Close

Wac0m RipOff BLE coming soon !

A project log for Wac0m Rip0ff : Wacom I2C hacked!

I broke my YOGA Book touch keyboard while trying to replace the battery, So I have a chance to reverse engineer the Wacom I2C HID digitizer

tinlethaxTinLethax 08/14/2021 at 05:010 Comments

I'm really excited to tell you that the next revision of Wac0m RipOff project is coming with Wireless Bluetooth Low energy support ! Yesterday I've been researching for the suitable Bluetooth-Capable MCU. I came across many like HC-05 with RN-42 firmware (HID capable), STM32WB (Also HID capable) and nRF51822 (Arduino compatible). but I decided to go with Arduino again this time because : USB is hard, Bluetooth is 1000 times harder! (Except for the last one). 

first, the HC-05 module (based on BC417 made by CRS). Though the RN-42 firmware is just a firmware not really a code, but Someone on Arduino forum found out that in the firmware has the HID descriptor embedded byte by byte, and only way to implement my own HID descriptor is to modify the firmware. But there're couple reasons that keeping me away from using HC-05 

1. I need to write the Python script to rearrange the memory address (the firmware is plain text) that look like this :

@06eb31 0005 
@06eb32 0001 
@06eb33 0009
@06eb34 0006

That portion of code is the HID descriptor taken from that .xpv firmware file  

That is possible to write some script to move the byte to next mem address (but since I don't code Python sadly), but the next reason is make it almost impossible.

2. These HID descriptor likely has the pre-defined array size and event memory address is fixed. so I really need to dig down to the compiler + CPU programming manual. that will cost me (probably) years to finally made through it, but I don't have that much time. so I move to next solution

Second, STM32WB. To be honest, I really love using STM32. It's IDE (CubeIDE, formerly knows as ACE) is based on Eclipse, and I've been using for 3 years now. It's really easy to use but also really advance in the same time. I came across the STM32WB30CE, BLE capable (via another Cortex M0 beside the main M4 core). I thought that the BLE middleware is really easy to use like USB (<- not easy, just not CRAZY COMPLEXT). Thing went unexpected. The BLE middleware is really complicated. Also in order to make radio works. It's required the external 32MHz Xtal (My habit : avoid using external OSC, just lazy to design the HF board). So again I abandoned this idea.

Last one, nRF51822 (NRF51822-04 module to be precise). I came across video on the Hugatry's HackVlog YouTube channel making video about Arduino with that Nordic NRF thingy. I did some little research and find out that this Nordic chip is really flexible, I can literally remap i2c pin to any pin any where! so I only need a small nRF51 module board with couple pins exposed to use with Wacom w9013. All the thing to do is just to port the BLEHID library (done), port the sketch (done) and test it out (not yet, haven't buy that module). 

Once I got the nRF51 module on hand. I'll make video about it too.

P.S. for who wonder Why I don't go with ESP32. That thing is too powerful, I'd probably use 1 out of 10 from it. 

Discussions