Overclock.net › Forums › Components › Mice › reverse engineering 3366
New Posts  All Forums:Forum Nav:

reverse engineering 3366

post #1 of 408
Thread Starter 
hopefully this thread doesn't get deleted for leaking too many of logitech's secrets biggrin.gif. oh well i'll back up all the information in here just in case

anyway i've been reverse engineering the 3366 to make my own mouse. plan is to make my own pcb and firmware and then stick it in a mouse that's reasonably shaped. why not just g502/303 pcb and frankenmouse? because that's boring

here's a dump of most of the stuff i've figured out

? means i'm unsure
?? means i'm really unsure

3366 pinout
Code:
MOT  1
                16      GND
SCLK    2
                15      3.3V VDDIO?? directly connected to mcu (for g303)
MOSI    3
                14      clock tuning square wave output
MISO    4
                13      3.3V VDD
NCS     5
                12      2.02V led power?
NC      6
                11      1.68V internal regulator output?
LED     7
                10      -LED (not connected to any trace on g303)
NC      8
                9       NC

g502 fpc connector pinout

1 to 14 from left to right
Code:
1  GND
2  3.3V LED something?, mcu output
3  GND
4  NCS
5  MISO (40k pullup input for mcu)
6  MOSI
7  SCLK
8  MOT
9  3.3V Vdd
10 connected to sensor pin 14 (clock tuning), 40k pullup input for mcu
11 3.3V Vdd
12 3.3V, connected to sensor pin 15 (VDDIO??), sensor board input, on g502 rises to 3.3V exactly as Vdd rises, but not shorted to Vdd
13 3.3V, sensor board output
14 3.3V, sensor board output

g303 pcb pictures
sensor, mcu, and some silkscreen removed to uncover traces

top:

bottom (flipped to align with top image):


sensor pixel array
6e975c08_ZD4DKQ6.png

40x40 pixels
estimated spacing between each pixel is 30.8 +- 1um

the sensor only uses 36x36 pixels though (see frame capture section below)

see post 105. the resolution of the imaged area is 800/inch. so the magnification of the lens is 1x. so the area of the mousepad the pixel array uses is 36/800 = 0.045in = 1.143mm

spi protocol
list of registers (functionality of most of them are unknown tongue.gif):
https://docs.google.com/spreadsheets/d/1dReGd09oq9VszvLSRh9nFZWW4f2LvZZUsj5OZ8EBYqU/edit?usp=sharing

power up procedure:
g502 (annotated): http://pastebin.com/TQmL6wA3
g303: http://pastebin.com/DH4K3Ege
they're identical except srom

a lot of stuff is similar to that of 9800.

motion burst read:
exact same procedure as 9800 but without the frame period bytes. see end of power up procedure for timings. the g502 and g303 do this once every 1ms, exactly synchronized to usb polling

cpi switching:
write 0x?? to register 0x0f.
the new cpi is (0x?? + 1) * 50
range is 50 (0x00) to 12800 (0xff). the 200-12000 limitation for logitech's 3366 mice are just a "software" limitation

angle snapping:
on:
write 0x80 to register 0x42
off:
write 0x00 to register 0x42

surface tuning:
default:
write 0x0a to register 0x2c
write 0x10 to register 0x2b
g440 preset in lgs:
write 0x34 to register 0x2c
write 0xe5 to register 0x2b
g240 preset in lgs:
write 0x1f to register 0x2c
write 0xd8 to register 0x2b

frame capture:
aka using mouse sensor as a camera
exactly same protocol as frame capture section in 9800 datasheet, except you read 1296 bytes and every byte you read after that is the same as the 1296th byte. 1296 = 36*36 which means the sensor only actually uses 36x36 pixels
see post 67 for pictures

clock tuning:
registers 0x3d and 0x4f control the clock frequency of the sensor in run and rest mode, respectively
toggling on the msb of one of the registers (e.g. writing 0x96) causes the 3366's pin 14 to output a square wave with frequency related to the bottom 5,6,or 7 (not sure) bits of the register (see second sheet of the google doc above). the g502 adjusts the value of the register until the square wave frequency is as close to 1000hz as possible. usually the adjustment is quite coarse and the final values are off by 20hz or so. to disable the square wave toggle off the msb of whichever register had it on. changing the register's lower bits while the msb is 0 doesn't do anything.

SROM dumps
version 0x07 (g502, firmware 88.2.16): http://pastebin.com/9tXC0XhF
version 0x08 (g303, firmware 95.1.24): http://pastebin.com/ZJQ2HjZj
version 0x09 (g303, firmware 95.2.26, g502 firmware 88.2.17): http://pastebin.com/WsLCeCdE
unless someone figures out how to understand these, the only interesting thing is that they're 4KB
Edited by qsxcv - 9/3/15 at 12:55pm
main
(15 items)
 
old
(14 items)
 
 
CPUMotherboardGraphicsRAM
4770k maximus vii impact nvidia gtx 970 crucial ballistix tactical 16gb 
Hard DriveCoolingOSMonitor
crucial mx100 noctua nh-c14 windows 7 ultimate sony cpd-g520 
KeyboardPowerCaseMouse
kbp v80 matias quiet silverstone sx500-lg ncase m1 v3 logitech g100s with mcu replaced by teensy2.0 
Mouse PadAudioAudio
allsop raindrop xl chord mojo hifiman re-600 
CPUMotherboardGraphicsRAM
i7 920 evga x58 sli le galaxy gtx 460 crucial something 3x1gb 
Hard DriveCoolingOSMonitor
intel 330 180gb scythe kotetsu windows 8.1 pro sony cpd-g520 
KeyboardPowerCaseMouse
logitech k120 silverstone st75f-gs nxzt h440 evga torq x5 
Mouse PadAudio
allsop raindrop mobo 
  hide details  
Reply
main
(15 items)
 
old
(14 items)
 
 
CPUMotherboardGraphicsRAM
4770k maximus vii impact nvidia gtx 970 crucial ballistix tactical 16gb 
Hard DriveCoolingOSMonitor
crucial mx100 noctua nh-c14 windows 7 ultimate sony cpd-g520 
KeyboardPowerCaseMouse
kbp v80 matias quiet silverstone sx500-lg ncase m1 v3 logitech g100s with mcu replaced by teensy2.0 
Mouse PadAudioAudio
allsop raindrop xl chord mojo hifiman re-600 
CPUMotherboardGraphicsRAM
i7 920 evga x58 sli le galaxy gtx 460 crucial something 3x1gb 
Hard DriveCoolingOSMonitor
intel 330 180gb scythe kotetsu windows 8.1 pro sony cpd-g520 
KeyboardPowerCaseMouse
logitech k120 silverstone st75f-gs nxzt h440 evga torq x5 
Mouse PadAudio
allsop raindrop mobo 
  hide details  
Reply
post #2 of 408
Dear Sir,

Please do whatever you like because it's your bought product and you can cut it or dice it anyway you like.

Logicrap and suck my royal ghoolies if they think they could do anything to stop you from doing this sort of thing sneaky.gif .

Besides it's nice to see a real go-getter making a better product than what Logicrap failed to produce in the first place. All you are doing is fixing their abortive attempts at selling garbage to the public, which they shouldn't of.

More power to you specool.gif .
post #3 of 408
Then there is myself that have a logitech webcam, keyboard, and mouse - no complaints biggrin.gif

But is my tech new, no not really - run of the mill stuff.

Its like corsair, i will not touch at all.

It seems to me, that companies such as mentioned were good, in fact really good yrs ago. And now whether it be greed, austerity...... Quality control, materials used, many now suck thumb.gif
post #4 of 408
Don't see why would Logitech or PixArt do anything about it. Not like he's trying to replicate their design for profit or anything. If he's researching tech to make a mouse for him self - there's no problem.

But hey, we'll find out soon enough.

Edit: And it's more of a "compiling a rough datasheet from w/e scraps I salvaged" type.
Edited by Melan - 6/19/15 at 3:38am
Obsidian
(17 items)
 
  
CPUMotherboardGraphicsRAM
Intel Core i7 3770K 4.5 @ 1.15v P8Z77-V PRO Gigabyte GTX 970 G1 Crucial 16Gb 
Hard DriveHard DriveCoolingOS
Samsung 840 Pro 128Gb WD Caviar Blue 500Gb Be Quiet! Dark Rock Pro 3 Windows 10 Enterprise LTSB 
MonitorMonitorKeyboardPower
BenQ XL2411T Acer S220HQL CM Storm Quickfire Rapid EVGA Supernova G2 650W 
CaseMouseMouse PadAudio
Corsair Obsidian 550D Logitech G403 Wireless Artisan Zero XSoft Large Audinst HUD-MX2 
Audio
Beyerdynamic DT 770 Pro 250 ohm 
  hide details  
Reply
Obsidian
(17 items)
 
  
CPUMotherboardGraphicsRAM
Intel Core i7 3770K 4.5 @ 1.15v P8Z77-V PRO Gigabyte GTX 970 G1 Crucial 16Gb 
Hard DriveHard DriveCoolingOS
Samsung 840 Pro 128Gb WD Caviar Blue 500Gb Be Quiet! Dark Rock Pro 3 Windows 10 Enterprise LTSB 
MonitorMonitorKeyboardPower
BenQ XL2411T Acer S220HQL CM Storm Quickfire Rapid EVGA Supernova G2 650W 
CaseMouseMouse PadAudio
Corsair Obsidian 550D Logitech G403 Wireless Artisan Zero XSoft Large Audinst HUD-MX2 
Audio
Beyerdynamic DT 770 Pro 250 ohm 
  hide details  
Reply
post #5 of 408
they will do when I grass him up biggrin.gif

ring ring - Mr Logi ........
post #6 of 408
Aren't there paid services that will scan chips for you with microscopes of extremely high magnification?
post #7 of 408
Thread Starter 
yea but that's kind of overkill...

just added the SROM to the op. only interesting thing is that it's 4KB. (for comparison 9800 was 3KB)
it's obtained by recording the powerup sequence on my oscilloscope and using a little program to process the data
main
(15 items)
 
old
(14 items)
 
 
CPUMotherboardGraphicsRAM
4770k maximus vii impact nvidia gtx 970 crucial ballistix tactical 16gb 
Hard DriveCoolingOSMonitor
crucial mx100 noctua nh-c14 windows 7 ultimate sony cpd-g520 
KeyboardPowerCaseMouse
kbp v80 matias quiet silverstone sx500-lg ncase m1 v3 logitech g100s with mcu replaced by teensy2.0 
Mouse PadAudioAudio
allsop raindrop xl chord mojo hifiman re-600 
CPUMotherboardGraphicsRAM
i7 920 evga x58 sli le galaxy gtx 460 crucial something 3x1gb 
Hard DriveCoolingOSMonitor
intel 330 180gb scythe kotetsu windows 8.1 pro sony cpd-g520 
KeyboardPowerCaseMouse
logitech k120 silverstone st75f-gs nxzt h440 evga torq x5 
Mouse PadAudio
allsop raindrop mobo 
  hide details  
Reply
main
(15 items)
 
old
(14 items)
 
 
CPUMotherboardGraphicsRAM
4770k maximus vii impact nvidia gtx 970 crucial ballistix tactical 16gb 
Hard DriveCoolingOSMonitor
crucial mx100 noctua nh-c14 windows 7 ultimate sony cpd-g520 
KeyboardPowerCaseMouse
kbp v80 matias quiet silverstone sx500-lg ncase m1 v3 logitech g100s with mcu replaced by teensy2.0 
Mouse PadAudioAudio
allsop raindrop xl chord mojo hifiman re-600 
CPUMotherboardGraphicsRAM
i7 920 evga x58 sli le galaxy gtx 460 crucial something 3x1gb 
Hard DriveCoolingOSMonitor
intel 330 180gb scythe kotetsu windows 8.1 pro sony cpd-g520 
KeyboardPowerCaseMouse
logitech k120 silverstone st75f-gs nxzt h440 evga torq x5 
Mouse PadAudio
allsop raindrop mobo 
  hide details  
Reply
post #8 of 408
Quote:
Originally Posted by qsxcv View Post

just added the SROM to the op. only interesting thing is that it's 4KB. (for comparison 9800 was 3KB)
it's obtained by recording the powerup sequence on my oscilloscope and using a little program to process the data

Eventually G303 owners will have a custom SROM?
post #9 of 408
Thread Starter 
i dont think anyone who doesn't work for a mouse-related company knows how to (meaningfully) edit the srom
main
(15 items)
 
old
(14 items)
 
 
CPUMotherboardGraphicsRAM
4770k maximus vii impact nvidia gtx 970 crucial ballistix tactical 16gb 
Hard DriveCoolingOSMonitor
crucial mx100 noctua nh-c14 windows 7 ultimate sony cpd-g520 
KeyboardPowerCaseMouse
kbp v80 matias quiet silverstone sx500-lg ncase m1 v3 logitech g100s with mcu replaced by teensy2.0 
Mouse PadAudioAudio
allsop raindrop xl chord mojo hifiman re-600 
CPUMotherboardGraphicsRAM
i7 920 evga x58 sli le galaxy gtx 460 crucial something 3x1gb 
Hard DriveCoolingOSMonitor
intel 330 180gb scythe kotetsu windows 8.1 pro sony cpd-g520 
KeyboardPowerCaseMouse
logitech k120 silverstone st75f-gs nxzt h440 evga torq x5 
Mouse PadAudio
allsop raindrop mobo 
  hide details  
Reply
main
(15 items)
 
old
(14 items)
 
 
CPUMotherboardGraphicsRAM
4770k maximus vii impact nvidia gtx 970 crucial ballistix tactical 16gb 
Hard DriveCoolingOSMonitor
crucial mx100 noctua nh-c14 windows 7 ultimate sony cpd-g520 
KeyboardPowerCaseMouse
kbp v80 matias quiet silverstone sx500-lg ncase m1 v3 logitech g100s with mcu replaced by teensy2.0 
Mouse PadAudioAudio
allsop raindrop xl chord mojo hifiman re-600 
CPUMotherboardGraphicsRAM
i7 920 evga x58 sli le galaxy gtx 460 crucial something 3x1gb 
Hard DriveCoolingOSMonitor
intel 330 180gb scythe kotetsu windows 8.1 pro sony cpd-g520 
KeyboardPowerCaseMouse
logitech k120 silverstone st75f-gs nxzt h440 evga torq x5 
Mouse PadAudio
allsop raindrop mobo 
  hide details  
Reply
post #10 of 408
Quote:
Originally Posted by qsxcv View Post

i dont think anyone who doesn't work for a mouse-related company knows how to (meaningfully) edit the srom

There might be some ways... wink.gif

I rather have Logitech offer an optional SROM instead of people having to be sneaking/creative.
New Posts  All Forums:Forum Nav:
  Return Home
  Back to Forum: Mice
Overclock.net › Forums › Components › Mice › reverse engineering 3366