[SOLVED] How can i hack my mouse to use windows software controlled feature?

coralfang · 03-22-2017, 05:05 AM

(EDIT: I managed to figure most of the mouse features out using a virtual machine and wireshark to capture USB controls, i put the code here https://github.com/Jigoku/blackweb_aya which is a small python script to manage the mouse settings under Linux)

I just purchased a "Blackweb AYA" gaming mouse as my old one needed replacing.

I plug the thing in, and it works out of the box mostly (it's usable).

Dmesg shows this:

Code:

[ 1010.197709] usb 9-1: new full-speed USB device number 4 using ohci-pci
[ 1010.349995] usb 9-1: New USB device found, idVendor=3938, idProduct=1101
[ 1010.349999] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 1010.350002] usb 9-1: Product: Blackweb  Optical Gaming Mouse
[ 1010.350004] usb 9-1: Manufacturer: Gaming Mouse
[ 1010.357659] input: Gaming Mouse Blackweb  Optical Gaming Mouse as /devices/pci0000:00/0000:00:13.0/usb9/9-1/9-1:1.0/0003:3938:1101.0007/input/input23
[ 1010.357857] hid-generic 0003:3938:1101.0007: input,hidraw1: USB HID v1.11 Mouse [Gaming Mouse Blackweb  Optical Gaming Mouse] on usb-0000:00:13.0-1/input0
[ 1010.364242] input: Gaming Mouse Blackweb  Optical Gaming Mouse as /devices/pci0000:00/0000:00:13.0/usb9/9-1/9-1:1.1/0003:3938:1101.0008/input/input24
[ 1010.468232] hid-generic 0003:3938:1101.0008: input,hiddev0,hidraw2: USB HID v1.11 Keyboard [Gaming Mouse Blackweb  Optical Gaming Mouse] on usb-0000:00:13.0-1/input1

The mouse comes with some windows software to adjust the polling speed/sensitivity etc, and allows you to customize the LED colours, either cycling through the 16.8million colours or setting them to a single colour.

I did try to run the software under wine, hoping that would set the mouse settings, however the programs fail to run. Sensitivity isn't an issue, as that can be set by any X related mouse tool.

So i did a search about mouse polling and came to the conclusion you can manually set this using the usbhid module;

/etc/modprobe.d/usbhid.conf

Code:

options usbhid mousepoll=1
usbhid

As far as i know "1" sets the mouse to 1000hz polling rate, i can't say i notice the difference from the default setting of "0", but i guess that's out of the way. I guess polling speed setting is out of the way.

Now, how can i start trying to find out how the LED colours are changed? As there appears to be no documentation or scripts other people have written to configure this mouse on Linux.

I came across this C source, for a Logitech mouse which changes the colours of the LED, and tried to replace the device/vendor id with the ones of my mouse, which obviously fails to work, but i thought it was worth a try.
http://als.regnet.cz/logitech-g9-linux-led-color.html

Maybe this can be slightly modified to change the correct setting in the correct format?

Surely there is something under /sys or /dev that can be written to manually to set the colour somehow? But how would i find it.

Would anyone know where to start with this?

Here is the lsusb output if this is any use;

Code:

$ lsusb -d 3938:1101 -v

Bus 009 Device 004: ID 3938:1101  
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               1.10
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0         8
  idVendor           0x3938 
  idProduct          0x1101 
  bcdDevice            0.16
  iManufacturer           1 Gaming Mouse
  iProduct                2 Blackweb  Optical Gaming Mouse
  iSerial                 0 
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           59
    bNumInterfaces          2
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0xa0
      (Bus Powered)
      Remote Wakeup
    MaxPower              100mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         3 Human Interface Device
      bInterfaceSubClass      1 Boot Interface Subclass
      bInterfaceProtocol      2 Mouse
      iInterface              0 
        HID Device Descriptor:
          bLength                 9
          bDescriptorType        33
          bcdHID               1.11
          bCountryCode            0 Not supported
          bNumDescriptors         1
          bDescriptorType        34 Report
          wDescriptorLength      75
         Report Descriptors: 
           ** UNAVAILABLE **
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0010  1x 16 bytes
        bInterval               1
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         3 Human Interface Device
      bInterfaceSubClass      1 Boot Interface Subclass
      bInterfaceProtocol      1 Keyboard
      iInterface              0 
        HID Device Descriptor:
          bLength                 9
          bDescriptorType        33
          bcdHID               1.11
          bCountryCode            0 Not supported
          bNumDescriptors         1
          bDescriptorType        34 Report
          wDescriptorLength     201
         Report Descriptors: 
           ** UNAVAILABLE **
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               1
can't get debug descriptor: Resource temporarily unavailable
Device Status:     0x0002
  (Bus Powered)
  Remote Wakeup Enabled

coralfang · 03-22-2017, 05:30 AM

The mouse has a red led as default;
I just found this (edit, has nothing to do with colour);

Code:

$ cat /sys/class/hidraw/hidraw1/device/input/input23/event1/device/capabilities/key
1f0000 0 0 0 0

Maybe i'm wrong, but that looks like a RGB colour value of a very dark red? I tried echoing "00ff00 0 0 0 0" to see if it would turn the mouse green, but is unwritable even as root.

Admittedly i don't even know what i'm doing... but if anyone has any information on possible files where this value might be set within the device, that would be much appreciated.

DavidMcCann · 03-22-2017, 12:50 PM

This struck me as an interesting problem, so I did some digging.

There doesn't seem to be any Linux driver for that mouse. Roccat mice have Linux drivers, but they're a bit pricier!

The /sys directory is a bit like /dev. This explains the difference
http://www.signal11.us/oss/udev/
In other words (if I've understood it), /sys doesn't contain files but is a direct link to the devices. If you couldn't write to the "file" it actually meant that you couldn't write to the mouse. That seems reasonable enough: the mouse doesn't have RAM and relies on software to manage it.

So, it looks like you may have to learn to like its colour scheme.

coralfang · 03-23-2017, 03:47 AM

Yes, as far as i understand you can only write to a /dev 'file' if it's something created by a device driver? I'm not totally sure. A device driver would give access to updating parts of the hardware i'd assume.

However, i thought of something which seems to be a solution until (if) a native driver ever pops up.
I decided to get a windows 10 of virtualbox up and running, enabling USB passthrough for the mouse. Then installed the windows driver software included on the disk to the guest machine.

I was able to load up the mouse settings fine and it detected the mouse properly, so i changed the colour to turquoise, with a glowing effect on the LED. Closed the virtual machine, and the mouse still glows this colour.

I rebooted the host Linux machine and even disconnected the mouse, and it is still glowing a turquoise colour. So it seems to be persistent, in that the settings must be stored on the actual hardware.

I guess this is the most simple solution for now, thought i'd post this in case anyone else ends up trying to use this mouse on Linux. Quite a simple workaround, although i'd love to be able to program this thing to flash different colours depending on system load or checking for new emails... haha.

TB0ne · 03-23-2017, 07:20 AM

Quote:

Originally Posted by coralfang

Yes, as far as i understand you can only write to a /dev 'file' if it's something created by a device driver? I'm not totally sure. A device driver would give access to updating parts of the hardware i'd assume.

However, i thought of something which seems to be a solution until (if) a native driver ever pops up.
I decided to get a windows 10 of virtualbox up and running, enabling USB passthrough for the mouse. Then installed the windows driver software included on the disk to the guest machine.

I was able to load up the mouse settings fine and it detected the mouse properly, so i changed the colour to turquoise, with a glowing effect on the LED. Closed the virtual machine, and the mouse still glows this colour.

I rebooted the host Linux machine and even disconnected the mouse, and it is still glowing a turquoise colour. So it seems to be persistent, in that the settings must be stored on the actual hardware.

I guess this is the most simple solution for now, thought i'd post this in case anyone else ends up trying to use this mouse on Linux. Quite a simple workaround, although i'd love to be able to program this thing to flash different colours depending on system load or checking for new emails... haha.

There is a set of tools for many Razer peripherals that are native Linux:
https://terrycain.github.io/razer-drivers/

As with the roccat stuff, they're pricey, but nice. That said, the software/daemon itself may be worth looking in to, since most of the razer stuff has similar features...you may get lucky.

DavidMcCann · 03-23-2017, 11:38 AM

It's nice to know it can be done, and I'm impressed that such a reasonably-priced product has that feature. Obviously the secret was knowing exactly what to say to the mouse to persuade it to change colour — that sounds like a lesson at Hogwarts, doesn't it!

coralfang · 03-24-2017, 02:50 PM

Well, here's an interesting turn of events. I've been reading about USB sniffing all day, and ended up writing a small program afterwards to control the LED colors on Linux natively! I've never really looked into reverse engineering before, but i seem to understand things easier than i expected.

Basically, i figured that wireshark has USB sniffing support, so after loading up the virtual machine and attaching the mouse, i logged the packets going to/from the mouse, and consequently found the data streams for two of the LED functions (triggered by setting the colors in the virtual machine)

I managed to write a small program to change the LED color, and also make it persistent across reboots/hotplugging.

Which is as easy as:

Code:

# ./led_color.py 255 0 0

I put the code here on github in the event someone finds this topic and is also looking for a solution;
https://github.com/Jigoku/blackweb_aya

It could do with some improvements, but it seems to work fine as it is!

TB0ne · 03-24-2017, 03:44 PM

Quote:

Originally Posted by coralfang

Well, here's an interesting turn of events. I've been reading about USB sniffing all day, and ended up writing a small program afterwards to control the LED colors on Linux natively! I've never really looked into reverse engineering before, but i seem to understand things easier than i expected.

Basically, i figured that wireshark has USB sniffing support, so after loading up the virtual machine and attaching the mouse, i logged the packets going to/from the mouse, and consequently found the data streams for two of the LED functions (triggered by setting the colors in the virtual machine)

I managed to write a small program to change the LED color, and also make it persistent across reboots/hotplugging.

Which is as easy as:

Code:

# ./led_color.py 255 0 0

I put the code here on github in the event someone finds this topic and is also looking for a solution;
https://github.com/Jigoku/blackweb_aya

It could do with some improvements, but it seems to work fine as it is!

Outstanding, coralfang...thanks for writing it, and sharing.

coralfang · 04-03-2017, 05:04 PM

I've been digging deeper with this lately.
https://github.com/Jigoku/blackweb_aya/issues/2
https://github.com/Jigoku/blackweb_a...lackweb_aya.py

Ended up finding the USB control for the LED mode (on/off/breathe/cycle). Discovered that usbhid doesn't actually set the polling rate for this mouse, it seems to be stored on the hardware aswell. Managed to find the USB control for setting that and also implemented that with this script.

Feels like a quality mouse now when set to 1000hz!
Glad i purchased this on a whim in the end. Ended up learning quite alot about USB devices, and also gave me an excuse to start learning python again

Shadow_7 · 04-03-2017, 05:18 PM

Does xinput not handle at least some of the features of your mouse?

$ xinput
$ xinput --list-props 9
===== Logitech USB Receiver id=9 [slave pointer (2)]
$ xinput --set-prop 9 265 1.3
$ xinput --set-prop 9 266 1.3
===== Device Accel Constant Deceleration (265): 1.000000
===== Device Accel Adaptive Deceleration (266): 1.000000

In order to slow down my mouse to mis-click less often. No need to re-invent the wheel, linux does plenty already.

coralfang · 04-03-2017, 05:24 PM

Quote:

Originally Posted by Shadow_7

Does xinput not handle at least some of the features of your mouse?

$ xinput
$ xinput --list-props 9
===== Logitech USB Receiver id=9 [slave pointer (2)]
$ xinput --set-prop 9 265 1.3
$ xinput --set-prop 9 266 1.3
===== Device Accel Constant Deceleration (265): 1.000000
===== Device Accel Adaptive Deceleration (266): 1.000000

In order to slow down my mouse to mis-click less often. No need to re-invent the wheel, linux does plenty already.

Yeah, alot of the things in the windows driver software are not hardware controlled. X related tools on Linux can configure mouse acceleration / sensitivity / double click speed etc. That's not an issue. Out of the box, the mouse works fine besides settings related to polling, LED, macros, profiles.

The mouse polling is only noticeably different by setting it through a direct USB control (it's stored on the hardware itself), along with the support for changing the LED color/mode. The profiles are also saved to the mouse, so requires a USB control to switch between them. I guess that could be implemented in software too, but the feature is already there, just missing proper driver support.