Line 61:
Line 61:
[[User:Acamilo|Acamilo]] ([[User talk:Acamilo|talk]]) 23:43, 16 February 2017 (CET)
[[User:Acamilo|Acamilo]] ([[User talk:Acamilo|talk]]) 23:43, 16 February 2017 (CET)
+
+
+
Good news. I'm getting data from the tablet.
+
+
I started it up the way the wii did after using a analyzer on the i2c bus to see what the wii did.
+
+
A log of i2c comms between a wiimote and the wii running the included sw CD.
+
<nowiki>
+
// unenc init
+
a4 w f0 55
+
a4 w fb 00
+
+
Read ID Bytes
+
a4 w fa
+
a5 r ff 00 a4 20 00 13
+
+
// Enter enc mode
+
a4 w f0 aa
+
+
// write 16 byte key
+
a4 w 40 e0 7d e0 7d e0 7d
+
a4 w 46 e0 7d e0 7d 38 54
+
a4 w 4c bb 79 01 43
+
+
// Read Cal Data
+
a4 w 20
+
a5 r a2 b2 89 40 0f 1f 39 f0
+
a5 r a2 b2 89 40 0f 1f 39 f0
+
+
a4 w 30
+
a5 r a2 b2 89 40 0f 1f 39 f0
+
a5 r a2 b2 89 40 0f 1f 39 f0
+
+
// Read inputs
+
a4 w 00
+
+
a5 r a3 b1 8a 41 0e 5e 38 f3
+
a5 r a3 b1 8a 41 0e 1e 38 f3
+
+
many more 00 reads
+
+
????
+
a4 w fb 01
+
+
many more 00 reads
+
</nowiki>
+
+
+
Looks like 3 things need to happen to make this tablet work.
+
You need to explicitly enable encrypted mode and send a full 16 bytes of key or it will return FFs. Additionally, You need to write 01 to FB.
+
+
I wrote 16 zeros for the key and decrypted the data with (e ^ 0x97)+0x97 and I'm getting bytes that make sense.
+
+
So far I've figured out that bit7 (index zero) of byte 5 (index zero) is a flag for detecting a pen in range. bits 2 to 0 of byte 5 are the MSbits of a pressure value. Additionally, bits 5 to 0 of bytes 1 and 3 are the upper 6 bits of X and Y pen positions respectively.
+
+
I'm gonna keep poking at this.
+
[[User:Acamilo|Acamilo]] ([[User talk:Acamilo|talk]]) 20:16, 18 February 2017 (CET)