Tail light HID protocol

HID protocol description

Tail-light update

Steps to update the tail-light:

• Connect to mouse HID device with Usage=0212 and UsagePage=FF07.
• Send a feature report with ByteLength=73 with the following header:

FeatureReport[0] = 0x24; // ReportID 36
FeatureReport[1] = 0xB2; // magic value
FeatureReport[2] = 0x03; // magic value
FeatureReport[3] = red;
FeatureReport[4] = green;
FeatureReport[5] = blue;

Other package types

Observed set feature-report packages of unknown type:

• {0x24, 0x82, 0x00, 0x00, L"D\VID_045E&PID_00F9&MI_01&COL01", 0x00..., 0x07}
• {0x24, 0x89, 0x01, 0x03, 0xf7, 0x07, ..}
• {0x24, 0x97, 0x00, 0x00, 0x08, ..}
• ...

HID report descriptor

HID report descriptor for Pro IntelliMouse, obtained using sudo usbhid-dump --entity=all --model=045E (win-hid-dump can also be used to get an approximate descriptor):

045E:082A: Microsoft - HID KEYBOARD DEVICE
PATH:\\?\hid#vid_045e&pid_082a&mi_01&col05#7&655e630&0&0004#{4d1e55b2-f16f-11cf-88cb-001111000030}

0x06, 0x07, 0xFF,  // Usage Page (Vendor Defined 0xFF07)
0x0A, 0x12, 0x02,  // Usage (0x0212)
0xA1, 0x01,        // Collection (Application)

0x85, 0x24,        //   Report ID (36)
0x09, 0x01,        //   Usage (0x01)
0x75, 0x08,        //   Report Size (8)
0x95, 0x48,        //   Report Count (72)
0x15, 0x00,        //   Logical Minimum (0)
0x26, 0xFF, 0x00,  //   Logical Maximum (255)
0xB1, 0x02,        //   Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)

0x85, 0x27,        //   Report ID (39)
0x95, 0x28,        //   Report Count (40)
0x09, 0x02,        //   Usage (0x02)
0x81, 0x02,        //   Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)

0x85, 0x04,        //   Report ID (4)
0x09, 0x03,        //   Usage (0x03)
0x95, 0x08,        //   Report Count (8)
0x75, 0x08,        //   Report Size (8)
0x81, 0x02,        //   Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
0xC0,              // End Collection

As you can see above, the device exposes 2 INPUT reports and 1 FEATURE report. Report ID 36 consist of 72 bytes with values 0-255. This unfortunately says nothing on how to interpret these bytes.

How to reverse-engineer the protocol

It's possible to reverse-engineer the IntelliMouse USB HID protocol by installing USBPcap and Wireshark.

Steps:

1. Open Wireshark with USBPcap plugin.
2. Open "Microsoft Mouse and Keyboard Center" app.
3. Change tail-light color.
4. Observe USBHID SET_REPORT Request packages with ReportID=36 and ReportType=Feature that adhere to the format described above.

The feature report also contains a number of other non-zero bytes. I don't know if they carry a meaning or are just uninitialized memory.

It's possible to filter the packages by entering e.g. usbhid.setup.ReportType==3 as display filter in WireShark.