juggernautjulian
commented
2 years ago Now there's a solution to change every key except for the FN-Key. Which is kind of hilarious given the time I invested.
I will give a detailed explanation with the hopes somebody else can work from that or can give me some hints.
Let's start from the beginning:
Getting the binary:
-
Once the PCB is accessed, partially remove the double-sided sticky tape and solder 4 wires to the PCB (3V3, SWDIO, SWDCLK, GND) (In theory the PCB doesn't need to be removed since the back of the keyboard mold has dedicated holes, which give you access to those pins. Practically to do that, the label sticker and the double-sided sticky tape which holds the pcb in place has to be pierced to get contact to those pins. I thought that's rather unreliable - given the fact that you want to be sure to have an uncorrupted binary.)
-
Get a nRF5x-compatible swd programmer and dump the flash (the NRF52832 is not locked) _(e.g an ESP32 with ESP32 nRF52SWD Flasher - many thanks to @atc1441.) (I dumped the flash twice and diffed the binarys - just to be sure.)_ My dump differs in some places from the one @krysoft posted here So it can be suspected that the FWs are somewhat unique - but I can't proof that
Inspecting the binary:
- First of all: backup your original binary.
- Then open a copy of the binary with an hex-editor of your choice. (e.g. GHex or HxD)
- There are 2 look-up-tables in the binary which translate the matrix-inputs into Usage IDs.
-- The first Look-Up-Table seem to start at
0x2CBF0and ends at0x2CC49. -- The second Look-Up-Table starts at0x4A6FAand ends at0x4A779-- The first LUT is used when the keyboard is connected via Bluetooth. -- The second LUT is used when the Keyboard is connected via the 2.4GHz-USB-Dongle. _(Information about Usage IDs: https://www.usb.org/sites/default/files/documents/hut1_12v2.pdf -> Page 53)_
Modifying the binary:
From the binary and the Usage-ID I derived a keyboard matrix. It is based on the on matrix @federvieh posted for the wired keyboard on reddit. As you can see the keyboard matrix of the wireless keyboard differs on column 10-15 from the matrix of the wired keyboard.
|---+----+--------+-----+----+----+------+----+----+----+----+-------+------+-------+------+--------------+-----------+--------|
| | | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10| 11 | 12 | 13 | 14 | 15 |
| | LUT| 0xE | 0x0 | 0x4| 0x2| 0x1 | 0x3| 0x6| 0x7| 0x5| 0xF | 0xD| 0x9 | 0xC | 0xA | 0x8 | 0x0B | <-offset_byte
|---+----+--------+-----+----+----+------+----+----+----+----+-------+------+-------+------+--------------+-----------+--------|
| 0 | 5 | | ESC | h | F4 | | g | | '" | F6 | | LALT | | UP | | F5 | |
| 1 | 0 | | `~ | 6 | F2 | F1 | 5 | F8 | -_ | = | LCTRL | | Insert| |Delete forward| F9 | PgUp |
| 2 | 2 | | q | u | e | w | r | o | p | i | | | | | | | |
| 3 | 1 | | 1 | 7 | 3 | 2 | 4 | 9 | 0 | 8 | |PrtScr| F12 | END | F11 | F10 | PgDown |
| 4 | 4 | | a | j | d | s | f | l | ;: | k | | | | | | \ PIPE | |
| 5 | 6 | RSHIFT | z | m | c | x | v | . | | , | RCTRL | | | | | RETURN | |
| 6 | 7 | | | n | | | b | | /? | | | RALT | RIGHT | LEFT | DOWN | SPACE | |
| 7 | 3 | LSHIFT | TAB | y | F3 | CAPS | t | F7 | [ | ] | | | | | | DEL/BKSPC | WIN |
|---+----+--------+-----+----+----+------+----+----+----+----+-------+------+-------+------+--------------+-----------+--------|
^offset_bitIf you want to know the address of a key. Calculate:
start_address_of_lut + offset_byte (column) * byte (0x08) + off_set_bit (row).
- e.g., if you want to know the address of the PgDn-Key in the first LUT (Bluetooth)
calculate:
0x2CBF0 + 0xB (offset_byte) *0x8 (byte) + 0x1 (offset_bit)-> 0x2CC49
The value of address 0x2CC49 is 0x4E, which is a PgDn-Command (see Usage-ID PDF Page 55)
- e.g., if you want to know the address of the PgUp-Key in the second LUT (2.4GHz-Dongle)
calculate:
0x4A6FA + 0xB (offset_byte) *0x8 (byte) + 0x0 (offset_bit)-> 0x4A752
The value of address 0x4A752 is 0x4B, which is a PgUp-Command (see Usage-ID PDF Page 55)
If you replace a value with 0x00 the corresponding key will be deactivated. If you insert other Usage-IDs in there, the key will become the command represented by the new usage-id.
But what about the FN-Key? In the wireless version of the keyboard the FN-Key has a dedicated IO. Which is PIN 8 (P0.06); pulled up - active low. (PIN 18 on the ZIF-Connector (see picture - the trace with the via right next to the ZIF-Connector) Meaning the FN-Key is not part of the keyboard matrix. A simple replacement with another Usage-ID (e.g. LSHIFT - 0xE0) seems not possible. One approach would be to look for pieces in the binary where the P0.06 is read and find a solution from there. But at the moment I didn't fully understand how that works. (E.g. The data in PIN_CNF[6] @ 0x718 make no sense to me.)
So I'm out of ideas... I found the tables by staring at the binary for hours and searching for logical usage id strings. The use of a disassembler would be useful, but I'm not familiar with that.
boryspoplawski
lgg
csdvrx
WNMW
bgi
sideone
nahuel
KlosiakMK
Practically everywhere you go, every review and every lenovo thread, about the trackpoint 2 keyboard, there's this persistent issue of being unable to swap the FN and CTRL keys somehow, which is amazing as that just flew under their radar for making the second edition keyboard. Link
It would be a hell of a lot of help if the same hex edit miracle was pulled for the trackpoint ii as it was for the trackpoint 1