Fix a keyboard’s firmware with trial, error, and I2C

eepromKeyboardFlash

If the media shortcut keys on your keyboard don’t function correctly due to outdated firmware, the manufacturer may recommend you ship it to them for an update. [Alvaro] didn’t care to wait that long, so he cracked it open and taught himself how to mod the EEPROM. The result is a well-documented breakdown of sorting out the keyboard’s guts. Inside he finds a USB hub, which he ignores, and the keyboard controller chip, which he attacks. Two data sheets and a schematic later, [Alvaro] breaks out the logic analyzer to compare physical key presses to the keypad codes they output.

He dumps the entire EEPROM and follows up with a quick flash via I2C to change the “next song” key to instead output the letter “a”. That seems to work, so [Alvaro] combs through an HID USB usage table for some codes and has to guess which ones will properly control Spotify. He converts the media keys from “scan next” and “scan previous” to “rewind” and “fast forward.” Problem solved.

[Alvaro] had zero knowledge of keyboards prior to opening this one up. If you aren’t already taking things apart to see how they function and how to fix them, hopefully his success will persuade you to explore and learn about those “black boxes” in your home. And, if you’ve never used I2C before—or think it might be the name of a boy band—head over to [Kevin's] tutorial on bitbanging I2C by hand.

Comments

  1. ejonesss says:

    there are macro programs that can allow you to re assign keys

    • Nick says:

      Yes but this is HackaDay not download some program and call it a day-day. You seem like you’d be the type of person that complains about lame hacks, while at the same time saying how you wouldn’t need to hack it, such as what you wrote.

      • Eatith Mee says:

        I’ll go one further and say I’d throw the POS in the trash and buy a new keyboard all together and call it a day and do something actually useful with the time saved. A LOT of the hacks on HaD feature crazy wastes of time and money on useless junk that end up being a wash in the end. Do what you want, It’s your life, but I’ll choose to spend my own limited time wisely…

        • Jim says:

          I agree with you and Nick, I’d just get a new one call it a day, but otherwise, its still a hacking site, yes there are many hacks that make me shake my head and ask why, but its not called HacksThatAreUseFullADay, just HackaDay, whether they are useful or useless

        • Old'un says:

          If someone ‘wastes’ their time by doing the investigation so that others can learn from the fruits of their labour, it’s not a waste of time.

          Sure, if I were in that position, I’d probably have downloaded something or got a new keyboard. However, having read the article – I’d probably spend a couple of minutes flashing the chip instead, as it’s easy once someone else has done it.

        • Jake Mercer says:

          The pursuit of knowledge is never a poor choice, the guy who did this got to learn all about how his keyboard worked, and how to modify it!

        • Whatnot says:

          You are always the sunny positive guy alright.

  2. Lloyd Atkinson says:

    Nice hack. But what happened to the other half of the keyboard?

  3. fosafdsadf says:

    I am so happy to be on linux and can just do everything with xmodmap or if everything goes wrong with evdev + uevdev :)

    • sneakypoo says:

      Because rebinding keys in other operating systems is impossible?

      • meh says:

        Exactly! Linux has some low-level cmd line util to do things the cryptic way, he’s so lucky because we’re all missing out! I mean, if only Microsoft had a Keyboard Layout Creator, with a user friendly GUI and all! Oh, wait… Well, hopefully it’s still better than the Mac. It couldn’t possibly have configuration files which are edited with programs such as Ukelele and several others, right? As usual, Linux ends up dead last… Sorry!

        • Greenaum says:

          Hm, never knew that, thanks for the tip! I’ve already got “X-Mouse Button Control” from http://www.highrez.co.uk . It’s freeware, written by one guy.

          I got it when I got a 5-button mouse. Now the 2 little buttons on the side work the computer’s volume control. Much easier way of controlling it than starting up the volume control program, or gods forbid, reaching over to my amplifier to turn it down!

          It lets you set up mouse buttons to do all sorts of things, to the mouse pointer itself and to simulating key presses and running programs. It has different schemes for different programs. Normally the 4th and 5th buttons control volume, and the rest do their normal job. But if I’m over the task bar (my choice) they run REW / FF on a media player, and the wheel does volume.

          Anyway it’s very versatile if you’ve got some spare mouse buttons. It’s completely free and ad-free, and I’m just a satisfied user. I don’t know the guy who wrote it!

  4. Dosx says:

    Noice! All in all a good hack….think this might be of use to me in future hacks as well.

  5. pod says:

    nice post, it inspired me to go check my foobar setting and found out I can bind almost every (usually non functioning) mediakey on my keyboard to specific playback functions instead of using all the software hacks I did in the past :)

  6. Whatnot says:

    I always assumed keyboards used off-the-shelf keyboard chips that didn’t have any programming options but the keys available were about the grid layout connected to them.
    But maybe with such specialized keyboards it’s different.

    Anybody know about this? Was I completely wrong in my assumption?

    • Greenaum says:

      The keyboard in this post is a special one, and contains a translation table in an EEPROM. Normal keyboards don’t have this. They don’t need to, really, keyboards just send the raw key number, ranging from Esc on the top-left to num-pad Enter on the other corner. The PC’s operating system converts it to letters, and recognises when the shift key is pressed, so it needs to start returning capital letters. Most of the brains are at the PC end, to the keyboard it’s just numbers for switches.

      Since this keyboard is a special one, coming in two halves, I suppose it suited the manufacturer to include the translation table. Perhaps they use the same controller chip and PCB in both halves, with only the EEPROM data being different.

      So yeah your assumption was right. This is an exception.

      • Greenaum says:

        Oh, just to make clear… it’s not just the translation table, the microcontroller chip in the keyboard will be running code written specifically for it by the keyboard manufacturer. Most keyboard controllers don’t have an option for stuff like translation, or anywhere to plug EEPROMs.

        I dunno if each keyboard manufacturer writes their own code for their controller chip. It would make sense to, scanning a keyboard is not a difficult program to write. But this specific keyboard / pair of halves definitely does use code written specifically for it / them.

      • Whatnot says:

        Now to expand on that: do those standard controllers have the capability to send keys not on the keyboard by changing the matrix? I mean I assume they are designed to have a large number and it’s the manufacturer who selects which part to use right?
        for instance in the standard definition of keycodes they mention F13 up to F24 and such, keys that I never see on keyboards, but do those off-the-shelf chips actually have them in their tables ready to be used? I bet the general controller chips datasheets are hard to find and in chinese, that at least is my experience when I search for such things. But the keyboards I opened also have those dab of epoxy type of chips that don’t have part numbers to even start to look them up I fear.

  7. Galane says:

    “bitbanging I2C by hand” That sounds so dirrrrty.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

Join 94,478 other followers