Changes

Line 61: Line 61:     
[[User:Acamilo|Acamilo]] ([[User talk:Acamilo|talk]]) 23:43, 16 February 2017 (CET)
 
[[User:Acamilo|Acamilo]] ([[User talk:Acamilo|talk]]) 23:43, 16 February 2017 (CET)
 +
 +
 +
Good news. I'm getting data from the tablet.
 +
 +
I started it up the way the wii did after using a analyzer on the i2c bus to see what the wii did.
 +
 +
A log of i2c comms between a wiimote and the wii running the included sw CD.
 +
<nowiki>
 +
// unenc init
 +
a4 w f0 55
 +
a4 w fb 00
 +
 +
Read ID Bytes
 +
a4 w fa
 +
a5 r ff 00 a4 20 00 13
 +
 +
// Enter enc mode
 +
a4 w f0 aa
 +
 +
// write 16 byte key
 +
a4 w 40 e0 7d e0 7d e0 7d
 +
a4 w 46 e0 7d e0 7d 38 54
 +
a4 w 4c bb 79 01 43
 +
 +
// Read Cal Data
 +
a4 w 20
 +
a5 r a2 b2 89 40 0f 1f 39 f0
 +
a5 r a2 b2 89 40 0f 1f 39 f0
 +
 +
a4 w 30
 +
a5 r a2 b2 89 40 0f 1f 39 f0
 +
a5 r a2 b2 89 40 0f 1f 39 f0
 +
 +
// Read inputs
 +
a4 w 00
 +
 +
a5 r a3 b1 8a 41 0e 5e 38 f3
 +
a5 r a3 b1 8a 41 0e 1e 38 f3
 +
 +
many more  00 reads
 +
 +
????
 +
a4 w fb 01
 +
 +
many more  00 reads
 +
</nowiki>
 +
 +
 +
Looks like 3 things need to happen to make this tablet work.
 +
You need to explicitly enable encrypted mode and send a full 16 bytes of key or it will return FFs. Additionally, You need to write 01 to FB.
 +
 +
I wrote 16 zeros for the key and decrypted the data with (e ^ 0x97)+0x97 and I'm getting bytes that make sense.
 +
 +
So far I've figured out that bit7 (index zero) of byte 5 (index zero) is a flag for detecting a pen in range. bits 2 to 0 of byte 5 are the MSbits of a pressure value. Additionally, bits 5 to 0 of bytes 1 and 3 are the upper 6 bits of X and Y pen positions respectively.
 +
 +
I'm gonna keep poking at this.
 +
[[User:Acamilo|Acamilo]] ([[User talk:Acamilo|talk]]) 20:16, 18 February 2017 (CET)
3

edits