Author Topic: Possiblity of Pok3r firmware replacement  (Read 25596 times)

0 Members and 1 Guest are viewing this topic.

Offline hasu

  • Thread Starter
  • Posts: 2926
  • Location: Tokyo, Japan
  • @tmk
    • tmk keyboard firmware project
Possiblity of Pok3r firmware replacement
« on: Wed, 27 May 2015, 02:36:27 »
Recently I'm thinking about buying new Vortex Pok3r keyboard, the keyboard itself really looks worth the money for typing as normal usage. But if it is hacakable with custom firmware it would be more attractive to me.

Looks like it has holtek Corex MCU and no doubt it is flashable and updatable, my concerns are that it is possible to flash custom firmware with tool publicly available from chip vendor or open source tools. I didn't look into datasheet, app notes and tools of the chip, by any chance, does anyone know about these things?

See this video in HD mode :)  Let me know if you have links to high resolution pics of Pok3r PCB.
Marking on the chip says HT32F1655.

Vendor page:
http://www.holtek.com/english/docum/32bit_flash_mcu/ht32f1655_1656.htm


So my questions are:
Is Pok3r controller flashable? If so How?
Or the chip is locked by Vortex?


With doing this I'll lose default Vortex firmware and functionality but I don't mind this and I have other keyboards for daily usage:D
And if it is flashable I or someone of the community will be able to write custome firmware for Pok3r hopefully, in the end.

Thanks in advance,



[Update]
Resources:

twiddle's analysis of firmware in updater executable:
https://geekhack.org/index.php?topic=72262.msg1796931#msg1796931

pacet capture of updater by einalex:
https://geekhack.org/index.php?topic=72262.msg1956377#msg1956377
https://geekhack.org/index.php?topic=72262.msg1990025#msg1990025


[Update 160202]
https://geekhack.org/index.php?topic=72262.msg2037084#msg2037084

Snake hack for Coolermaster Quickfire Rapid-I:
  Update protocol
  http://spritesmods.com/?art=rapidisnake&page=3

  firmware update tool:
  http://spritesmods.com/?art=rapidisnake&page=7
« Last Edit: Tue, 02 February 2016, 00:03:37 by hasu »
TMK products:HHKB Alt  ⌨ConvertersAlps64FC660C AltFC980C Alt

Offline hitaki

  • Posts: 18
Re: Possiblity of Pok3r firmware replacement
« Reply #1 on: Fri, 29 May 2015, 11:15:05 »
Maybe try asking on their Facebook page.
RF 87ub, RF 10th Anniversary Edition, Leopold FC660C, KUL ES-87, KBP v60

Offline engicoder

  • Posts: 719
  • Location: North Carolina
Re: Possiblity of Pok3r firmware replacement
« Reply #2 on: Fri, 29 May 2015, 13:10:52 »
Many cortex-M microcontrollers have some type of flash read protection to prevent reverse engineering of firmware, but most do no prevent overwriting the flash memory. I believe Holtek has a proprietary programmer, but I imaging standard SWD or JTAG would also work. That may require desoldering the chip depending how those pins are used on the board.

   

Offline FuriousGeorge

  • Posts: 134
  • Location: United States
Re: Possiblity of Pok3r firmware replacement
« Reply #3 on: Fri, 29 May 2015, 16:12:06 »
I don't have anything useful to add, but I do want to wish you luck. A Pok3r with space-fn would be amazing.

Offline hasu

  • Thread Starter
  • Posts: 2926
  • Location: Tokyo, Japan
  • @tmk
    • tmk keyboard firmware project
Re: Possiblity of Pok3r firmware replacement
« Reply #4 on: Sat, 30 May 2015, 17:13:12 »
Many cortex-M microcontrollers have some type of flash read protection to prevent reverse engineering of firmware, but most do no prevent overwriting the flash memory. I believe Holtek has a proprietary programmer, but I imaging standard SWD or JTAG would also work. That may require desoldering the chip depending how those pins are used on the board.

Thanks.
Yes. What you said is exactly what occured on Poker II firmware hacking project.
https://github.com/erichkeane/poker2firmwarehacking

Probably Pok3r also can be overwritten with hardware programmer and it is far better than completely not flashable.
But if we can flash the MCU through USB just with software tool it would be great so that everyone can flash custom firmware without special hardware.
TMK products:HHKB Alt  ⌨ConvertersAlps64FC660C AltFC980C Alt

Offline wakko

  • Posts: 96
  • Location: Austin, TX
Re: Possiblity of Pok3r firmware replacement
« Reply #5 on: Sat, 30 May 2015, 17:59:26 »
Subscribing.
NOOB
KUL ES-87

Offline twiddle

  • Posts: 164
    • Portfolio
Re: Possiblity of Pok3r firmware replacement
« Reply #6 on: Sat, 30 May 2015, 23:31:34 »
You could probably make some sort of test jig with contacts that press down onto the chip's legs or the part of the traces which extends beyond them. There's an ISP/IAP bootloader that uses a special serial based protocol, the product page you linked to has a document about it. The jig could either use that or SWD - no point using JTAG (many more pins, and some Cortex M chips dont support it anyway).

From looking over the documentation there's no USB bootloader, though, so I'm guessing there's something being sent to the chip (custom USB report perhaps? certain key combination being pressed when the board is plugged in?) that either forces it into ISP mode or more likely just uses flash memory commands to reprogram itself.
If anybody has a USB protocol analyzer, getting a capture of the firmware update process would probably be helpful.

Offline mecano

  • Posts: 141
  • Location: France
Re: Possiblity of Pok3r firmware replacement
« Reply #7 on: Mon, 01 June 2015, 13:42:49 »
Heng Yu (the manufacturer) has matrix programming programs (windows and linux) anyone succeed in getting these?
Really a shame, they would sell even more keyboards if they provide these.

Offline jackiecanev2

  • Posts: 73
  • Location: US
Re: Possiblity of Pok3r firmware replacement
« Reply #8 on: Mon, 01 June 2015, 23:01:16 »
Many cortex-M microcontrollers have some type of flash read protection to prevent reverse engineering of firmware, but most do no prevent overwriting the flash memory. I believe Holtek has a proprietary programmer, but I imaging standard SWD or JTAG would also work. That may require desoldering the chip depending how those pins are used on the board.

Thanks.
Yes. What you said is exactly what occured on Poker II firmware hacking project.
https://github.com/erichkeane/poker2firmwarehacking

Probably Pok3r also can be overwritten with hardware programmer and it is far better than completely not flashable.
But if we can flash the MCU through USB just with software tool it would be great so that everyone can flash custom firmware without special hardware.

I'm planning to des older my switches tomorrow, so I can probably get shots of both sides of the board if that will help.

Looks like it's a universal board; there are extra placements for an ISO enter, short left shift, short right shift and others - the top plate is ANSI but the board should be the same.

Some of the poker 2 functions were inadvertently moved to other keys; I found that you can you can program the volume controls directly to another layer using the default, layer1, and layer2 bindings to another layer key. Maybe the previous backlight controls are blocked in the firmware main layer but it's blocked function still be bound to a non-default layer?

The led resistors are soldered (LRXX) but in the way of things that are fill-soldered, the led pins are filled and there are smd resistor pads soldered but with no resistors, six pairs that I can see. RRD2/RRU2, 3 and 4 are visible in the second picture.

Once I desolder the switches I'll try and scan the pcb on both sides.

« Last Edit: Mon, 01 June 2015, 23:04:10 by jackiecanev2 »
| HHKB2 | Viper | 356.2 | Ducati | pitties | scalpels |

Offline hasu

  • Thread Starter
  • Posts: 2926
  • Location: Tokyo, Japan
  • @tmk
    • tmk keyboard firmware project
Re: Possiblity of Pok3r firmware replacement
« Reply #9 on: Tue, 02 June 2015, 01:11:33 »
Once I desolder the switches I'll try and scan the pcb on both sides.

It would be definitely useful!

TMK products:HHKB Alt  ⌨ConvertersAlps64FC660C AltFC980C Alt

Offline KaLam1ty

  • Posts: 88
Re: Possiblity of Pok3r firmware replacement
« Reply #10 on: Tue, 02 June 2015, 02:16:13 »
I know that the Poker II had firmware upgrades via Vortex's proprietary flasher. The update allows NKRO via USB, among a few other things.
But the most notable thing though, was that there WAS a custom firmware released which allowed remapping of PN, FN, Caps, and LWin: https://geekhack.org/index.php?topic=64916.0

From what I've read here and there, the Pok3r will eventually get a firmware update for LED compatibility (as the PCB itself has holes for LED leads, but is currently not programmed for LED usage).
My guess is Vortex will eventually release this firmware once they start releasing Pok3r's with LEDs.

With this, there will most definitely be some proprietary firmware flasher.

Offline jpec

  • Posts: 2
  • Location: PARIS, FRANCE
Re: Possiblity of Pok3r firmware replacement
« Reply #11 on: Thu, 11 June 2015, 09:14:00 »
I don't have anything useful to add, but I do want to wish you luck. A Pok3r with space-fn would be amazing.


I totally agree with you !


I already asked them for SpaceFn support or opensourcing their firmware on facebook : https://www.facebook.com/Vortexgear/posts/748409298608405

Thinkpad x201 (CPU : i5 @ 2,4GHz, RAM : 8GO, SSD : 128GO) - Archlinux (x86_64) + LUKS + BTRFS + GNOME + Bépo
TEX Yoda (MX Brown, trackpoint) | HHPK (MX Brown)

Offline hoz

  • Posts: 105
  • Location: sweden
  • 60% is more than enough.
Re: Possiblity of Pok3r firmware replacement
« Reply #12 on: Fri, 12 June 2015, 04:27:31 »
Ducky mini/YOTH mini uses HT32F1655 and KBP V60 Mini HT32F1755, both had firmware updates released :)
one 40% and seven 60%'s

Offline Giorgio

  • Posts: 1841
  • Location: Italy
Re: Possiblity of Pok3r firmware replacement
« Reply #13 on: Fri, 12 June 2015, 08:25:16 »
asking them to open source the firmware maybe it's too much. Right now what people are really interested in is an easy way to configure the keyboard, something like the software used to configure the gon's nerd, which allows to program any key with any value-combination, not only with those actually present on the keyboard.

We should start a poll, and show vortex how much we want an easy way to configure the keyboard.




https://geekhack.org/index.php?topic=50577.msg1105404#msg1105404

Offline mecano

  • Posts: 141
  • Location: France
Re: Possiblity of Pok3r firmware replacement
« Reply #14 on: Wed, 17 June 2015, 12:54:05 »
Interresting documentation, debuggers and tracers for M3 from Keil: http://www.keil.com/dd/chip/7462.htm
not sure if the lite version allows you much to do (i'm on OSX, looks like Windows only).

Offline thismat

  • Posts: 4
Re: Possiblity of Pok3r firmware replacement
« Reply #15 on: Wed, 17 June 2015, 12:57:13 »
I'd definitely buy a pok3r if there was a good way to configure multiple layers.

Offline twiddle

  • Posts: 164
    • Portfolio
Re: Possiblity of Pok3r firmware replacement
« Reply #16 on: Wed, 17 June 2015, 14:36:10 »
Interresting documentation, debuggers and tracers for M3 from Keil: http://www.keil.com/dd/chip/7462.htm
not sure if the lite version allows you much to do (i'm on OSX, looks like Windows only).
I already have a J-link, it would just be a matter of whether the manufacturer properly set their flash protection settings to prevent dumping the binary out to a file.

Offline mecano

  • Posts: 141
  • Location: France
Re: Possiblity of Pok3r firmware replacement
« Reply #17 on: Fri, 10 July 2015, 12:22:14 »
Curious to know what you'll find out.

Offline twiddle

  • Posts: 164
    • Portfolio
Re: Possiblity of Pok3r firmware replacement
« Reply #18 on: Fri, 10 July 2015, 21:39:53 »
I'm pretty sure I've managed to dump the firmware out of the executable.
In the update program are a number of areas where the software calls ReadFile on itself then loops over a function that transforms the data that was read, changing it.


Notice Sub_401000 in the bottom left hand corner? That looks like this:


(the green arrows are showing how the code loops around a byte at a time to change the data)
Its pretty obvious that it is decrypting the firmware, because the first time we see this Read-Convert process happening, we convert from:



to



The second time this happens we get the following result:



Notice those funny repetitive bits at the start? they line up quite nicely with the Vector Table at the start of an ARM chip's firmware.
(the first address in the file at address 0 corresponds to the bottom entry in the diagram, moving upwards in the diagram as we keep going through the data, in groups of 4 numbers, cos thats just how memory really works)


They're basically addresses which is why they are all pointing into a similar region of code.

I can't test with anything because I don't have a POK3R but it looks like if you could replace the memory region in the application with your own custom firmware you could reflash the controller. You'd also need to skip the decryption process, I guess, but that shouldn't be much more than erasing the instructions that decrypt it.

On another note it looks like there's some sort of data being sent to the controller to initialise IAP (programming mode), based on this string I can see in the code:


I'm guessing, but I think sub_405480 is sending data to the keyboard to enter IAP mode.  The error happens if theres a timeout after a certain period.
With more effort perhaps this process could be hijacked but actually using a USB protocol analyser would take almost all of the guesswork out of it.

I've attached the firmware update I've been reversing, and included an archive containing the IDA Pro database and the dumped and decrypted data if people want to take a look.

Offline Giorgio

  • Posts: 1841
  • Location: Italy
Re: Possiblity of Pok3r firmware replacement
« Reply #19 on: Sat, 11 July 2015, 04:11:16 »
Fantastic job :-) now hackers will take down the server again :-)))))

If only we could convince vortex to allow us to program the layouts using an external software....


I'm pretty sure I've managed to dump the firmware out of the executable.
In the update program are a number of areas where the software calls ReadFile on itself then loops over a function that transforms the data that was read, changing it.
Show Image


Notice Sub_401000 in the bottom left hand corner? That looks like this:
Show Image


(the green arrows are showing how the code loops around a byte at a time to change the data)
Its pretty obvious that it is decrypting the firmware, because the first time we see this Read-Convert process happening, we convert from:

Show Image


to

Show Image


The second time this happens we get the following result:

Show Image


Notice those funny repetitive bits at the start? they line up quite nicely with the Vector Table at the start of an ARM chip's firmware.
(the first address in the file at address 0 corresponds to the bottom entry in the diagram, moving upwards in the diagram as we keep going through the data, in groups of 4 numbers, cos thats just how memory really works)
Show Image


They're basically addresses which is why they are all pointing into a similar region of code.

I can't test with anything because I don't have a POK3R but it looks like if you could replace the memory region in the application with your own custom firmware you could reflash the controller. You'd also need to skip the decryption process, I guess, but that shouldn't be much more than erasing the instructions that decrypt it.

On another note it looks like there's some sort of data being sent to the controller to initialise IAP (programming mode), based on this string I can see in the code:

Show Image

I'm guessing, but I think sub_405480 is sending data to the keyboard to enter IAP mode.  The error happens if theres a timeout after a certain period.
With more effort perhaps this process could be hijacked but actually using a USB protocol analyser would take almost all of the guesswork out of it.

I've attached the firmware update I've been reversing, and included an archive containing the IDA Pro database and the dumped and decrypted data if people want to take a look.



Offline tofgerl

  • Posts: 887
  • Location: Norway
Re: Possiblity of Pok3r firmware replacement
« Reply #20 on: Tue, 01 September 2015, 06:35:31 »
Any movement on this?

Offline ocodo

  • Posts: 27
  • Location: Singapore
Re: Possiblity of Pok3r firmware replacement
« Reply #21 on: Sun, 25 October 2015, 22:10:50 »
subscribed - I assume the outcome of this will be applicable to the KUL ES87 (same Holtek HT82K94E/HT82K94A MCU unless I'm way off!)

Offline ctm

  • Posts: 424
  • Location: Seattle, WA
  • Hello, world!
Re: Possiblity of Pok3r firmware replacement
« Reply #22 on: Sat, 31 October 2015, 11:13:40 »
Subscribed. If I can flash in TMK firmware to Poker 3R it will be so great! I also have a KBP V60 that uses a similar chip. Does it mean V60 might also be hackable?
TMK Alps64 w/ Matias Quiet Switches in KBP V60 case.
Infinity60 with SKCM Orange Switches w/ TMK.
CM Storm QRF w/ Frosty Flake controller, Cherry MX Blue Switches and TMK firmware.


Coming:
Ellipse Model F F62.

Offline einalex

  • Posts: 6
Re: Possiblity of Pok3r firmware replacement
« Reply #23 on: Fri, 04 December 2015, 18:08:54 »
Hi guys!
I updated my firmware from 113 to 114 and captured usb packets of the process.
See the attached file.

best, alex

Offline einalex

  • Posts: 6
Re: Possiblity of Pok3r firmware replacement
« Reply #24 on: Thu, 31 December 2015, 10:57:05 »
Hi guys!
A happy new year and another capture of updating the firmware from 1.1.4 to 1.1.5

Offline jcoffin1981

  • Posts: 706
Re: Possiblity of Pok3r firmware replacement
« Reply #25 on: Sat, 02 January 2016, 16:32:43 »
I have read just last night that Vortex released a firmware update that allows for media controls on all four FN layers, not just the ones you program on a single layer.  However, I have gotten used to them and am not sure if I want to change.
KPB V60 Gateron Browns and Leopold Keycaps.  Poker 3 with Gateron Browns and Poker keycaps.  Poker 3 with Cherry MX Browns, ABS keycaps and white LED's.

Leopold FC660M- my new favorite, right out of the box.

Offline gurghet

  • Posts: 9
  • Location: Italy
Re: Possiblity of Pok3r firmware replacement
« Reply #26 on: Wed, 13 January 2016, 02:22:41 »
subscribed

Offline overclocked157

  • Posts: 7
  • Location: Athens, GR
Re: Possiblity of Pok3r firmware replacement
« Reply #27 on: Wed, 13 January 2016, 08:01:34 »
I subscribed as well.
Visit the Typing Test and try!

Offline hasu

  • Thread Starter
  • Posts: 2926
  • Location: Tokyo, Japan
  • @tmk
    • tmk keyboard firmware project
Re: Possiblity of Pok3r firmware replacement
« Reply #28 on: Mon, 01 February 2016, 23:58:48 »
The other day, I found this hack in similar thread on reddit. And I looked into pcap logs attached in this thread and confirmed Pok3r update procedure is almost same as he described in here.
http://spritesmods.com/?art=rapidisnake&page=3

I think his tool can be used for Pok3r to update its firmware with slight modification.
http://spritesmods.com/?art=rapidisnake&page=7

I think we can make firmware updater for Pok3r based on his work. I'd recommend someone interested to read this article.
I can't try this because I don't have Pok3r but still update first post of this thread to share info.
TMK products:HHKB Alt  ⌨ConvertersAlps64FC660C AltFC980C Alt

Offline einalex

  • Posts: 6
Re: Possiblity of Pok3r firmware replacement
« Reply #29 on: Sat, 06 February 2016, 17:50:57 »
Nice find hasu!
The usb commands are the same in the pok3r firmware. I'm currently implementing a pok3r specific version of his flashing tool in python.

Offline iLLucionist

  • * Elevated Elder
  • Posts: 2715
  • Location: Netherlands
  • Topre is Love.
Re: Possiblity of Pok3r firmware replacement
« Reply #30 on: Sat, 06 February 2016, 18:58:01 »
This is really cool. If anything workable comes out of this, I would buy the pok3r in a heartbeat. I really dislike the default mappings in layer-1 (tilde/backtick/esc for example... whhhyyyy??).
MJT2 Browns o-rings - HHKB White - ES-87 Smoke White Clears - 87UB 55g

Offline tofgerl

  • Posts: 887
  • Location: Norway
Re: Possiblity of Pok3r firmware replacement
« Reply #31 on: Sun, 07 February 2016, 04:19:09 »
Would this enable TMK, or just remapping?

Offline jumbled

  • Posts: 1
Re: Possiblity of Pok3r firmware replacement
« Reply #32 on: Tue, 09 February 2016, 04:48:29 »
@einalex please do this, you will gain much respect. If it works, stick it on a site with a donate button. I'm looking to convert the alt/fn/pn/ctrl buttons to arrows: without clunky workarounds.

Offline iLLucionist

  • * Elevated Elder
  • Posts: 2715
  • Location: Netherlands
  • Topre is Love.
Re: Possiblity of Pok3r firmware replacement
« Reply #33 on: Tue, 09 February 2016, 08:51:51 »
Nice find hasu!
The usb commands are the same in the pok3r firmware. I'm currently implementing a pok3r specific version of his flashing tool in python.

Really cool, are you going to put it in github?
MJT2 Browns o-rings - HHKB White - ES-87 Smoke White Clears - 87UB 55g

Offline einalex

  • Posts: 6
Re: Possiblity of Pok3r firmware replacement
« Reply #34 on: Wed, 24 February 2016, 18:30:07 »
No worries, I'm still working on it.
I have something working that can read the flash. But the firmware has a security mechanism that results in the script reading just zeros over large areas (same problem sprite had)
So I'm looking for the byte in the firmware that I can flip to disable that check.
For details read sprites article. He solved the problem for another keyboard already.

Offline einalex

  • Posts: 6
Re: Possiblity of Pok3r firmware replacement
« Reply #35 on: Wed, 24 February 2016, 19:43:51 »

The flash script has it's own github repo now.
It's a little python thingy and still lacks most of what would make it usable (a user interface).

Find it here:
https://github.com/einalex/pok3r-flash-tool

Feel free to contribute.
Although if you poke through the firmware to find that part which turns most of our flash reading to zeros, that would be even better.

Offline einalex

  • Posts: 6
Re: Possiblity of Pok3r firmware replacement
« Reply #36 on: Wed, 24 February 2016, 19:47:59 »
Would this enable TMK, or just remapping?


We would have to adjust the TMK firmware to work with this specific chip.
It should be doable, might take some work though.

Offline grav3serker

  • Posts: 236
  • Location: California
  • graves + berserker = grav3serker
Re: Possiblity of Pok3r firmware replacement
« Reply #37 on: Sat, 27 February 2016, 11:57:35 »
I came across this the other day, but I'm not sure if it'll be any help or not, as it's for the V60.

https://github.com/pellettiero/V60Mini-firmhack

If this is of any use to anyone, awesome, if not, I tried! Haha. I'd love to re-write the firmware for the V60 so that I can change the layout to HHKB style.

 :thumb:

Offline PaNaVTEC

  • Posts: 1
Re: Possiblity of Pok3r firmware replacement
« Reply #38 on: Thu, 02 June 2016, 02:46:50 »
Is this project still alive? I can help with that UI if necessary, not an expert of python, but still I can do it.

Offline randomize

  • Posts: 1
  • Location: Chisinau, MD
    • Github
Re: Possiblity of Pok3r firmware replacement
« Reply #39 on: Tue, 09 August 2016, 01:05:02 »
Hi guys, just did some progress on this.

My goal is to replace US Dvorak mode with Programmer Dvorak in my WASD CODE (same hw as Pok3r), so I can happily type it with no extra software on target machine.
Firmware update process and protections around it are indeed pretty similar to ones Sprite described in his article.

Wrote two simple C tools to decode and encode firmware (can't call ROR and swap an encryption, ha) - keep in mind that alg can be slightly tweaked in future firmware updater executables from Vortex, and that there are two blocks of data at the end of firmware - a big one with vector table and arm instructions and a smaller one with string constants - because of that offset, smaller block needs to be decoded separately.
https://github.com/randomize/pok3r-dec

Top bytes (right after vector table) of decoded fw are mangled somehow, but the rest looks like valid code so I found instructions that do protect from reading.
Encoding back patched and flushing was simple - attached pwned exe of v1.1.5. here is radiff2 output - just one byte does it:
Code: [Select]
0x001a7dba 09 => f2 0x001a7dba
After that I was able to dump firmware (and some bootloader in high address I guess) with neat tool by einalex https://github.com/einalex/pok3r-flash-tool - thanks man.
Attached dump as flash.img
Comparing with decoded fw form updater reveals that blocks are indeed mangled - will find how these are decoded on kb side later.
Next and more hard step is to find where dvorak switch is implemented and tweak it

Thanks to all for this thread - was a good starting point



Offline Giorgio

  • Posts: 1841
  • Location: Italy
Re: Possiblity of Pok3r firmware replacement
« Reply #40 on: Tue, 09 August 2016, 03:39:42 »
Has anyone tried to ask vortex???

I'm sure that the could open source their firmware if the community could help them in making an opersource configurator. Possibly adapting the existing ones?

Offline lunas

  • Posts: 35
Re: Possiblity of Pok3r firmware replacement
« Reply #41 on: Thu, 11 August 2016, 12:47:41 »
My skillset doesn't offer much in this endeavor, but I'm very interested in better programability for the Pok3r. I'm a Pok3r owner and happy to assist in any grunt work.
Pok3r Whitefox

Offline blastoid

  • Posts: 141
Re: Possiblity of Pok3r firmware replacement
« Reply #42 on: Mon, 17 October 2016, 09:29:39 »
Any recent movement on this?

Offline pon10

  • Posts: 277
  • Location: At the desk
  • looking at my keycaps..
Re: Possiblity of Pok3r firmware replacement
« Reply #43 on: Mon, 17 October 2016, 10:45:13 »
This is great! hope is coming from vortex one day.. but i also like the idea that everything is just in the board and i was born autistic....

Offline ChaoticConundrum

  • Posts: 2
  • Location: New England
Re: Possiblity of Pok3r firmware replacement
« Reply #44 on: Mon, 07 November 2016, 01:50:24 »
I hadn't checked this thread for a while, but I independently came to the same solution randomize did, somewhat inspired by sprite's work. I was able to dump the 128KB flash and the 8KB read-only boot loader directly from the Pok3r over USB, after running the patched v1.1.7 updater. All three are attached if anyone else wants to look at them. I take no responsibility if the patched updater bricks your keyboard, you have been warned.

The flash image is set at 0x0 in the ARM memory map, and the bootloader image is set at 0x1F000000. I haven't tried dumping the entirety of the address space, but everywhere else, including peripheral registers and SRAM seems to read 0's. It seems most likely there is another test in the program before the function randomize and I each changed.
As far as I can tell, there are three vector tables between the two images, at 0x0 and 0x2C00 in the flash image, and 0x0 in the boot loader.

I've also done some reading in the HT32 user manual, trying to figure out the program flow of the whole firmware. The boot pins on the processor are both grounded, so according to the manual, the program counter should start at the value of the SBVT1 register, with reset value 0x20000155. This doesn't make sense to me, since SRAM is volatile. If anyone knows what I'm missing here, it'd be great to know. Datasheet and user manual are attached, just for simplicity.

I wrote my own code for decoding firmware from the updaters, encoding patched firmware back into an updater, and reading from the keyboard in C++. I'll eventually make my version of the code public, but it's tangled up in my personal C++ libraries, which I haven't made public yet. I have a bunch of small projects to clean up and release at some point.

Also, for disassembling code, I like to use
Code: [Select]
arm-none-eabi-objdump -D -EL -b binary -m arm -M force-thumb firmware.bin
I have investigated JTAG options on the HT32 in the Pok3r. Fortunately, the chip does not need to be desoldered to connect a debugger to it. There is an unpopulated 5-pin header on the board (CN2), which exposes SWD signals. The pinout is (from 1 to 5, pin 1 is denoted by square pad) 3.3V, SWDIO, SWCLK, nRST, GND. Unfortunately, SWD support isn't very good in many debug interfaces or software. I wasn't able to get it to work with a JLink.

I think the end goal of this project should be an alternative to the official updaters, so it may be more useful to figure out how the existing bootloader and USB code are implemented. This way, the firmware can be rolled back by the official updaters. Just in case vortex releases new features, people can have the option to update to it.

I just wanted to join this conversation, put in my two cents. Thoughts and ideas appreciated.

Offline giammin

  • Posts: 48
  • Location: bologna, italy
Re: Possiblity of Pok3r firmware replacement
« Reply #45 on: Fri, 02 December 2016, 02:38:25 »
I asked Vortex about if they have any plan on opensource their firmware or if they will be compatible with tmk qmk firmware.


Waiting for a response

Offline Giorgio

  • Posts: 1841
  • Location: Italy
Re: Possiblity of Pok3r firmware replacement
« Reply #46 on: Fri, 02 December 2016, 05:13:44 »
I asked Vortex about if they have any plan on opensource their firmware or if they will be compatible with tmk qmk firmware.


Waiting for a response

Are you willing to make an online petition?

Offline giammin

  • Posts: 48
  • Location: bologna, italy
Re: Possiblity of Pok3r firmware replacement
« Reply #47 on: Fri, 02 December 2016, 05:45:12 »
I asked Vortex about if they have any plan on opensource their firmware or if they will be compatible with tmk qmk firmware.


Waiting for a response

Are you willing to make an online petition?
great idea gianni

Offline ChaoticConundrum

  • Posts: 2
  • Location: New England
Re: Possiblity of Pok3r firmware replacement
« Reply #48 on: Wed, 07 December 2016, 13:54:09 »
I have put my reverse-engineering project for the Pok3r firmware on GitHub, here: https://github.com/ChaoticConundrum/pok3r_re_firmware.

I have also learned a bit about the maker of the pok3r firmware. First, the firmware has a *near* identical update procedure and encryption scheme to the CM Storm QuickFire Rapid-i, which Sprite successfully cracked. Second, while looking at the firmware update program for the Pok3r RGB, I found the version strings indicate Cooler Master as the Company Name and Legal Copyright. So, either Cooler Master writes the firmware for Vortex, or both Vortex and Cooler Master outsource firmware to another company, which seems the most likely.

It seems fairly unlikely to me that Vortex would be willing (or legally able) to open-source firmware they probably didn't write, especially if it is very similar to Cooler Master's firmware. It also shows to me that more firmware updates for any Pok3r model will likely be scarce, because each update to the firmware costs more money if it is outsourced, rather than already having programmer(s) in-house.

Just my opinion from my experience. I think open-source Pok3r firmware will have to be in our hands.

Offline condekind

  • Posts: 10
Re: Possiblity of Pok3r firmware replacement
« Reply #49 on: Fri, 16 December 2016, 11:38:21 »
Zero knowledge on how to help with this, but I'm very interested in the results! Recently purchased a pok3r and it would be awesome to have it fully programmable :)

Offline giammin

  • Posts: 48
  • Location: bologna, italy
Re: Possiblity of Pok3r firmware replacement
« Reply #50 on: Fri, 16 December 2016, 11:40:33 »
no response from vortex...

anyway it would be enough to have compatibility with tmk or qmk

Offline giammin

  • Posts: 48
  • Location: bologna, italy
Re: Possiblity of Pok3r firmware replacement
« Reply #51 on: Fri, 16 December 2016, 11:46:52 »
I have put my reverse-engineering project for the Pok3r firmware on GitHub, here: https://github.com/ChaoticConundrum/pok3r_re_firmware.

I have also learned a bit about the maker of the pok3r firmware. First, the firmware has a *near* identical update procedure and encryption scheme to the CM Storm QuickFire Rapid-i, which Sprite successfully cracked. Second, while looking at the firmware update program for the Pok3r RGB, I found the version strings indicate Cooler Master as the Company Name and Legal Copyright. So, either Cooler Master writes the firmware for Vortex, or both Vortex and Cooler Master outsource firmware to another company, which seems the most likely.

It seems fairly unlikely to me that Vortex would be willing (or legally able) to open-source firmware they probably didn't write, especially if it is very similar to Cooler Master's firmware. It also shows to me that more firmware updates for any Pok3r model will likely be scarce, because each update to the firmware costs more money if it is outsourced, rather than already having programmer(s) in-house.

Just my opinion from my experience. I think open-source Pok3r firmware will have to be in our hands.

this is great!

Offline f1lt3r

  • Posts: 1
  • Location: Boston, USA
Re: Possiblity of Pok3r firmware replacement
« Reply #52 on: Thu, 05 January 2017, 20:10:58 »
I am really loving the Pok3r, but the thing that annoys me is that you can't move the programming-mode keys (Fn + R_Ctrl). This is frustrating as I would like to remap "Shift + R_Ctrl" to "Fn + L" (Cursor Arrow Right), so that the modifier keys right of the spacebar are like the Vim HJKL keys.


Offline falkentyne

  • Posts: 283
Re: Possiblity of Pok3r firmware replacement
« Reply #53 on: Thu, 05 January 2017, 21:30:10 »
Does the iKBC F108/F87 use the same type of firmware?
Because ikbc and vortex are very related.  I even think Ducky is in there with them too (their firmware use holtek flashers...)

Offline motoyuki85

  • Posts: 1
Re: Possiblity of Pok3r firmware replacement
« Reply #54 on: Thu, 20 April 2017, 00:10:11 »
Any update on this project?


Sent from my iPhone using Tapatalk

Offline pon10

  • Posts: 277
  • Location: At the desk
  • looking at my keycaps..
Re: Possiblity of Pok3r firmware replacement
« Reply #55 on: Thu, 20 April 2017, 23:43:36 »
Sometime ago vortex stated on MD that there would be possible of a software solution in Q3 17, lets hope they update it so we can choose n change how to switch layers!

Offline tofgerl

  • Posts: 887
  • Location: Norway
Re: Possiblity of Pok3r firmware replacement
« Reply #56 on: Mon, 15 May 2017, 08:14:06 »
Yeah, afaik there is no way to do this without proper specs from Vortex. In the mean time, Hasu's excellent usb_usb adapters work fine.

Offline andreya

  • Posts: 5
Re: Possiblity of Pok3r firmware replacement
« Reply #57 on: Thu, 04 January 2018, 06:47:28 »
I wish we can add mouse keys, then this keyboard would be complete.