Wacom EMR I2C : HACKED!

Hi, welcom back again to my another blog post. Today I will take you through my second time trying to reverse engineering something after the MN15439A vfd.

This time, It’s the hardware reverse engineering that I’ve been waiting for almost 2 years to have a chance to do that. I mean, I have a chance to replace the battery of my lenovo yoga book, but I also have a chance to replace the w31rD romania key layout that missunderstanding seller sent to replace a while ago. BTW, I brok that keyboad trying to access the battery.

Anyway, I got new US layout keyboard (FINALLY 😤😭). But old keyboard left over…Maybe I can do something with it AND YES! It’s time to P R O B E.

Last year, I started playing with logic analyzer. It’s Arduino SUMP open logic sniffer (OLS). And it’s really useful though it’s only capable at 4MHz but it’s fine anyway. I start probing with things, first time I use it, I’m probing the I2C bus of STM8L interfacing with MLX90614 (well the C0V1D just started, and I finally made something really useful 😂). Well, I’ve been working with electronics stuffs since I’m in elementary school, but growing up and saw the complex stuff doing their work. Fantastic!

Ok, I think it’s enough for the intro, lets dig deeper.

I started probing by actually solder the bodge wires onto the pads near the 8-pin fpc connector (pitch size still unknow). By the way, each pad I already checked the continuity between pads and pins.

I broke on of the trace, luckily I can bodge wire it back the the front (for interfacing with PC)

The setup looks like this.

A closer look the the wacom w9013 chip. Sorry for the missing marking due to ligthing 😅

After everything is nice and sure. I connected to my YOGA Book.

On the left is the Wacom EMR RF pad extracted from broken keyboard. On the right is my lenovo YOGA Book.

That fpc connected to pc having up to 2 i2c buses. One is for Wacom i2c another for Goodix touchscreen IC

The fpc cable in the mid of this frame is 8-pin fpc connected to the wacom pad.

After some catefully inspection. I turned on my laptop, connect arduino to usb after it is booted into linux, run the OLS capture, and I caught something!

W 0 A H, 1 7 1 S I2C B U S ! yes, I caught the i2c activity plus on the channel 4 is something too!

After that I probed more and more. Until I came up with this

I manage to read >300+ lines of code of almost every different wacom i2c driver, mainline linux kernel, yoga book android kernel and samsung n5100 kernel (btw, my dad own one of these). It’s boied down to just 6 necessaty pins. But I’m gonna write down all of them anyway

Pin 8 is the most left of fpc, Pin 1 is the most right of fpc. The number I wrote in the solder pads are the same as fpc

1. Unknow
2. I2C SCL
3. I2C SDA
4. Unknow
5. IRQ interrupt for host. (goes low when wants the host to receive i2c packet)
6. Reset, Active low. Useful when host rebooted but not power cycled.
7. 3.3v power
8. GND

At this time, I’m currently implememting the reset in driver on my f1c100s linux source. But here’s some example ~~~

We found it YAY, the wacom w9013 chip has a i2c addres of 0x09.

The wacom-i2c driver probe just fine.

Although, I have some issue with pull up resistors and it cause the i2c bus to locked up quite frequencly.

I forgot to take the photo of “evtest” showing that it’s actually works (might put on here soon) but I still have the problem whe running evtest, it works fine for just a couple seconds but the bus tend to lock up, this probably some to do with either pull-up resister or i2c frequency (My bus probing on YOGA Book shows that it’s running at ~1MHz).

UPDATE : The problem of bus lock is caused by w9013 not release SCL and SDA, quick workaround is to reset the w9013 via reset pin.

Anyway I hope you learn something from this post, here’s also the link to my kernel, you can take a look at wacom_i2c driver source code and f1c200s device tree binding too.

F1C100s kernel.

Advertisement