[device-report] Glorious Model O

crashniels commented 3 months ago

Device Info

Sinowealth Device: unknown
IC Label: BY8948-00006
Product Page: https://web.archive.org/web/20220609205659mp/https://www.gloriousgaming.com/products/glorious-model-o-black_

Part Info

firmware_size: 61440
vendor_id: 0x258a
product_id: 0x0036
bootloader_size: 4096 # necessary if not default
page_size: 2048 # necessary if not default
isp_usage_page: 0xff00 # necessary if not default
isp_usage: 0x0001 # necessary if not default
isp_index: 0 # necessary if not default

Operations Tested

[x] Read
[ ] Write

Platforms Tested

[x] linux
[ ] macos
[ ] windows

Checksums

Bootloader MD5: 46459c31e58194fa076b8ce8fb1f3eaa
Stock Firmware MD5: a16ac7d66d970b0c574870eaf7ba8302

HID Dump

A dump from usbhid-dump, win-hid-dump or mac-hid-dump

HID Tool Output

``` 003:012:001:DESCRIPTOR 1711043772.918294 05 01 09 06 A1 01 85 01 05 07 19 E0 29 E7 15 00 25 01 75 01 95 08 81 02 95 06 75 08 15 00 26 FF 00 05 07 19 00 2A FF 00 81 00 C0 06 0C 00 09 01 A1 01 85 02 25 01 15 00 75 01 0A B5 00 0A B6 00 0A B7 00 0A CD 00 0A E2 00 0A A2 00 0A E9 00 0A EA 00 95 08 81 03 0A 83 01 0A 94 01 0A 86 01 0A 88 01 0A 8A 01 0A 92 01 0A A8 02 0A 84 01 95 08 81 03 0A 21 02 0A 23 02 0A 24 02 0A 25 02 0A 26 02 0A 27 02 0A 2A 02 0A B1 02 95 08 81 03 C0 06 00 FF 09 01 A1 01 85 04 15 00 26 FF 00 09 00 75 08 96 07 02 B1 02 C0 06 00 FF 09 01 A1 01 85 07 15 00 26 FF 00 09 00 75 08 95 07 81 00 C0 06 00 FF 09 01 A1 01 85 05 15 00 26 FF 00 09 00 95 05 75 08 B1 02 C0 003:012:000:DESCRIPTOR 1711043772.921288 05 01 09 02 A1 01 09 01 A1 00 05 09 19 01 29 05 15 00 25 01 75 01 95 05 81 02 95 03 81 01 05 01 09 30 09 31 16 00 80 26 FF 7F 75 10 95 02 81 06 09 38 15 80 25 7F 75 08 95 01 81 06 05 0C 0A 38 02 95 01 81 06 C0 C0 ```

Device seems to enter bootloader mode but fails to find device after. The mouse will enumerate as 0603:1021 Novatek Microelectronics Corp.

I ran

sudo ./sinowealth-kb-tool read \
                 --vendor_id 0x258A \
                 --product_id 0x0036 \
                 --firmware_size 61440 \
                 --bootloader_size 4096 \
                 --page_size 2048 \
                 --isp_iface_num 1 \
                 --isp_usage_page 0xff00 \
                 --isp_usage 0x0001 \
                 --isp_index 0 \
                 --reboot false \
                 ModelO.hex

with --isp_index 0, 1 or 2 same result.

Hamza-beta commented 3 months ago

Hello Am sorry to post here but can you help me am looking for the datasheet for the SH68F88 mcu bur i couldn't find anything with google except your efforts with the firmware if tou have one please help me find one And thank you

carlossless commented 3 months ago

@crashniels all of the bootloaders encountered so far used the 0x1020 pid, this is the first one that I see with 0x1021!

I changed the predicate to include it on this branch (prebuilt binaries). Can you please try using this version against your device?

carlossless commented 3 months ago

@Hamza-beta

Hello Am sorry to post here but can you help me am looking for the datasheet for the SH68F88 mcu bur i couldn't find anything with google except your efforts with the firmware if tou have one please help me find one And thank you

Unfortunatelly, I haven't found any datasheets for SH68F88 or SH68F881 MCUs so far. If it exists somewhere, I would love to get it also.

I'm also curious which sinowealth part BY8948 corresponds to...

crashniels commented 3 months ago

@crashniels all of the bootloaders encountered so far used the 0x1020 pid, this is the first one that I see with 0x1021!

I changed the predicate to include it on this branch (prebuilt binaries). Can you please try using this version against your device?

That seems to have worked. a16ac7d66d970b0c574870eaf7ba8302 for firmware and 46459c31e58194fa076b8ce8fb1f3eaa for bootloader.

crashniels commented 3 months ago

@Hamza-beta

Hello Am sorry to post here but can you help me am looking for the datasheet for the SH68F88 mcu bur i couldn't find anything with google except your efforts with the firmware if tou have one please help me find one And thank you

Unfortunatelly, I haven't found any datasheets for SH68F88 or SH68F881 MCUs so far. If it exists somewhere, I would love to get it also.

I'm also curious which sinowealth part BY8948 corresponds to...

I would also love to know. On Aliexpress you can find very similar looking mice like the Model O or the Trust mouse with the same software and very similar hardware. The Model D is also pretty much the same as the Model O just with a different PID.

The Model O uses a 48 pin MCU and the Trust has a 28 pin MCU if that can give any clues on what it might be.

carlossless commented 3 months ago

@crashniels I looked up the catalog, and assuming it's it includes these parts, I would guess that the 48pin MCU should be SH68F1000 or SH68F1001

No idea about the 28-pin one though. I assume that the only way to verify the mcu model would be via the jtag interface with a sinolink/ProWritter or Arduino/sinowealth-8051-dumper though you would have to find the JTAG pins first.

Do you happen to have a picture of the PCB? Could you post it here? Perhaps there is a visible JTAG/programming header?

carlossless commented 3 months ago

@crashniels ~also, to verify, is the pid of this keyboard: 0x0036?~ Yep it is.

carlossless commented 3 months ago

@crashniels I went ahead and bought a used Glorious Model O to confirm a couple of these details.

Based on the info I got from sniffing the prowritter<->sinolink configuration packets, it seems like BY8948 is SH68F89.

Naturally, to get that info, I had to hook it up to the sinolink. Fortunately, programming pins were easy to find on this mouse: glorious-model-o-jtag

@gashtaan I wasn't able to get sinowealth-8051-dumper working on this device. Looking at prowriter, it seems that it allows only one type of programming method (unlike devices like sh68f90, which allows both JTAG and SWE). I didn't go beyond trying to confirm anything further.

gashtaan commented 3 months ago

@carlossless Thanks for the info. According to *.opt files the SH68F89 should be the same chip type as SH68F881 which works ok, so I can't even guess why it doesn't work. My dumper tool tries both JTAG and SWE methods to dump the firmware, so problem is probably elsewhere. If I ever get my hands on this mouse I'll give it a try.

fucksophie commented 2 months ago

Do I have a different version of the Model O, or is something wrong? It shows up as Bus 003 Device 003: ID 258a:0036 SINOWEALTH Wired Gaming Mouse in lsusb, and when I try using sinowealth-kb-tool, MD5 for the firmware shows up as 1dba8eb95a0e363900799cdfee0d76ff and bootloader is cfc8661da8c9d7e351b36c0a763426aa.

crashniels commented 2 months ago

Did you ever use the official software to update it ? I'm sure mine was on latest.

fucksophie commented 2 months ago

No, never did. Model_O_old.zip

carlossless / sinowealth-kb-tool