wacom_i2c : HACKED !

I broke my YOGA Book touch keyboard while trying to replace the battery, So I have a chance to reverse engineer the Wacom I2C HID digitizer.

Similar projects worth following
Recently, I need to replace the battery of my Lenovo YOGA Book, but in the procedure of open it up, I accidentally broke the keyboard second time (touchscreen made of GLASS). So I can finally replace w31Rd Romania layout keyboard with US layout. but the old cracked glass still has the Wacom digitizer sticking to it (That is the second one that I have). So after 6 years of experience in Electronics and Computer. I finally graduated from high school and brave enough to do the first and successful hardware reverse engineering. !

I reversed engineering the Wacom I2C EMR pad taken from Lenovo YOGA Book, first started by probing all pads connected to the Wacom board. There're 8 pins total connected to touchscreen chip board which is connected to YOGA's mainboard. the main character of this project is W9013 the REALLY SECRET Wacom proprietary chip that ONLY Wacom engineer team has access to datasheet(Try search it up, You won't find it ;P). I started by peeling of the copper sheet protecting the board against EMI, since this technology (Wacom EMR) rely on radio emission similar to RFID and NFC. take a look at the second pic in project gallery. I labeled 6 pins plus the main Vcc/Vdd rail. all the pins labeled with number are corresponding to FPC connector pin order

1. Unknow

2. SCL (No pull-up D:)

3. SDA (No pull-up D:)

4. Unknow

5. IRQ, goes low when w9013 is ready to send (pen present)

6. Chip Reset Active low, useful for re-establish/initialize I2C comm.

7. 3v3 Vdd

8. GND

(I suspect that the remain pins are used for IRQ on other detection, Because this chip is very similar to one used in Samsung Galaxy Note 8.0 tab, btw my dad own one of these, might try probing later too). 

The host seems to used 1MHz I2C, but I confirmed that the w9013 works with 400kHz too (on my F1C100s and STM32).

right now, I ported the Wacom i2c driver from mainline Linux kernel to STM32 (using STM32CubeIDE). I currently using the STM32F3 DISCO board,  because I can share the I2C bus with onboard sensor (Pull-up already there 10k). also the onboard ST-Link provide the 8MHz clock for HSE and Serial ACM for debugging. It's worth buying board (I've been using this board for 3 years now Since Grade 10, 3 years ago). 

the STM32F3 is capable of USB device (USB gadget I would say). And I use the USB HID feature and writing my own HID descriptor. The tool that I use is HID descriptor tool from (by the way, the latest version is younger that me just ~1 year xD). but the output of the program is in non-friendly-C format, so I literally wrote entire thing in C array. Right now I be able to get the HID partially working, the "evtest" in Linux can detect the HID event, but the problem that still persist is the cursor will never work on both and Windows 10. I might need to take a look at HID descriptor more to fix this issue. 

  • 1 × Wacom I2C digitizer (W9013 based). You can find this exact OEM part by searching for Lenovo yoga book keyboard replacement
  • 2 × 4.7kOhm Resistor for pull-up on the original probing with my Laptop open. there're pull-up on the bus somewhere on the main board
  • 1 × Logic Analyzer that accept 1MHz [optional] I don't have much buck to buy the reliable Logic analyzer, but at lease my Arduino UNO SUMP logic sniffer done the job and doesn't cause the i2c bus to lock up.
  • 1 × STM32F3 Discovery Board in fact, any STM32 should work with some code modification.

  • digitizer is now working (partially)

    TinLethax7 days ago 0 comments

    Couple minutes ago I finally get the USB HID work ! By changing the USB device name from "Wacom Rip off" to "Wac0m Rip off". I still had no idea why this change make the cursor actually move (as I said earlier that the "evtest" did shows event report). But I suspect that the word "Wacom" is used for driver probing (grep from device name to load driver, Name match ?).

    Anyway, There're main 3 problems

    1. Y axis is inverted

    2. Hovering the pen over the pad does generate event, but cursor doesn't move along unless pen tip is down

    3. Sometime Eraser side works with randomly having problem from number 2

    The 2 latest commits are on my GitHub repo. 

  • USB HID is now report correctly

    TinLethax06/11/2021 at 14:25 0 comments

    I be able to get the STM32 to report the USB HID event correctly, But still can't move the cursor on both Windows 10 and Linux (Debian but for some reason, it's behaving like relative mouse on Android 11 (My Xperia 10 II). So anyway, the code is already on my GitHub repo.

  • Code on GitHub.

    TinLethax06/08/2021 at 13:24 0 comments

    Here's the code I just push to my repo on GitHub, Note that I'm using the STM32F3 Discovery board (DISCO). here's the repo

  • STM32 as USB HID and interfacing the w9013

    TinLethax06/08/2021 at 12:55 0 comments

    Yesterday I've been working with my STM32F3 Disco board to interface with the w9013 chip on the Wacom i2c digitizer. By far, I wrote the HID descriptor and be able to send packet to the host. but I still have problem interfacing with w9013 (probably I2C pull up problem). I will create new GitHub repo of this soon.

View all 4 project logs

Enjoy this project?



Similar Projects

Does this project spark your interest?

Become a member to follow this project and never miss any updates