Hi, welcom back again to my another blog post. Today I will take you through my second time trying to reverse engineering something after the MN15439A vfd.
This time, It’s the hardware reverse engineering that I’ve been waiting for almost 2 years to have a chance to do that. I mean, I have a chance to replace the battery of my lenovo yoga book, but I also have a chance to replace the w31rD romania key layout that missunderstanding seller sent to replace a while ago. BTW, I brok that keyboad trying to access the battery.
Anyway, I got new US layout keyboard (FINALLY 😤😭). But old keyboard left over…Maybe I can do something with it AND YES! It’s time to P R O B E.
Last year, I started playing with logic analyzer. It’s Arduino SUMP open logic sniffer (OLS). And it’s really useful though it’s only capable at 4MHz but it’s fine anyway. I start probing with things, first time I use it, I’m probing the I2C bus of STM8L interfacing with MLX90614 (well the C0V1D just started, and I finally made something really useful 😂). Well, I’ve been working with electronics stuffs since I’m in elementary school, but growing up and saw the complex stuff doing their work. Fantastic!
Ok, I think it’s enough for the intro, lets dig deeper.
I started probing by actually solder the bodge wires onto the pads near the 8-pin fpc connector (pitch size still unknow). By the way, each pad I already checked the continuity between pads and pins.
After everything is nice and sure. I connected to my YOGA Book.
After some catefully inspection. I turned on my laptop, connect arduino to usb after it is booted into linux, run the OLS capture, and I caught something!
W 0 A H, 1 7 1 S I2C B U S ! yes, I caught the i2c activity plus on the channel 4 is something too!
After that I probed more and more. Until I came up with this
I manage to read >300+ lines of code of almost every different wacom i2c driver, mainline linux kernel, yoga book android kernel and samsung n5100 kernel (btw, my dad own one of these). It’s boied down to just 6 necessaty pins. But I’m gonna write down all of them anyway
Pin 8 is the most left of fpc, Pin 1 is the most right of fpc. The number I wrote in the solder pads are the same as fpc
- I2C SCL
- I2C SDA
- IRQ interrupt for host. (goes low when wants the host to receive i2c packet)
- Reset, Active low. Useful when host rebooted but not power cycled.
- 3.3v power
At this time, I’m currently implememting the reset in driver on my f1c100s linux source. But here’s some example ~~~
I forgot to take the photo of “evtest” showing that it’s actually works (might put on here soon) but I still have the problem whe running evtest, it works fine for just a couple seconds but the bus tend to lock up, this probably some to do with either pull-up resister or i2c frequency (My bus probing on YOGA Book shows that it’s running at ~1MHz).
UPDATE : The problem of bus lock is caused by w9013 not release SCL and SDA, quick workaround is to reset the w9013 via reset pin.
Anyway I hope you learn something from this post, here’s also the link to my kernel, you can take a look at wacom_i2c driver source code and f1c200s device tree binding too.