hopefully this thread doesn't get deleted for leaking too many of logitech's secrets
. oh well i'll back up all the information in here just in case
anyway i've been reverse engineering the 3366 to make my own mouse. plan is to make my own pcb and firmware and then stick it in a mouse that's reasonably shaped. why not just g502/303 pcb and frankenmouse? because that's boring
here's a dump of most of the stuff i've figured out
? means i'm unsure
?? means i'm really unsure
3366 pinout
Code:
g502 fpc connector pinout
1 to 14 from left to right
Code:
g303 pcb pictures
sensor, mcu, and some silkscreen removed to uncover traces
top:
bottom (flipped to align with top image):
sensor pixel array
40x40 pixels
estimated spacing between each pixel is 30.8 +- 1um
the sensor only uses 36x36 pixels though (see frame capture section below)
see post 105. the resolution of the imaged area is 800/inch. so the magnification of the lens is 1x. so the area of the mousepad the pixel array uses is 36/800 = 0.045in = 1.143mm
spi protocol
list of registers (functionality of most of them are unknown
):
https://docs.google.com/spreadsheets/d/1dReGd09oq9VszvLSRh9nFZWW4f2LvZZUsj5OZ8EBYqU/edit?usp=sharing
power up procedure:
g502 (annotated): http://pastebin.com/TQmL6wA3
g303: http://pastebin.com/DH4K3Ege
they're identical except srom
a lot of stuff is similar to that of 9800.
motion burst read:
exact same procedure as 9800 but without the frame period bytes. see end of power up procedure for timings. the g502 and g303 do this once every 1ms, exactly synchronized to usb polling
cpi switching:
write 0x?? to register 0x0f.
the new cpi is (0x?? + 1) * 50
range is 50 (0x00) to 12800 (0xff). the 200-12000 limitation for logitech's 3366 mice are just a "software" limitation
angle snapping:
on:
write 0x80 to register 0x42
off:
write 0x00 to register 0x42
surface tuning:
default:
write 0x0a to register 0x2c
write 0x10 to register 0x2b
g440 preset in lgs:
write 0x34 to register 0x2c
write 0xe5 to register 0x2b
g240 preset in lgs:
write 0x1f to register 0x2c
write 0xd8 to register 0x2b
frame capture:
aka using mouse sensor as a camera
exactly same protocol as frame capture section in 9800 datasheet, except you read 1296 bytes and every byte you read after that is the same as the 1296th byte. 1296 = 36*36 which means the sensor only actually uses 36x36 pixels
see post 67 for pictures
clock tuning:
registers 0x3d and 0x4f control the clock frequency of the sensor in run and rest mode, respectively
toggling on the msb of one of the registers (e.g. writing 0x96) causes the 3366's pin 14 to output a square wave with frequency related to the bottom 5,6,or 7 (not sure) bits of the register (see second sheet of the google doc above). the g502 adjusts the value of the register until the square wave frequency is as close to 1000hz as possible. usually the adjustment is quite coarse and the final values are off by 20hz or so. to disable the square wave toggle off the msb of whichever register had it on. changing the register's lower bits while the msb is 0 doesn't do anything.
SROM dumps
version 0x07 (g502, firmware 88.2.16): http://pastebin.com/9tXC0XhF
version 0x08 (g303, firmware 95.1.24): http://pastebin.com/ZJQ2HjZj
version 0x09 (g303, firmware 95.2.26, g502 firmware 88.2.17): http://pastebin.com/WsLCeCdE
unless someone figures out how to understand these, the only interesting thing is that they're 4KB
anyway i've been reverse engineering the 3366 to make my own mouse. plan is to make my own pcb and firmware and then stick it in a mouse that's reasonably shaped. why not just g502/303 pcb and frankenmouse? because that's boring
here's a dump of most of the stuff i've figured out
? means i'm unsure
?? means i'm really unsure
3366 pinout
Code:
Code:
MOT 1
16 GND
SCLK 2
15 3.3V VDDIO?? directly connected to mcu (for g303)
MOSI 3
14 clock tuning square wave output
MISO 4
13 3.3V VDD
NCS 5
12 2.02V led power?
NC 6
11 1.68V internal regulator output?
LED 7
10 -LED (not connected to any trace on g303)
NC 8
9 NC
1 to 14 from left to right
Code:
Code:
1 GND
2 3.3V LED something?, mcu output
3 GND
4 NCS
5 MISO (40k pullup input for mcu)
6 MOSI
7 SCLK
8 MOT
9 3.3V Vdd
10 connected to sensor pin 14 (clock tuning), 40k pullup input for mcu
11 3.3V Vdd
12 3.3V, connected to sensor pin 15 (VDDIO??), sensor board input, on g502 rises to 3.3V exactly as Vdd rises, but not shorted to Vdd
13 3.3V, sensor board output
14 3.3V, sensor board output
sensor, mcu, and some silkscreen removed to uncover traces
top:
bottom (flipped to align with top image):
sensor pixel array
40x40 pixels
estimated spacing between each pixel is 30.8 +- 1um
the sensor only uses 36x36 pixels though (see frame capture section below)
see post 105. the resolution of the imaged area is 800/inch. so the magnification of the lens is 1x. so the area of the mousepad the pixel array uses is 36/800 = 0.045in = 1.143mm
spi protocol
list of registers (functionality of most of them are unknown
https://docs.google.com/spreadsheets/d/1dReGd09oq9VszvLSRh9nFZWW4f2LvZZUsj5OZ8EBYqU/edit?usp=sharing
power up procedure:
g502 (annotated): http://pastebin.com/TQmL6wA3
g303: http://pastebin.com/DH4K3Ege
they're identical except srom
a lot of stuff is similar to that of 9800.
motion burst read:
exact same procedure as 9800 but without the frame period bytes. see end of power up procedure for timings. the g502 and g303 do this once every 1ms, exactly synchronized to usb polling
cpi switching:
write 0x?? to register 0x0f.
the new cpi is (0x?? + 1) * 50
range is 50 (0x00) to 12800 (0xff). the 200-12000 limitation for logitech's 3366 mice are just a "software" limitation
angle snapping:
on:
write 0x80 to register 0x42
off:
write 0x00 to register 0x42
surface tuning:
default:
write 0x0a to register 0x2c
write 0x10 to register 0x2b
g440 preset in lgs:
write 0x34 to register 0x2c
write 0xe5 to register 0x2b
g240 preset in lgs:
write 0x1f to register 0x2c
write 0xd8 to register 0x2b
frame capture:
aka using mouse sensor as a camera
exactly same protocol as frame capture section in 9800 datasheet, except you read 1296 bytes and every byte you read after that is the same as the 1296th byte. 1296 = 36*36 which means the sensor only actually uses 36x36 pixels
see post 67 for pictures
clock tuning:
registers 0x3d and 0x4f control the clock frequency of the sensor in run and rest mode, respectively
toggling on the msb of one of the registers (e.g. writing 0x96) causes the 3366's pin 14 to output a square wave with frequency related to the bottom 5,6,or 7 (not sure) bits of the register (see second sheet of the google doc above). the g502 adjusts the value of the register until the square wave frequency is as close to 1000hz as possible. usually the adjustment is quite coarse and the final values are off by 20hz or so. to disable the square wave toggle off the msb of whichever register had it on. changing the register's lower bits while the msb is 0 doesn't do anything.
SROM dumps
version 0x07 (g502, firmware 88.2.16): http://pastebin.com/9tXC0XhF
version 0x08 (g303, firmware 95.1.24): http://pastebin.com/ZJQ2HjZj
version 0x09 (g303, firmware 95.2.26, g502 firmware 88.2.17): http://pastebin.com/WsLCeCdE
unless someone figures out how to understand these, the only interesting thing is that they're 4KB