfer type: URB_CONTROL (0x02)
Endpoint: 0x00, Direction: OUT
0... .... = Direction: OUT (0)
.000 0000 = Endpoint value: 0
Device: 6
URB bus id: 1
Device setup request: relevant (0)
Data: present (0)
URB sec: 1340124450
URB usec: 495643
URB status: Operation now in progress (-EINPROGRESS) (-115)
URB length [bytes]: 7
Data length [bytes]: 7
[Response in: 18]
[bInterfaceClass: HID (0x03)]
URB setup
bmRequestType: 0x21
0... .... = Direction: Host-to-device
.01. .... = Type: Class (0x01)
...0 0001 = Recipient: Interface (0x01)
bRequest: SET_REPORT (0x09)
wValue: 0x0210
ReportID: 16
ReportType: Output (2)
wIndex: 2
wLength: 7
0000 40 72 99 61 01 88 ff ff 53 02 00 06 01 00 00 00 @r.a....S.......
0010 22 ad e0 4f 00 00 00 00 1b 90 07 00 8d ff ff ff "..O............
0020 07 00 00 00 07 00 00 00 21 09 10 02 02 00 07 00 ........!.......
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 10 01 09 03 78 01 00 ....x..
</figure>
What's here interesting is the last part representing the data.
wLength
says that the length of the data is 7 bytes, so let's take a look at those 7
bytes:
10 01 09 03 78 01 00.
Well, actually, you can't decode them like that, unless you're a freak or a
Logitech engineer. And I have actually no idea what they mean. But sending
this to the keyboard will trigger an interesting thing: the keyboard will
start sending URB interrupt with some data without you pressing any more key.
The "light meter and battery values" packet
This is most interesting packet. This is the one sent by the keyboard to the
host and that contains the data we want to retrieve.
<figure>
Frame 1467: 84 bytes on wire (672 bits), 84 bytes captured (672 bits)
Frame Length: 84 bytes (672 bits)
Capture Length: 84 bytes (672 bits)
USB URB
URB id: 0xffff88010c43c380
URB type: URB_COMPLETE ('C')
URB transfer type: URB_INTERRUPT (0x01)
Endpoint: 0x83, Direction: IN
1... .... = Direction: IN (1)
.000 0011 = Endpoint value: 3
Device: 2
URB bus id: 6
Device setup request: not relevant ('-')
Data: present (0)
URB sec: 1334953309
URB usec: 728740
URB status: Success (0)
URB length [bytes]: 20
Data length [bytes]: 20
[Request in: 1466]
[Time from request: 0.992374000 seconds]
[bInterfaceClass: Unknown (0xffff)]
Leftover Capture Data: 1102091039000c061d474f4f4400000000000000
0000 80 c3 43 0c 01 88 ff ff 43 01 83 02 06 00 2d 00 ..C.....C.....-.
0010 5d c5 91 4f 00 00 00 00 a4 1e 0b 00 00 00 00 00 ]..O............
0020 14 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 ................
0030 02 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 ................
0040 11 02 09 10 39 00 0c 06 1d 47 4f 4f 44 00 00 00 ....9....GOOD...
0050 00 00 00 00 ....
</figure>
This packets come in regularly (1 per second) on the wire for some time once
you sent the "go for the light meter" packet. At one point they are emitted
less often and do not contain the value for the light meter anymore,
suggesting that the control packet sent earlier triggers the activation of
the light meter for a defined period.
Now you probably wonder where the data are in this. They're in the 20 bytes
leftover in the capture data part, indicated by Wireshark, at the end of the
packet:
11 02 09 10 39 00 0c 06 1d 47 4f 4f 44 00 00 00 00 00 00 00.
Fortunately, it was easy to decode. Knowing we're looking for 2 values
(battery charge and light meter), we just need to observe and compare the
packet emitted on the wire with the values displayed by the Logitech Solar
App.
To achieve this, I looked both at the
Logitech Solar App and
Wireshark
while bringing more and more light near the keyboard, increasing the lux
value received by the meter on the Solar App, and saw that the fields
represented in blue (see below) where changing in Wireshark. Since 2 bytes
were changing, I guessed that it was coded on 16 bits, and therefore it was
easy to correlate the value with the Solar App.
<figure>
[ ....9....GOOD....... ]
11 02 09 10 39 00 0c 06 1d 47 4f 4f 44 00 00 00 00 00 00 00
4 bytes - 1 byte for battery charge - 2 bytes for light meter - 2 bytes - 4 bytes for GOOD - 7 bytes
</figure>
In this example, the battery has a charge of
0x39 = 57 % and
the light meter receives
0x0c = 12 lux of light. It's basically
dark, and that makes sense: it was night and the light was off in my office,
the only light being the one coming from my screen.
I've no idea what the
GOOD part of the packet is about, but
it's present in every packet and it's actually very handy to recognize such
a packet. Therefore I'm considering this as some sort of useful mark for
now.
For the other bytes, they were always the same (
0x11 0x2 0x9
0x10 at the beginning, 7 times
0x00 at the end). The 2
bytes between the light meter and GOOD probably mean something, but I've no
idea what for now.
Building our solar app
Now we've enough information to build our own very basic solar application.
We know how to triggers the light meter, and we know how to decode the
packets.
We're going to write a small application using
libusb. Here's a quick example. It's not perfect
and does not check for error codes, be careful.
<figure>
/* Written by Julien Danjou <julien> in 2012 */
#include <linux/hid.h>
#include <libusb.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main(void)
libusb_context *ctx;
libusb_init(&ctx);
libusb_set_debug(ctx, 3);
/* Look at the keyboard based on vendor and device id */
libusb_device_handle *device_handle = libusb_open_device_with_vid_pid(ctx, 0x046d, 0xc52b);
fprintf(stderr, "Found keyboard 0x%p\n", device_handle);
libusb_device *device = libusb_get_device(device_handle);
struct libusb_device_descriptor desc;
libusb_get_device_descriptor(device, &desc);
for(uint8_t config_index = 0; config_index < desc.bNumConfigurations; config_index++)
struct libusb_config_descriptor *config;
libusb_get_config_descriptor(device, config_index, &config);
/* We know we want interface 2 */
int iface_index = 2;
const struct libusb_interface *iface = &config->interface[iface_index];
for (int altsetting_index = 0; altsetting_index < iface->num_altsetting; altsetting_index++)
const struct libusb_interface_descriptor *iface_desc = &iface->altsetting[al>tsetting_index];
if (iface_desc->bInterfaceClass == LIBUSB_CLASS_HID)
libusb_detach_kernel_driver(device_handle, iface_index);
libusb_claim_interface(device_handle, iface_index);
unsigned char ret[65535];
unsigned char payload[] = "\x10\x02\x09\x03\x78\x01\x00";
if(libusb_control_transfer(device_handle,
LIBUSB_REQUEST_TYPE_CLASS LIBUSB_RECIPIENT_INTERFACE,
HID_REQ_SET_REPORT,
0x0210, iface_index, payload, sizeof(payload) - 1, 10000))
int actual_length = 0;
while(actual_length != 20 strncmp((const char *) &ret[9], "GOOD", 4))
libusb_interrupt_transfer(device_handle,
iface_desc->endpoint[0].bEndpointAddress,
ret, sizeof(ret), &actual_length, 100000);
uint16_t lux = ret[5] << 8 ret[6];
fprintf(stderr, "Charge: %d %%\nLight: %d lux\n", ret[4], lux);
libusb_release_interface(device_handle, iface_index);
libusb_attach_kernel_driver(device_handle, iface_index);
libusb_close(device_handle);
libusb_exit(ctx);
</figure>
What the program is doing is the following:
- Request for the Unifying Receiver device based on vendor and product ID
- Get the HID interface
- Detach the HID interface from the kernel driver
- Claim the interface
- Send a control packets, were parameters are defined using the same data we captured earlier
- Read interrupt packets coming in until we receive one we recognize (length
20 containing the "GOOD" string)
- Decode the content (battery charge & light meter)
- Release the interface
- Reattach the kernel driver to the interface
This gives the following:
Found keyboard 0x0x24ec8e0
Charge: 64 %
Light: 21 lux
Challenge accomplished!
To be continued
Unfortunately, this approach has at least one major drawback. We have to
disconnect the
Logitech Unifying Receiver from the kernel. That means that
while we're waiting for the packet, we're dropping packets corresponding to
other events from every connected device (key presses, pointer motions ).
In order to solve that, I sent a request for help on the
linux-input mailing
list. That way, I learned that Logitech is actually using the HID++ protocol
to communicate with the devices using the Unifying Receiver.
Lars-Dominik
Braun managed to get the HID++ specifications from Logitech
and
published
them
with their authorization.
This opens a whole new world. With that document, I may be able to
understand the part I reverse engineered and convert this to a more useful
and generic library using the hidraw interface (so we don't have to
disconnect the devices from the kernel driver).
Just set up 
Today, map in hand, I explored the "long valley, narrower than the great
dale in the South where the Gates of the river stood, and walled with lower
spurs of the Mountain".
Recently I've been wanting to replace my old point and shoot camera, a 
I used to recommend the GNOME desktop for simple users for two main
advantages over Windows:
Back in the dark ages of the web, before the introduction of 
I have also added a third line where the ligature is built from o
and e and the following style is applied to e :
Since fonts are needed, the rendering has been paused for 3.5 seconds
until Typekit was fully loaded. If we look more closely, we may also
notice we got a status 
