Towards A Reverse Engineering Of Samsung’s S-Pen

A few years ago, Wacom, the company behind all those cool graphics tablets, teamed up with Samsung to create the S Pen, a rebirth of that weird pen computing thing that happened in the 90s and a very interesting peripheral if only someone would write some software for it. [Kerry D. Wong] was wondering how the S Pen worked and wired up some hardware to take a look at how the pen communicates with the phone.

It was already known that the S Pen was powered by an RF field, and works somewhat like RFID. Listening in on the communication would require a coil of some type, so [Kerry] disassembled a small speaker and connected it to a scope.

A look at the captured waveforms from the S Pen reveled the carrier frequency appears to be in the range of 550 to 560kHz, outside the range of standard RFID. He doesn’t have the equipment to decode the complete protocol, but a few things can be deduced – the screen senses the location of the pen by detecting a dip in the RF field strength. The only information that is transferred between the pen and phone is the 11-bit pressure sensitivity and a 1-bit value that signals the button is on or off.

[Kerry] put the waveform data up on his site should anyone want to make an attempt at decoding the protocol.