pok3r-custom / pok3r_re_firmware

Reverse engineering project for the POK3R and related keyboards.
219 stars 17 forks source link

pok3r rgb needs jtag, no LEDs #33

Closed xkonni closed 4 years ago

xkonni commented 4 years ago

hello!

I had some troubles understanding the whole process at first, so guess I did something wrong.

Things I did

mass erase and flash

# start openocd
pok3r_re_firmware/firmware $ openocd -f openocd.cfg
# connect with telnet
$ telnet localhost 4444
> ht32f165x mass_erase 0
ht32f165x probe: 64 pages, 0x400 bytes, 0x10000 total
ht32f165x mass erase complete
> flash write_image ../disassemble/pok3r_rgb/builtin_rgb/firmware_builtin_rgb.bin 0
ht32f165x probe: 64 pages, 0x400 bytes, 0x10000 total
wrote 8848 bytes from file ../disassemble/pok3r_rgb/builtin_rgb/firmware_builtin_rgb.bin in 123.842178s (0.070 KiB/s)

flash patched firmware

pok3r_re_firmware $ pok3rtool --ok -t pok3r-rgb flash V130 disassemble/pok3r_rgb/v130/firmware_v130_patched.bin
Opened Vortex POK3R RGB (bootloader)
Update Firmware: firmware_v130_patched.bin
Current Version: CLEARED
Firmware CRC D: ed6bb896
Firmware CRC E: 62f334a8
crc 0
sum 0
Current CRC: 00000000
Erase...
Write...
crc 40e964fb
sum 9447470a
New CRC: 40e964fb
pok3r_re_firmware $ pok3rtool --ok -t pok3r-rgb flash V130 disassemble/pok3r_rgb/v130/firmware_v130_patched.bin
Opened Vortex POK3R RGB (bootloader)
Update Firmware: disassemble/pok3r_rgb/v130/firmware_v130_patched.bin
Current Version: CLEARED
Firmware CRC D: ed6bb896
Firmware CRC E: 62f334a8
crc 40e964fb
sum 9447470a
Current CRC: 40e964fb
Erase...
Write...
crc 62f334a8
sum 43b16d41
New CRC: 62f334a8
Writing Version: V130
Reset to Firmware
true

Details

  1. When plugging in the keyboard without jtag attached, I get a dmesg spam like:
$ dmesg -wT
[Sat Jun 27 20:52:45 2020] usb 1-2.1.2: New USB device strings: Mfr=0, Product=1, SerialNumber=0
[Sat Jun 27 20:52:45 2020] usb 1-2.1.2: Product: USB-HID IAP
[Sat Jun 27 20:52:45 2020] usb 1-2.1.2: can't set config #1, error -32
[Sat Jun 27 20:52:45 2020] usb 1-2.1.2: USB disconnect, device number 52
[Sat Jun 27 20:52:45 2020] usb 1-2.1.2: new full-speed USB device number 53 using xhci_hcd
[Sat Jun 27 20:52:45 2020] usb 1-2.1.2: New USB device found, idVendor=04d9, idProduct=1167, bcdDevice=11.03
[Sat Jun 27 20:52:45 2020] usb 1-2.1.2: New USB device strings: Mfr=0, Product=1, SerialNumber=0
[Sat Jun 27 20:52:45 2020] usb 1-2.1.2: Product: USB-HID IAP
[Sat Jun 27 20:52:46 2020] usb 1-2.1.2: can't set config #1, error -32
[Sat Jun 27 20:52:46 2020] usb 1-2.1.2: USB disconnect, device number 53
[Sat Jun 27 20:52:46 2020] usb 1-2.1.2: new full-speed USB device number 54 using xhci_hcd
[Sat Jun 27 20:52:46 2020] usb 1-2.1.2: New USB device found, idVendor=04d9, idProduct=1167, bcdDevice=11.03
[repeat endlessly]
$ lsusb -d 04d9:
Bus 001 Device 119: ID 04d9:0167 Holtek Semiconductor, Inc.
  1. The default firmware seems to have lost its LED abilities
    • After starting the device in firmware mode, I can enter programming modes but it never lights up

Conclusion

Hope there's some way to fix this and I didn't actually break the keyboard.

Questions

  1. Can I somehow fix 1. so the keyboard works without jtag?
  2. And is there some general issue with the LEDS?
  3. Can I revert to factory firmware? Tried flashing official updates in windows but this didn't really change anything.

Thank you very much!

ChaoticEnigma commented 4 years ago

You may be using the wrong bootloader. The pok3r_rgb firmware is for the old POK3R RGB, which had two separate PCBs, sandwiched together. The pok3r_rgb2 firmware is for the new POK3R RGB, which has only one PCB.

xkonni commented 4 years ago

wow.

thanks for your quick and helpful response!

flashed the rgb2 bootloader with openocd

> flash write_image ../disassemble/pok3r_rgb2/bootloader/rgb2_bootloader.bin 0

then v105 with pok3rtool

$ pok3rtool --ok -t pok3r-rgb2 flash V105 disassemble/pok3r_rgb2/v105/rgb2_v105.bin

And now it seems like everything is up and running!

Awesome! ;D

xkonni commented 4 years ago

let's close this, but would you be interested in a little documentation? i can submit PRs next week.

ChaoticEnigma commented 4 years ago

Absolutely, that would be great. Sometimes it's honestly hard to write documentation for your own work, because you know it too well...

xkonni commented 4 years ago

Alright, trying to summarize things. There are still a few open questions though. e.g.

If I flash a slightly modified version of qmk_pok3r for pok3r_rgb:

qmk_pok3r/vortex $ diff pok3r_rgb/config.h pok3r_rgb2/config.h
23c23
< #define PRODUCT_ID      0x0167
---
> #define PRODUCT_ID      0x0207
26,27c26,27
< #define PRODUCT         Vortex POK3R RGB
< #define DESCRIPTION     Vortex POK3R RGB with qmk_pok3r
---
> #define PRODUCT         Vortex POK3R RGB2
> #define DESCRIPTION     Vortex POK3R RGB2 with qmk_pok3r
qmk_pok3r/vortex $ diff pok3r_rgb/pok3r_rgb.c pok3r_rgb2/pok3r_rgb2.c
[empty]
qmk_pok3r/vortex $ diff pok3r_rgb/rules.mk pok3r_rgb2/rules.mk
[empty]

with

qmk_pok3r $ make vortex/pok3r_rgb2:default
qmk_pok3r $ pok3rtool --ok -t pok3r-rgb2 flash "QMK_POK3R" ./vortex_pok3r_rgb2_default.bin 

there is limited functionality.

I can rebind keys, with e.g. pok3rtool --ok -t pok3r-rgb2 keymap set 1 1 2 KC_UP and they show up pok3rtool --ok -t pok3r-rgb2 keymap dump. Some keys, like KC_{LEFT,DOWN,UP,RIGHT}, work fine and some, like MEDIA_PLAY_PAUSE do not emit any signals, backlight does not work. It also seems like the keyboard is crashing constantly, at least watch pok3rtool list is sometimes empty.

So I'm not sure if this is due to my rgb2, unimplemented functionality or due to some other mistake. Do you have any further information? Feel free to message via twitter/irc/xmpp/matrix.

ChaoticEnigma commented 4 years ago

Wait, really? I'm honestly amazed that with those changes it works at all. qmk_pok3r is only stable on the HT32F1655 (the MCU on the pok3r). I have had lots of problems with the same firmware on the HT32F1654 (pok3r_rgb, pok3r_rgb2, vortex_core, etc). I'm surprised it doesn't HardFault instantly on boot. I may have to look into this some more...

As far as the keys, I believe the matrix for the RGB2 is wired slightly differently than the RGB. I would have to look at my schematics. And I never implemented backlight support. It wasn't as simple as driving an LED matrix, it used LED driver ICs.