====== Test Data ====== This page just shows some test data and notes that were made during the reverse engineering process, only read this if you don't understand something on the [[USB Protocol Information]] page. Testing Modifier Keys ===================== Assigned key 1 to "shift" and switched to app with profile (other keys came from global profile) 000003: Bulk or Interrupt Transfer (UP), 06.02.2007 14:50:42.4375000 +5.0312500 Pipe Handle: 0x88094694 (Endpoint Address: 0x2) Send 0x10 bytes to the device: 02 00 00 01 00 01 01 01 00 00 00 00 00 00 00 00 ................ 000004: Bulk or Interrupt Transfer (UP), 06.02.2007 14:50:42.4843750 +0.0468750 Pipe Handle: 0x88094694 (Endpoint Address: 0x2) Send 0x30 bytes to the device: 03 01 02 02 02 03 00 03 03 00 04 03 00 0E 03 00 ................ 03 12 03 00 18 03 00 1B 03 00 29 03 00 2C 03 00 ..........)..,.. 02 00 00 01 00 00 01 01 00 00 00 00 00 00 00 00 ................ Testing Serial Number / Device Information ========================================== Ran ryan's dzassign using the default config file it shipped with. serial number reported as before. 000003: Bulk or Interrupt Transfer (UP), 06.02.2007 20:40:55.3750000 +363.2343750 Pipe Handle: 0x87797214 (Endpoint Address: 0x2) Send 0xa0 bytes to the device: 02 00 00 01 00 01 01 01 00 00 00 00 00 00 00 00 ................ 03 17 01 29 1F 01 3A 20 01 3B 21 01 3C 22 01 3D ...)..: .;!.<".= 03 23 01 3E 1E 01 35 01 01 1E 02 01 1F 03 01 20 .#.>..5........ 03 04 01 21 05 01 22 18 01 23 16 01 2B 06 01 14 ...!.."..#..+... 03 07 01 1A 08 01 08 09 01 15 0A 01 17 1A 01 39 ...............9 03 0B 01 04 0C 01 16 0D 01 07 0E 01 09 0F 01 0A ................ 03 15 02 02 11 01 1D 10 01 1B 12 01 06 13 01 19 ................ 03 14 01 05 19 02 01 1B 02 08 1C 02 04 1D 01 2C ..............., 02 00 00 01 00 00 01 01 00 00 00 00 00 00 00 00 ................ 0A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 000004: Bulk or Interrupt Transfer (UP), 06.02.2007 20:40:55.3906250 +0.0156250 Pipe Handle: 0x877971f4 (Endpoint Address: 0x82) Get 0x10 bytes from the device: 0A 05 28 95 01 31 97 14 4C 01 01 00 00 00 00 00 ..(?.1?.L....... Testing immovable buttons at upper right of pad =============================================== receiving data from "control" device: Start listening to Pipe82 01 04 01 01 02 00 00 00 00 00 00 00 00 00 00 00 | ................ Hand pressed 01 04 01 01 00 00 00 00 00 00 00 00 00 00 00 00 | ................ Record pressed 01 04 01 01 02 00 00 00 00 00 00 00 00 00 00 00 | ................ Record released 01 04 01 01 03 00 00 00 00 00 00 00 00 00 00 00 | ................ Hand released Stop listening to Pipe82 Start listening to Pipe82 01 04 01 01 02 00 00 00 00 00 00 00 00 00 00 00 | ................ Hand pressed 01 04 01 01 00 00 00 00 00 00 00 00 00 00 00 00 | ................ Record pressed 01 04 01 01 01 00 00 00 00 00 00 00 00 00 00 00 | ................ Hand released 01 04 01 01 03 00 00 00 00 00 00 00 00 00 00 00 | ................ Record released Stop listening to Pipe82 Start listening to Pipe82 01 04 01 01 02 00 00 00 00 00 00 00 00 00 00 00 | ................ Hand pressed 01 04 01 01 03 00 00 00 00 00 00 00 00 00 00 00 | ................ Hand released Stop listening to Pipe82 Start listening to Pipe82 01 04 01 01 01 00 00 00 00 00 00 00 00 00 00 00 | ................ Record pressed 01 04 01 01 03 00 00 00 00 00 00 00 00 00 00 00 | ................ Record released Stop listening to Pipe82 01 04 seems to be a status message, not just a key press message After sending 02 00 00 00 00 01 01 01 00 00 00 00 00 00 00 00 The output for the same sequence of events was as follows: Start listening to Pipe82 01 04 00 00 02 01 00 00 00 00 00 00 00 00 00 00 | ................ 01 04 00 00 00 01 00 00 00 00 00 00 00 00 00 00 | ................ 01 04 00 00 02 01 00 00 00 00 00 00 00 00 00 00 | ................ 01 04 00 00 03 01 00 00 00 00 00 00 00 00 00 00 | ................ Stop listening to Pipe82 Start listening to Pipe82 01 04 00 00 02 01 00 00 00 00 00 00 00 00 00 00 | ................ 01 04 00 00 00 01 00 00 00 00 00 00 00 00 00 00 | ................ 01 04 00 00 01 01 00 00 00 00 00 00 00 00 00 00 | ................ 01 04 00 00 03 01 00 00 00 00 00 00 00 00 00 00 | ................ Stop listening to Pipe82 Start listening to Pipe82 01 04 00 00 02 01 00 00 00 00 00 00 00 00 00 00 | ................ 01 04 00 00 03 01 00 00 00 00 00 00 00 00 00 00 | ................ Stop listening to Pipe82 Start listening to Pipe82 01 04 00 00 01 01 00 00 00 00 00 00 00 00 00 00 | ................ 01 04 00 00 03 01 00 00 00 00 00 00 00 00 00 00 | ................ Stop listening to Pipe82 Thus, byte 5 of the status message is mapped as follows: the last two bits: 0x00 - 00 - both buttons pressed 0x01 - 01 - record button pressed 0x02 - 10 - hand button pressed 0x03 - 11 - both buttons released so: the first bit (lsb) is 0 when the hand button is pressed, 1 otherwise the second bit is 0 when the record button is pressed, 1 otherwise The sixth byte of the status message is mapped as follows: 0x01 - keys enabled 0x00 - keys disabled Testing removable keys ====================== After programming the device with the following data 02000001000100000000000000000000 03010201020202030204040104050300 02000002000000000000000000000000 explained: first 16 bytes, green led on, red led off, disable keys second 16 bytes, program keys 1-5 with left ctrl, left shift, left alt, A and "macro" third 16 bytes, disable green led, enable red led. enable keys the following is then observed: pressing and releasing keys 1-4 results in the following HID device output 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ note, 8 bytes are sent for every key down or key up event pressing and releasing key 5 results in the following "control" device output 02 01 01 05 00 00 00 00 00 00 00 00 00 00 00 00 | ................ 02 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ note, 16 bytes are sent for every key down or up event holding down keys 1-5 results in the following HID device output 01 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 | ................ 07 00 00 00 00 00 00 00 07 00 04 00 00 00 00 00 | ................ (again, 8 bytes per key down event) and the following "control" device output 02 01 01 05 00 00 00 00 00 00 00 00 00 00 00 00 | ................ (again, 8 bytes per key down event) When all 5 keys are released the following is received by the HID device 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ (releasing all 5 keys at exact same moment is hard to do, hence two key up chunks, 8 bytes each) and the following "control" device output: 02 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ (again, 16 bytes for one keyup event) Testing Leds ============ 02000001000101010000000000000000 03010201020202030204000000000000 02000001000001010000000000000000 0A000000000000000000000000000000 Turn on red led 02 00 01 03 00 00 01 01 00 00 00 00 00 00 00 00 Turn on green led, turn off red led (reset device too?) 02 00 00 01 00 01 01 01 00 00 00 00 00 00 00 00 Turns off green led, turn off red led 02 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 Turn on red led, turn off green led 02 00 01 02 00 00 00 00 00 00 00 00 00 00 00 00 Turn on green led, turn off red led 02 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 Turn on greed and red led's 02 00 01 03 00 00 00 00 00 00 00 00 00 00 00 00 Disable Keys (6th byte to 0x01) 02 00 00 00 00 01 01 01 00 00 00 00 00 00 00 00 Enable keys (6th byte to 0x00) 02 00 00 00 00 00 01 01 00 00 00 00 00 00 00 00 02000001000100000000000000000000 03010201020202030204040104050300 02000002000000000000000000000000 0A000000000000000000000000000000 More testing of keys ==================== 02 00 00 01 00 01 00 00 00 00 00 00 00 00 00 00 03 010201 020202 030204 040104 050300 03 060300 070300 080210 090220 0A0240 03 28011E 27011F 260120 000000 000000 03 250121 240122 230123 220124 210125 03 200126 1F0127 000000 000000 000000 03 0F0300 100300 110300 000000 000000 02 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 02 00 00 00 01 00 00 00 00 00 00 00 00 <- NO EFFECT 02 00 00 02 00 00 00 00 01 00 00 00 00 00 00 00 <- ALSO NO EFFECT 02 00 00 02 00 00 00 01 01 00 00 00 00 00 00 00 <- NO EFFECT 02 00 00 02 00 00 01 01 00 00 00 00 00 00 00 00 TODO 02 00 00 02 00 00 01 00 00 00 00 00 00 00 00 00 TODO 03 01 02 01 02 02 02 03 02 04 04 01 04 05 03 00 03 05 03 00 06 03 00 28 01 1E 27 01 1F 26 01 20 0A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02000002000000000000000000000000 sending the follow block * sets green led on, red off * clears existing keymap * programs 3 keys * turns both led's off 02000001000100000000000000000000 032001261F0127000000000000000000 02000000000000000000000000000000 subsequently sending the following block * sets the red led on, green led off * leaves existing keymap intact * programs 5 more keys * turns both led's on 02000002000000000000000000000000 03250121240122230123220124210125 02000003000000000000000000000000 pressing and holding 6 "single key" keys gives: 00 00 27 00 00 00 00 00 00 00 27 26 00 00 00 00 | ..'.......'&.... | pressing 00 00 27 26 25 00 00 00 00 00 27 26 25 24 00 00 | ..'&%.....'&%$.. | 00 00 27 26 25 24 23 00 00 00 27 26 25 24 23 22 | ..'&%$#...'&%$#" | then the same keys are released, in the same order they were pressed gives: 00 00 26 25 24 23 22 00 00 00 25 24 23 22 00 00 | ..&%$#"...%$#".. | releasing 00 00 24 23 22 00 00 00 00 00 23 22 00 00 00 00 | ..$#".....#".... | 00 00 22 00 00 00 00 00 00 00 00 00 00 00 00 00 | .."............. | pressing them and holding the keys and releasing them in reverse order gives: 00 00 27 00 00 00 00 00 00 00 27 26 00 00 00 00 | ..'.......'&.... | pressing 00 00 27 26 25 00 00 00 00 00 27 26 25 24 00 00 | ..'&%.....'&%$.. | 00 00 27 26 25 24 23 00 00 00 27 26 25 24 23 22 | ..'&%$#...'&%$#" | 00 00 27 26 25 24 23 00 00 00 27 26 25 24 00 00 | ..'&%$#...'&%$.. | releasing 00 00 27 26 25 00 00 00 00 00 27 26 00 00 00 00 | ..'&%.....'&.... | 00 00 27 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..'............. | pressing and holding 3 "Modifier Key" and 3 "Single Key" gives: 01 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 | ................ | pressing 07 00 00 00 00 00 00 00 07 00 23 00 00 00 00 00 | ..........#..... | 07 00 23 24 00 00 00 00 07 00 23 24 25 00 00 00 | ..#$......#$%... | then the same keys are released, in the same order they were pressed gives: 06 00 23 24 25 00 00 00 04 00 23 24 25 00 00 00 | ..#$%.....#$%... | releasing 00 00 23 24 25 00 00 00 00 00 24 25 00 00 00 00 | ..#$%.....$%.... | 00 00 25 00 00 00 00 00 00 00 00 00 00 00 00 00 | ..%............. | pressing them and holding the keys and releasing them in reverse order gives: 01 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 | ................ | pressing 07 00 00 00 00 00 00 00 07 00 23 00 00 00 00 00 | ..........#..... | 07 00 23 24 00 00 00 00 07 00 23 24 25 00 00 00 | ..#$......#$%... | 07 00 23 24 00 00 00 00 07 00 23 00 00 00 00 00 | ..#$......#..... | releasing 07 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 | ................ | 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ | Thus we can assertain the following: It's possible to detect up-to 6 seperate key presses for "Single Key" and "Modifier Key" types. Additional testing revealed that attempting to press any more then 6 keys at a time had NO EFFECT. It was also found that you can only press up to 6 keys of ANY KIND ("Single", "Modifier" or "Macro") in ANY combination. Other notes regarding key programming. if you send and "program keys" commands (with existing keys already programmed) the newly programmed "single key" or "modifier key" key assignments have no effect until a "set device" command is issued - however newly programmed "macro key" assignments take effect immediately! Other tests =========== when the red light was on and no keys were held sending 01000000000000000000000000000000 resulted in 01 04 00 02 03 00 00 00 00 00 00 00 00 00 00 00 | ................ subsequently sending 02 00 00 01 00 01 00 00 00 00 00 00 00 00 00 00 (clear keys, set green led on, red led off) followed by 01000000000000000000000000000000 resulted in 01 04 00 01 03 01 00 00 00 00 00 00 00 00 00 00 | ................ holding down "record" and sending 01000000000000000000000000000000 resulted in (record button pressed, output from keypress ignored) 01 04 00 01 01 01 00 00 00 00 00 00 00 00 00 00 | ................ (record button released, output from keypress ignored) sending 02 00 00 01 00 01 00 00 00 00 00 00 00 00 00 00 followed by 01000000000000000000000000000000 resulted in 01 04 00 01 03 01 00 00 00 00 00 00 00 00 00 00 | ................ thus: the response from the 01 command is mapped as follows: Byte 1: response type 0x01 Byte 2: unknown, seen 0x04 only Byte 3: unknown, seen 0x00 only Byte 4: led bitmap Byte 5: button bitmap Byte 6: keys enabled bitmap (lsb: 0 = keys enabled, 1 = keys disabled) Bytes 7-16: unknowm, seen filled with 0x00's only More testing ============ 02 00 01 01 00 01 00 00 00 00 00 00 00 00 00 00 0A000000000000000000000000000000 Testing For "Test Mode" ======================= start monitoring 000047: Bulk or Interrupt Transfer (UP), 12.02.2007 20:30:42.5931250 +7.0468750 Pipe Handle: 0x86f5fdf4 (Endpoint Address: 0x2) Send 0x10 bytes to the device: 02 00 00 01 00 01 01 01 00 00 00 00 00 00 00 00 ................ 000048: Bulk or Interrupt Transfer (UP), 12.02.2007 20:30:42.6243750 +0.0312500 Pipe Handle: 0x86f5fdf4 (Endpoint Address: 0x2) Send 0x30 bytes to the device: 03 01 03 00 02 03 00 03 03 00 04 03 00 0E 03 00 ................ 03 12 03 00 18 03 00 29 03 00 2C 03 00 00 00 00 .......)..,..... 02 00 00 01 00 00 01 01 00 00 00 00 00 00 00 00 ................ switch to ergodex manager 000049: Bulk or Interrupt Transfer (UP), 12.02.2007 20:30:42.7025000 +0.0781250 Pipe Handle: 0x86f5fdf4 (Endpoint Address: 0x2) Send 0x10 bytes to the device: 02 00 01 01 00 00 01 01 00 00 00 00 00 00 00 00 ................ hold key 1 000050: Bulk or Interrupt Transfer (UP), 12.02.2007 20:30:45.3275000 +2.6250000 Pipe Handle: 0x86f5fdd4 (Endpoint Address: 0x82) Get 0x10 bytes from the device: 03 01 01 01 00 00 00 00 00 00 00 00 00 00 00 00 ................ hold key 2 000051: Bulk or Interrupt Transfer (UP), 12.02.2007 20:30:46.9212500 +1.5937500 Pipe Handle: 0x86f5fdd4 (Endpoint Address: 0x82) Get 0x10 bytes from the device: 03 01 01 01 02 00 00 00 00 00 00 00 00 00 00 00 ................ hold key 3 000052: Bulk or Interrupt Transfer (UP), 12.02.2007 20:30:48.5306250 +1.6093750 Pipe Handle: 0x86f5fdd4 (Endpoint Address: 0x82) Get 0x10 bytes from the device: 03 01 01 01 02 03 00 00 00 00 00 00 00 00 00 00 ................ release key 3 000053: Bulk or Interrupt Transfer (UP), 12.02.2007 20:30:50.0618750 +1.5312500 Pipe Handle: 0x86f5fdd4 (Endpoint Address: 0x82) Get 0x10 bytes from the device: 03 01 01 01 02 00 00 00 00 00 00 00 00 00 00 00 ................ release key 1 000054: Bulk or Interrupt Transfer (UP), 12.02.2007 20:30:51.4525000 +1.3906250 Pipe Handle: 0x86f5fdd4 (Endpoint Address: 0x82) Get 0x10 bytes from the device: 03 01 01 00 02 00 00 00 00 00 00 00 00 00 00 00 ................ release key 2 000055: Bulk or Interrupt Transfer (UP), 12.02.2007 20:30:55.9212500 +4.4687500 Pipe Handle: 0x86f5fdd4 (Endpoint Address: 0x82) Get 0x10 bytes from the device: 03 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ "exit and shutdown pad" from ergodex manager file menu 000056: Bulk or Interrupt Transfer (UP), 12.02.2007 20:31:09.4837500 +13.5625000 Pipe Handle: 0x86f5fdf4 (Endpoint Address: 0x2) Send 0x10 bytes to the device: 02 00 00 00 00 01 01 01 00 00 00 00 00 00 00 00 ................