It is based on the wor on DK63 from smp4488.
VID 0x05AC
PID 0x024F
VID 0C45 is not used for this keyboard therefore for uploading the firmware via USB interface, it is needes to update the VIC and PID to the above.
For default flashing: Bus 001 Device 006: ID 0c45:7044 Microdia.
or Bus 001 Device 011: ID 0c45:7040 Microdia
For keyboard: Bus 001 Device 009: ID 05ac:024f Apple, Inc.
This project is to reverse engineer the Kmove / DIERYA DK63 to get QMK running on it. Use this information at your own risk. I'm not liable if you break something.
VS11K09A-1
/ Sonix SN32F248BF
Sonix SN32F248BF
porting guide
SN32F248BF
Keil packs~VSPW01
RGB MatrixPAR2801QN-GHVC
docsDownload this flashing software for windows: SONiX_USB_MCU_ISP_Tool_V2.3.1.7-.zip
Put your keyboard in boot/recovery/flash mode via connecting boot pin to ground before connecting the keyboard via USB.
Then flash the binary via the software after setting the following configuration:
Name | Start | End | Length | R | W | X | Volatile | Overlay | Type | Initialized | Byte Source | Source | Comment |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
ram | 00000000 | 0000ffff | 0x10000 | true | true | true | false | false | Default | true | File: blitzwolf-kb1.bin: 0x0 | Binary Loader | |
Boot-ROM | 1fff0000 | 1fff0bff | 0xc00 | true | true | false | false | false | Default | false | |||
SRAM | 20000000 | 20001fff | 0x2000 | true | true | false | false | false | Default | false | |||
SN_CT16B0 | 40000000 | 40001fff | 0x2000 | true | true | false | true | false | Default | false | Generated by SVD-Loader. | ||
SN_CT16B1 | 40002000 | 40003fff | 0x2000 | true | true | false | true | false | Default | false | |||
SN_WDT | 40010000 | 40011fff | 0x2000 | true | true | false | true | false | Default | false | Generated by SVD-Loader. | ||
SN_UART2 | 40012000 | 40013fff | 0x2000 | true | true | false | true | false | Default | false | |||
SN_UART1 | 40014000 | 40015fff | 0x2000 | true | true | false | true | false | Default | false | |||
SN_UART0 | 40016000 | 40017fff | 0x2000 | true | true | false | true | false | Default | false | |||
SN_I2C0 | 40018000 | 40019fff | 0x2000 | true | true | false | true | false | Default | false | |||
SN_SPI0 | 4001c000 | 4001dfff | 0x2000 | true | true | false | true | false | Default | false | Generated by SVD-Loader. | ||
SN_ADC | 40026000 | 40027fff | 0x2000 | true | true | false | true | false | Default | false | Generated by SVD-Loader. | ||
SN_PMU | 40032000 | 40033fff | 0x2000 | true | true | false | true | false | Default | false | Generated by SVD-Loader. | ||
SN_PFPA | 40042000 | 40043fff | 0x2000 | true | true | false | true | false | Default | false | Generated by SVD-Loader. | ||
SN_GPIO0 | 40044000 | 40045fff | 0x2000 | true | true | false | true | false | Default | false | |||
SN_GPIO1 | 40046000 | 40047fff | 0x2000 | true | true | false | true | false | Default | false | |||
SN_GPIO2 | 40048000 | 40049fff | 0x2000 | true | true | false | true | false | Default | false | |||
SN_GPIO3 | 4004a000 | 4004bfff | 0x2000 | true | true | false | true | false | Default | false | |||
SN_USB | 4005c000 | 4005dfff | 0x2000 | true | true | false | true | false | Default | false | Generated by SVD-Loader. | ||
SN_SYS1 | 4005e000 | 4005ffff | 0x2000 | true | true | false | true | false | Default | false | |||
SN_SYS0 | 40060000 | 40061fff | 0x2000 | true | true | false | true | false | Default | false | |||
SN_FMC | 40062000 | 40063fff | 0x2000 | true | true | false | true | false | Default | false |
Keyboard Layout www.keyboard-layout-editor.com
They seem to be driven by GPIO and transistors.
Appears to be an another ARM Cortex M0 MCU with UART and GPIO.
RCData 4000:0
, this is the hex file of the firmware4000:0
and choose Save Resource to BIN file
SN32F4xB
and then the firmware file.0C45
and enter 766B
for the PID.SN32F24X
config hereFirmware Updater Executable Analysis https://www.hybrid-analysis.com/sample/21cf79c4f5982e0d73e8269c03a043f16898292920074491d5452eea5155e1eb?environmentId=100
VS11K09A-1 VS 32-Bit Cortex-M0 Micro-Controller http://evision.net.cn/include/upload/kind/file/20190413/20190413174647_5965.pdf
DEF CON 26 IoT VILLAGE - Dennis Giese - How to modify ARM Cortex M based firmware A step by step app https://www.youtube.com/watch?v=Qvxa6o2oNS0
BalCCon2k16 - Travis Goodspeed - Nifty Tricks for ARM Firmware Reverse Engineering https://www.youtube.com/watch?v=GX8-K4TssjY
Getting STLink V2 Serial Number https://armprojects.wordpress.com/2016/08/21/debugging-multiple-stm32-in-eclipse-with-st-link-v2-and-openocd/
SUE 2017 - Reverse Engineering Embedded ARM Devices - by pancake https://www.youtube.com/watch?v=oXSx0Qo2Upk
Analyzing Keyboard Firmware https://mrexodia.github.io/reversing/2019/09/28/Analyzing-keyboard-firmware-part-1 https://mrexodia.github.io/reversing/2019/09/28/Analyzing-keyboard-firmware-part-2 https://mrexodia.github.io/reversing/2019/09/28/Analyzing-keyboard-firmware-part-3
Hacking the fx-CP400 https://the6p4c.github.io/2018/01/15/hacking-the-gc-part-1.html
Raspberry PI OpenOCD SWD / JTAG https://iosoft.blog/2019/01/28/raspberry-pi-openocd/
OpenOcd Creating Flash Drivers https://github.com/doctek/COOCDFlash/wiki/Creating-and-using-flash-drivers
Stack Exchange ARM Firmware Reverse Engineering Walkthrough https://reverseengineering.stackexchange.com/questions/15311/running-a-binary-identified-as-an-arm-excutable-by-binwalk-disasm/15317 https://reverseengineering.stackexchange.com/questions/15006/approach-to-extract-useful-information-from-binary-file
QMK Nuvoton Port PR [https://github.com/qmk/ChibiOS-Contrib/pull/10]