Overclock.net banner

reverse engineering 3366

137K views 446 replies 74 participants last post by  TheBonfiggy 
#1 ·
hopefully this thread doesn't get deleted for leaking too many of logitech's secrets
biggrin.gif
. oh well i'll back up all the information in here just in case

anyway i've been reverse engineering the 3366 to make my own mouse. plan is to make my own pcb and firmware and then stick it in a mouse that's reasonably shaped. why not just g502/303 pcb and frankenmouse? because that's boring

here's a dump of most of the stuff i've figured out

? means i'm unsure
?? means i'm really unsure

3366 pinout

Code:

Code:
MOT  1
                16      GND
SCLK    2
                15      3.3V VDDIO?? directly connected to mcu (for g303)
MOSI    3
                14      clock tuning square wave output
MISO    4
                13      3.3V VDD
NCS     5
                12      2.02V led power?
NC      6
                11      1.68V internal regulator output?
LED     7
                10      -LED (not connected to any trace on g303)
NC      8
                9       NC
g502 fpc connector pinout

1 to 14 from left to right

Code:

Code:
1  GND
2  3.3V LED something?, mcu output
3  GND
4  NCS
5  MISO (40k pullup input for mcu)
6  MOSI
7  SCLK
8  MOT
9  3.3V Vdd
10 connected to sensor pin 14 (clock tuning), 40k pullup input for mcu
11 3.3V Vdd
12 3.3V, connected to sensor pin 15 (VDDIO??), sensor board input, on g502 rises to 3.3V exactly as Vdd rises, but not shorted to Vdd
13 3.3V, sensor board output
14 3.3V, sensor board output
g303 pcb pictures
sensor, mcu, and some silkscreen removed to uncover traces

top:

bottom (flipped to align with top image):


sensor pixel array
6e975c08_ZD4DKQ6.png


40x40 pixels
estimated spacing between each pixel is 30.8 +- 1um

the sensor only uses 36x36 pixels though (see frame capture section below)

see post 105. the resolution of the imaged area is 800/inch. so the magnification of the lens is 1x. so the area of the mousepad the pixel array uses is 36/800 = 0.045in = 1.143mm

spi protocol
list of registers (functionality of most of them are unknown
tongue.gif
):
https://docs.google.com/spreadsheets/d/1dReGd09oq9VszvLSRh9nFZWW4f2LvZZUsj5OZ8EBYqU/edit?usp=sharing

power up procedure:
g502 (annotated): http://pastebin.com/TQmL6wA3
g303: http://pastebin.com/DH4K3Ege
they're identical except srom

a lot of stuff is similar to that of 9800.

motion burst read:
exact same procedure as 9800 but without the frame period bytes. see end of power up procedure for timings. the g502 and g303 do this once every 1ms, exactly synchronized to usb polling

cpi switching:
write 0x?? to register 0x0f.
the new cpi is (0x?? + 1) * 50
range is 50 (0x00) to 12800 (0xff). the 200-12000 limitation for logitech's 3366 mice are just a "software" limitation

angle snapping:
on:
write 0x80 to register 0x42
off:
write 0x00 to register 0x42

surface tuning:
default:
write 0x0a to register 0x2c
write 0x10 to register 0x2b
g440 preset in lgs:
write 0x34 to register 0x2c
write 0xe5 to register 0x2b
g240 preset in lgs:
write 0x1f to register 0x2c
write 0xd8 to register 0x2b

frame capture:
aka using mouse sensor as a camera
exactly same protocol as frame capture section in 9800 datasheet, except you read 1296 bytes and every byte you read after that is the same as the 1296th byte. 1296 = 36*36 which means the sensor only actually uses 36x36 pixels
see post 67 for pictures

clock tuning:
registers 0x3d and 0x4f control the clock frequency of the sensor in run and rest mode, respectively
toggling on the msb of one of the registers (e.g. writing 0x96) causes the 3366's pin 14 to output a square wave with frequency related to the bottom 5,6,or 7 (not sure) bits of the register (see second sheet of the google doc above). the g502 adjusts the value of the register until the square wave frequency is as close to 1000hz as possible. usually the adjustment is quite coarse and the final values are off by 20hz or so. to disable the square wave toggle off the msb of whichever register had it on. changing the register's lower bits while the msb is 0 doesn't do anything.

SROM dumps
version 0x07 (g502, firmware 88.2.16): http://pastebin.com/9tXC0XhF
version 0x08 (g303, firmware 95.1.24): http://pastebin.com/ZJQ2HjZj
version 0x09 (g303, firmware 95.2.26, g502 firmware 88.2.17): http://pastebin.com/WsLCeCdE
unless someone figures out how to understand these, the only interesting thing is that they're 4KB
 
See less See more
5
#2 ·
Dear Sir,

Please do whatever you like because it's your bought product and you can cut it or dice it anyway you like.

Logicrap and suck my royal ghoolies if they think they could do anything to stop you from doing this sort of thing
sneaky.gif
.

Besides it's nice to see a real go-getter making a better product than what Logicrap failed to produce in the first place. All you are doing is fixing their abortive attempts at selling garbage to the public, which they shouldn't of.

More power to you
specool.gif
.
 
#3 ·
Then there is myself that have a logitech webcam, keyboard, and mouse - no complaints
biggrin.gif


But is my tech new, no not really - run of the mill stuff.

Its like corsair, i will not touch at all.

It seems to me, that companies such as mentioned were good, in fact really good yrs ago. And now whether it be greed, austerity...... Quality control, materials used, many now suck
thumb.gif
 
#4 ·
Don't see why would Logitech or PixArt do anything about it. Not like he's trying to replicate their design for profit or anything. If he's researching tech to make a mouse for him self - there's no problem.

But hey, we'll find out soon enough.

Edit: And it's more of a "compiling a rough datasheet from w/e scraps I salvaged" type.
 
#7 ·
yea but that's kind of overkill...

just added the SROM to the op. only interesting thing is that it's 4KB. (for comparison 9800 was 3KB)
it's obtained by recording the powerup sequence on my oscilloscope and using a little program to process the data
 
#12 ·
#17 ·
#18 ·
Once again I am reminded of the sheer laziness of Pixart. Gotta love the monopoly they have going.

I sometimes wonder if Razer had to grease Avago's hands with even more money to get the NDC firmware for the deathadder back in the day. Especially now that I know the Copperhead's 6.21NDC firmware has disappeared off the internet.

Anyway, nice to see progress pics. It's a pipe dream at this point to have that sensor connected to something else. But it's still fun to think about.
 
#19 ·
Quote:
Originally Posted by qsxcv View Post

yea until logitech sues you
biggrin.gif
Well to be fair, you would still have to buy a G502.

If anything it's a subtle hint to Logitech to rethink their shapes. The problem with their shapes is rather simple: "Hate" or "Love".

Some other shapes from other brands can be "in between". Or "good enough", ... anyways you get the point.
 
#20 ·
so what mouse shell should i stick the thing in?
im looking for something similar to g100s with a 9800/9500sensor (since 3366 has same lens alignment grooves)

i got a evga torq x5l but it's kinda cramped
 
This is an older thread, you may not receive a response, and could be reviving an old thread. Please consider creating a new thread.
Top