reverse engineering 3366 - Overclock.net - An Overclocking Community

Forum Jump: 

reverse engineering 3366

Reply
 
Thread Tools
post #1 of 438 (permalink) Old 06-19-2015, 02:45 AM - Thread Starter
lololol
 
qsxcv's Avatar
 
Join Date: Feb 2014
Posts: 4,281
Rep: 369 (Unique: 152)
hopefully this thread doesn't get deleted for leaking too many of logitech's secrets biggrin.gif. oh well i'll back up all the information in here just in case

anyway i've been reverse engineering the 3366 to make my own mouse. plan is to make my own pcb and firmware and then stick it in a mouse that's reasonably shaped. why not just g502/303 pcb and frankenmouse? because that's boring

here's a dump of most of the stuff i've figured out

? means i'm unsure
?? means i'm really unsure

3366 pinout
Code:
MOT  1
                16      GND
SCLK    2
                15      3.3V VDDIO?? directly connected to mcu (for g303)
MOSI    3
                14      clock tuning square wave output
MISO    4
                13      3.3V VDD
NCS     5
                12      2.02V led power?
NC      6
                11      1.68V internal regulator output?
LED     7
                10      -LED (not connected to any trace on g303)
NC      8
                9       NC

g502 fpc connector pinout

1 to 14 from left to right
Code:
1  GND
2  3.3V LED something?, mcu output
3  GND
4  NCS
5  MISO (40k pullup input for mcu)
6  MOSI
7  SCLK
8  MOT
9  3.3V Vdd
10 connected to sensor pin 14 (clock tuning), 40k pullup input for mcu
11 3.3V Vdd
12 3.3V, connected to sensor pin 15 (VDDIO??), sensor board input, on g502 rises to 3.3V exactly as Vdd rises, but not shorted to Vdd
13 3.3V, sensor board output
14 3.3V, sensor board output

g303 pcb pictures
sensor, mcu, and some silkscreen removed to uncover traces

top:

bottom (flipped to align with top image):


sensor pixel array
6e975c08_ZD4DKQ6.png

40x40 pixels
estimated spacing between each pixel is 30.8 +- 1um

the sensor only uses 36x36 pixels though (see frame capture section below)

see post 105. the resolution of the imaged area is 800/inch. so the magnification of the lens is 1x. so the area of the mousepad the pixel array uses is 36/800 = 0.045in = 1.143mm

spi protocol
list of registers (functionality of most of them are unknown tongue.gif):
https://docs.google.com/spreadsheets/d/1dReGd09oq9VszvLSRh9nFZWW4f2LvZZUsj5OZ8EBYqU/edit?usp=sharing

power up procedure:
g502 (annotated): http://pastebin.com/TQmL6wA3
g303: http://pastebin.com/DH4K3Ege
they're identical except srom

a lot of stuff is similar to that of 9800.

motion burst read:
exact same procedure as 9800 but without the frame period bytes. see end of power up procedure for timings. the g502 and g303 do this once every 1ms, exactly synchronized to usb polling

cpi switching:
write 0x?? to register 0x0f.
the new cpi is (0x?? + 1) * 50
range is 50 (0x00) to 12800 (0xff). the 200-12000 limitation for logitech's 3366 mice are just a "software" limitation

angle snapping:
on:
write 0x80 to register 0x42
off:
write 0x00 to register 0x42

surface tuning:
default:
write 0x0a to register 0x2c
write 0x10 to register 0x2b
g440 preset in lgs:
write 0x34 to register 0x2c
write 0xe5 to register 0x2b
g240 preset in lgs:
write 0x1f to register 0x2c
write 0xd8 to register 0x2b

frame capture:
aka using mouse sensor as a camera
exactly same protocol as frame capture section in 9800 datasheet, except you read 1296 bytes and every byte you read after that is the same as the 1296th byte. 1296 = 36*36 which means the sensor only actually uses 36x36 pixels
see post 67 for pictures

clock tuning:
registers 0x3d and 0x4f control the clock frequency of the sensor in run and rest mode, respectively
toggling on the msb of one of the registers (e.g. writing 0x96) causes the 3366's pin 14 to output a square wave with frequency related to the bottom 5,6,or 7 (not sure) bits of the register (see second sheet of the google doc above). the g502 adjusts the value of the register until the square wave frequency is as close to 1000hz as possible. usually the adjustment is quite coarse and the final values are off by 20hz or so. to disable the square wave toggle off the msb of whichever register had it on. changing the register's lower bits while the msb is 0 doesn't do anything.

SROM dumps
version 0x07 (g502, firmware 88.2.16): http://pastebin.com/9tXC0XhF
version 0x08 (g303, firmware 95.1.24): http://pastebin.com/ZJQ2HjZj
version 0x09 (g303, firmware 95.2.26, g502 firmware 88.2.17): http://pastebin.com/WsLCeCdE
unless someone figures out how to understand these, the only interesting thing is that they're 4KB

too busy to check forums as regularly
pm me if i forget to respond
qsxcv is offline  
Sponsored Links
Advertisement
 
post #2 of 438 (permalink) Old 06-19-2015, 02:59 AM
- Insanity Beckons -
 
Elrick's Avatar
 
Join Date: Apr 2013
Posts: 3,977
Rep: 173 (Unique: 89)
Dear Sir,

Please do whatever you like because it's your bought product and you can cut it or dice it anyway you like.

Logicrap and suck my royal ghoolies if they think they could do anything to stop you from doing this sort of thing sneaky.gif .

Besides it's nice to see a real go-getter making a better product than what Logicrap failed to produce in the first place. All you are doing is fixing their abortive attempts at selling garbage to the public, which they shouldn't of.

More power to you specool.gif .
Elrick is offline  
post #3 of 438 (permalink) Old 06-19-2015, 03:11 AM
New to Overclock.net
 
ladcrooks's Avatar
 
Join Date: Feb 2011
Location: 10 drowning st
Posts: 4,918
Rep: 166 (Unique: 132)
Then there is myself that have a logitech webcam, keyboard, and mouse - no complaints biggrin.gif

But is my tech new, no not really - run of the mill stuff.

Its like corsair, i will not touch at all.

It seems to me, that companies such as mentioned were good, in fact really good yrs ago. And now whether it be greed, austerity...... Quality control, materials used, many now suck thumb.gif

There are 2 kinds of people I really admire in this world. Ones that say they are going to do something and do it! And ones that do something, and then say they have done it!
ladcrooks is offline  
Sponsored Links
Advertisement
 
post #4 of 438 (permalink) Old 06-19-2015, 04:34 AM
Mice is bad civilization
 
Melan's Avatar
 
Join Date: Feb 2015
Location: 0,0
Posts: 3,230
Rep: 109 (Unique: 83)
Don't see why would Logitech or PixArt do anything about it. Not like he's trying to replicate their design for profit or anything. If he's researching tech to make a mouse for him self - there's no problem.

But hey, we'll find out soon enough.

Edit: And it's more of a "compiling a rough datasheet from w/e scraps I salvaged" type.
Melan is offline  
post #5 of 438 (permalink) Old 06-19-2015, 05:48 AM
New to Overclock.net
 
ladcrooks's Avatar
 
Join Date: Feb 2011
Location: 10 drowning st
Posts: 4,918
Rep: 166 (Unique: 132)
they will do when I grass him up biggrin.gif

ring ring - Mr Logi ........

There are 2 kinds of people I really admire in this world. Ones that say they are going to do something and do it! And ones that do something, and then say they have done it!
ladcrooks is offline  
post #6 of 438 (permalink) Old 06-19-2015, 12:17 PM
AAGGHH~ MY EYES~ AAGGHH~
 
uaokkkkkkkk's Avatar
 
Join Date: Sep 2014
Posts: 3,552
Rep: 157 (Unique: 67)
Aren't there paid services that will scan chips for you with microscopes of extremely high magnification?
uaokkkkkkkk is offline  
post #7 of 438 (permalink) Old 06-20-2015, 08:02 PM - Thread Starter
lololol
 
qsxcv's Avatar
 
Join Date: Feb 2014
Posts: 4,281
Rep: 369 (Unique: 152)
yea but that's kind of overkill...

just added the SROM to the op. only interesting thing is that it's 4KB. (for comparison 9800 was 3KB)
it's obtained by recording the powerup sequence on my oscilloscope and using a little program to process the data

too busy to check forums as regularly
pm me if i forget to respond
qsxcv is offline  
post #8 of 438 (permalink) Old 06-20-2015, 09:01 PM
New to Overclock.net
 
popups's Avatar
 
Join Date: Jun 2012
Posts: 4,483
Rep: 142 (Unique: 79)
Quote:
Originally Posted by qsxcv View Post

just added the SROM to the op. only interesting thing is that it's 4KB. (for comparison 9800 was 3KB)
it's obtained by recording the powerup sequence on my oscilloscope and using a little program to process the data

Eventually G303 owners will have a custom SROM?
popups is offline  
post #9 of 438 (permalink) Old 06-20-2015, 09:03 PM - Thread Starter
lololol
 
qsxcv's Avatar
 
Join Date: Feb 2014
Posts: 4,281
Rep: 369 (Unique: 152)
i dont think anyone who doesn't work for a mouse-related company knows how to (meaningfully) edit the srom

too busy to check forums as regularly
pm me if i forget to respond
qsxcv is offline  
post #10 of 438 (permalink) Old 06-20-2015, 09:09 PM
New to Overclock.net
 
popups's Avatar
 
Join Date: Jun 2012
Posts: 4,483
Rep: 142 (Unique: 79)
Quote:
Originally Posted by qsxcv View Post

i dont think anyone who doesn't work for a mouse-related company knows how to (meaningfully) edit the srom

There might be some ways... wink.gif

I rather have Logitech offer an optional SROM instead of people having to be sneaking/creative.
popups is offline  
Reply

Quick Reply
Message:
Options

Register Now

In order to be able to post messages on the Overclock.net - An Overclocking Community forums, you must first register.
Please enter your desired user name, your email address and other required details in the form below.
User Name:
If you do not want to register, fill this field only and the name will be used as user name for your post.
Password
Please enter a password for your user account. Note that passwords are case-sensitive.
Password:
Confirm Password:
Email Address
Please enter a valid email address for yourself.
Email Address:

Log-in



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Show Printable Version Show Printable Version
Email this Page Email this Page


Forum Jump: 

Posting Rules  
You may post new threads
You may post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off