Overview USB VID 0x046d USB PID 0xc52b Message Sub ID 0x80 SET_REGISTER 0x81 GET_REGISTER 0x82 SET_LONG_REGISTER 0x83 GET_LONG_REGISTER 0x8F ERROR_MSG Notifications 0x40 Device Disconnection 0x41 Device Connection 0x4A Unifying Receiver Locking Change information Registers 0x00 Enable HID++ Notifications 0x02 Connection State 0xB2 Device Connection and Disconnection (Pairing) 0xB3 Device Activity 0xB5 Pairing Information (more undocumented below) Not documented: Long register B5 (Pairing Information) - nn=03 "Receiver information?" Send: 10 FF 83 B5 03 00 00 00 - Short (10) message for receiver (FF) to retrieve long register (83) PairingInfo (B5) with special param 03 00 00 00. Recv: 11 FF 83 B5 03 AF 4F 95 EA 05 06 0E 00 00 00 00 00 00 00 00 11 - Long message FF - Receiver target 83 - LONG_REGISTER_RESPONSE B5 - Pairing Info 03 - "Receiver information"? AF 4F 95 EA - Serial Number of receiver 05 - dunno, also seen: 02, 18 06 - Max Device Capability? (not sure, but it is six) 0E - dunno, also seen: 32, 47 00 00 00 00 00 00 00 00 - padding? Remaining information: - Wireless Status (0x03) - ModelId (0x46d c52b) - Handle: 0xff000001 (0xff is device ID, 01 is internal to the software, ordered) - Dfu Status (0x1) - Is Dfu Cancellable (yes) DFU = Device Firmware Upgrade 0x00 - Up-to-date 0x01 - Unknown 0x02 - Available 0x03 - Initiated 0x04 - Failed 0x05 - Succeeded 0x06 - Newer software needed 0x06 - Unrecoverable Short register F1 - "Version information" (guessed) Header: 10 FF 81 (short msg, receiver is target, GET_REGISTER) Data: F1 nn xx yy (xx yy is empty for request and contains version for response) nn=01 xx,yy=12 01 nn=02 xx,yy=00 19 nn=03 error 03 (Invalid address) (but returns 00 07 for keyboard) nn=04 xx,yy=02 14 Displayed firmware version: 012.001.00019 (x1 . y1 . x2 y2) Displayed bootloader version: BL.002.014 (BL . x4 . y4) More undocumented short regs **for K800 keyboard**: 17 rw Illumination info get 00 00 00 - Retrieve illimunation status? rsp: 3C 00 02 - (illimunation is disabled) set 3C 00 01 - Activate illumination only when I start typing set 3C 00 02 - Disable keyboard illumination Notif [10 ix 17] 3C 00 00 0n received when the keyboard illumination level is changed. (n = 1..5; 1=off; 5=full brightness) (NOTE: needs notif flag 00 02 00) 01 rw "Keyboard hand detection?" get 00 00 00 - retrieve keyboard hand detection status? rsp: 00 00 20 - (hand detection is disabled) set 00 00 00 - Enable hand detection set 00 00 20 - Disable hand detection 09 rw "F key functions" get 00 00 00 - Retrieve F key function state rsp: 00 00 00 - (F key functions are not swapped) set 00 01 00 - Swap F key functions set 00 00 00 - Do not swap F key functions 00 rw ENABLED_NOTIFS, 10 02 00, 10 is Battery info, buy what is 02? After writing FF FF FF, reading the register shows 13 02 00 .1 .. .. - If enabled, keys like Web and Mute are passed over the HID protocol with short message type=03. This presumably allows the user to customize key bindings. .2 .. .. - If enabled, Fn+F8 (Sleep button) generates a HID++ short message instead of a key event that is captured by the Linux input layer (10 ix 04 0s 00 00 00 where s=1 when pressed and s=0 when released). 10:53:54.914 Recv report_id=10 short device=01 DEV1 type=04 SYSTEM_CONTROL params=01 00 00 00 1. .. .. - battery status (documented) (see also below, register/type 07) .. .2 .. - backlight changes (pressing Fn+F[56]) (more details about bits 0 and 1 of flag 1 in keyboard.txt) 07 r Likely the battery status of the kbd, not observed for M525 mouse get 00 00 00 rsp: 07 00 00 - (Battery full?) rsp: 01 00 00 - (Battery almost empty? Flashing red light on keyboard) Undocumented short type=07 for KBD dev: 10 02 07 01 00 00 00; sent when pressing the Fn+F7 key for battery information. 01 is presumably the battery level (red, danger, etc)) (on kbd enable, 10 02 07 01 00 00 00 is sent ONLY if notification is enabled after NOTIF_DEVICE_PAIRED (0x41) / ?NOTIF_PAIR_ACCEPTED (0x4B); not observed when battery is not near dead) Format: 10 DEVID 07 00 00 (or: response to reading register, 10 DEVID 81 07 07 00) Battery level: 00 is not possible for battery level, when the keyboard went off because of zero power, 01 was still the reported value 01 - red zone 03 - one bar 05 - two bars 07 - three bars Some magic: 00 - after unplugging/when not connected 22 - fully charged 25 - charging 26 - notification when battery is fully charged [10 ix 07] 07 26 00 00 NOTE: 10 ix 07 notifications are only available when r0bit4 (Battery status) of Enable Hid++ Notifications (type=0x00) is enabled. This notification is then sent when pressing the Fn+F7 (battery) key or when an event happens (battery full). Recv report_id=10 short device=02 DEV2 type=41 NOTIF_DEVICE_PAIRED params=04 A1 10 20 # Hello, I am a device! Recv report_id=20 unkn device=02 DEV2 type=42 NOTIF_CONNECTION_STATUS params=00 00 00 00 00 00 00 00 00 00 00 00 # wtf is this? Recv report_id=10 short device=02 DEV2 type=4B ?NOTIF_PAIR_ACCEPTED params=01 00 00 00 # Guessed: pair succeeded? Send report_id=10 short device=02 DEV2 type=80 SET_REG reg=00 ENABLED_NOTIFS params=10 00 00 # Enable battery status notifs Recv report_id=10 short device=02 DEV2 type=80 SET_REG reg=00 ENABLED_NOTIFS params=00 00 00 # succesfully set Recv report_id=10 short device=02 DEV2 type=07 params=01 00 00 00 # battery low notif! 17 rw ??? Send report_id=10 short device=02 DEV2 type=81 GET_REG reg=17 params=00 00 00 report_id=10 short device=02 DEV2 type=81 GET_REG reg=17 params=3C 00 01 Send report_id=10 short device=02 DEV2 type=80 SET_REG reg=17 params=3C 00 01 report_id=10 short device=02 DEV2 type=80 SET_REG reg=17 params=00 00 00 Send report_id=10 short device=02 DEV2 type=81 GET_REG reg=01 params=00 00 00 report_id=10 short device=02 DEV2 type=81 GET_REG reg=01 params=00 00 00 Send report_id=10 short device=02 DEV2 type=80 SET_REG reg=01 params=00 00 00 report_id=10 short device=02 DEV2 type=80 SET_REG reg=01 params=00 00 00 Send report_id=10 short device=02 DEV2 type=81 GET_REG reg=09 params=00 00 00 report_id=10 short device=02 DEV2 type=81 GET_REG reg=09 params=00 00 00 Send report_id=10 short device=02 DEV2 type=80 SET_REG reg=09 params=00 00 00 report_id=10 short device=02 DEV2 type=80 SET_REG reg=09 params=00 00 00 Send report_id=10 short device=02 DEV2 type=81 GET_REG reg=07 params=00 00 00 report_id=10 short device=02 DEV2 type=81 GET_REG reg=07 params=07 00 00 Send report_id=10 short device=02 DEV2 type=81 GET_REG reg=00 ENABLED_NOTIFS params=00 00 00 report_id=10 short device=02 DEV2 type=81 GET_REG reg=00 ENABLED_NOTIFS params=10 02 00 Send report_id=10 short device=02 DEV2 type=80 SET_REG reg=00 ENABLED_NOTIFS params=10 02 00 report_id=10 short device=02 DEV2 type=80 SET_REG reg=00 ENABLED_NOTIFS params=00 00 00 Send report_id=10 short device=02 DEV2 type=81 GET_REG reg=17 params=00 00 00 report_id=10 short device=02 DEV2 type=81 GET_REG reg=17 params=3C 00 01 Send report_id=10 short device=02 DEV2 type=80 SET_REG reg=17 params=3C 00 01 report_id=10 short device=02 DEV2 type=80 SET_REG reg=17 params=00 00 00 Send report_id=10 short device=02 DEV2 type=81 GET_REG reg=01 params=00 00 00 report_id=10 short device=02 DEV2 type=81 GET_REG reg=01 params=00 00 00 Send report_id=10 short device=02 DEV2 type=80 SET_REG reg=01 params=00 00 00 report_id=10 short device=02 DEV2 type=80 SET_REG reg=01 params=00 00 00 Send report_id=10 short device=02 DEV2 type=81 GET_REG reg=09 params=00 00 00 report_id=10 short device=02 DEV2 type=81 GET_REG reg=09 params=00 00 00 Send report_id=10 short device=02 DEV2 type=80 SET_REG reg=09 params=00 00 00 report_id=10 short device=02 DEV2 type=80 SET_REG reg=09 params=00 00 00 Send report_id=10 short device=02 DEV2 type=81 GET_REG reg=07 params=00 00 00 report_id=10 short device=02 DEV2 type=81 GET_REG reg=07 params=07 00 00 Enabled HID++ Notifications for receiver Serial number: 03AF4F95 (shipped with K800 keyboard) Firmware version: 012.001.00019 Bootloader version: BL.002.014 Supported notifs: 00 09 00 Serial number: 08D89AA6 (shipped with M525 mouse) Firmware version: 024.000.00018 Bootloader version: BL.000.006 Supported notifs: 00 19 00 ^--- besides Wireless notifs (r1bit1) and Software present (r1bit3) it also supports another flag: r1bit4 (unknown functionality) Documented in hidpp10: Allows for testing protocol version. Request: 10 DeviceIndex 00 1n 00 00 uu - n is SwId - UU is "ping data" defined by SW Responses: HID++ 1.0: 10 ix 8F 00 Fn 01 00 (ERR_INVALID_SUBID) HID++ 2.0: 10 ix 00 1n 02 00 UU HID++ X.Y: 10 ix 00 1n XX YY UU Discovery: 1. Get Reg 00 2. Set Reg 00 to value from (1) with bit 0 of the second byte enabled (v1[1] |= 1) 3. Send read CONNECTION_STATE register for total number of devices 4. Write CONNECTION_STATE 02 00 00 register 5. (4) triggers a 0x41 notification (Device Paired notification) for each device. Note, device index does not have to start at 1 (if device got unpaired before). 5. Got response for (3). 6. (disable discovery) Get Reg 00 7. Set Reg 00 to value from (6) with bit 0 of the second byte disabled (v1[1] &= ~1) Startup (all targeted at receiver, notifications come from device 1..6): 1. Get receiver details from pairing info register (serial number, etc) 2. Get firmware version (recv) 3. Get bootloader version (recv) 4. Get enabled notifications 5. Enable wireless notifications (set enabled notifs reg) 6. Read connection state register for number of machines for each machine from (6): 7. Write params to connection state register (02 00 00 was written) (read returns after (8)) (possibly a "trigger report all paired devices") 8. (7) immediately triggers a Device Paired notification for a previously paired dev 9. Send/Read request for paired device device name 10. Send/Read request for paired device extended info (serial, .., location of power switch) 11. Read fw+bootloader version information again (this seems useless?) A1. Pairing starts: write DEVICE_PAIRING register, enable pairing with timeout (read returns after (A2)) A2. (A1) triggers Receiver Lock Changed notification (subid=0x41) (reason: no error) A3. On timeout, Receiver Lock Changed notification is received (reason: timeout) A4. (close button) On close, DEVICE_PAIRING register is written to disable pairing discovery A5. Receiver Lock Changed notification is immediately received (reason: timeout) Advanced: B1. Advanced button is pressed. Polling starts, every x time, DEVICE_ACTIVITY register request is sent/read B2. Unpair device, Device Unpaired notification (subid=0x40) received (reason: device disconnected) (note, report id 10 and 20 received, ignore 20) Send report_id=10 short device=FF RECV type=83 GET_LONG_REG reg=B5 PAIRING_INFO params=03 00 00 report_id=11 long device=FF RECV type=83 GET_LONG_REG reg=B5 PAIRING_INFO params=03 AF 4F 95 EA 05 06 0E 00 00 00 00 00 00 00 00 Send report_id=10 short device=FF RECV type=81 GET_REG reg=F1 VERSION_INFO? params=01 00 00 report_id=10 short device=FF RECV type=81 GET_REG reg=F1 VERSION_INFO? params=01 12 01 Send report_id=10 short device=FF RECV type=81 GET_REG reg=F1 VERSION_INFO? params=02 00 00 report_id=10 short device=FF RECV type=81 GET_REG reg=F1 VERSION_INFO? params=02 00 19 Send report_id=10 short device=FF RECV type=81 GET_REG reg=F1 VERSION_INFO? params=03 00 00 report_id=10 short device=FF RECV type=8F _ERROR_MSG SubID=81 GET_REG reg=F1 VERSION_INFO? err=03 INVALID_ADDRESS Send report_id=10 short device=FF RECV type=81 GET_REG reg=F1 VERSION_INFO? params=04 00 00 report_id=10 short device=FF RECV type=81 GET_REG reg=F1 VERSION_INFO? params=04 02 14 Send report_id=10 short device=FF RECV type=81 GET_REG reg=00 ENABLED_NOTIFS params=00 00 00 report_id=10 short device=FF RECV type=81 GET_REG reg=00 ENABLED_NOTIFS params=00 01 00 Send report_id=10 short device=FF RECV type=80 SET_REG reg=00 ENABLED_NOTIFS params=00 01 00 report_id=10 short device=FF RECV type=80 SET_REG reg=00 ENABLED_NOTIFS params=00 00 00 Send report_id=10 short device=FF RECV type=81 GET_REG reg=02 CONNECTION_STATE params=00 00 00 report_id=10 short device=FF RECV type=81 GET_REG reg=02 CONNECTION_STATE params=00 01 00 Send report_id=10 short device=FF RECV type=80 SET_REG reg=02 CONNECTION_STATE params=02 00 00 report_id=10 short device=01 DEV1 type=41 NOTIF_DEVICE_PAIRED params=04 61 10 20 report_id=10 short device=FF RECV type=80 SET_REG reg=02 CONNECTION_STATE params=00 00 00 Send report_id=10 short device=FF RECV type=83 GET_LONG_REG reg=B5 PAIRING_INFO params=40 00 00 report_id=11 long device=FF RECV type=83 GET_LONG_REG reg=B5 PAIRING_INFO params=40 04 4B 38 30 30 00 00 00 00 00 00 00 00 00 00 Send report_id=10 short device=FF RECV type=83 GET_LONG_REG reg=B5 PAIRING_INFO params=30 00 00 report_id=11 long device=FF RECV type=83 GET_LONG_REG reg=B5 PAIRING_INFO params=30 FB 84 1B 86 1A 40 00 00 07 00 00 00 00 00 00 Send report_id=10 short device=FF RECV type=81 GET_REG reg=F1 VERSION_INFO? params=01 00 00 report_id=10 short device=FF RECV type=81 GET_REG reg=F1 VERSION_INFO? params=01 12 01 Send report_id=10 short device=FF RECV type=81 GET_REG reg=F1 VERSION_INFO? params=02 00 00 report_id=10 short device=FF RECV type=81 GET_REG reg=F1 VERSION_INFO? params=02 00 19 Send report_id=10 short device=FF RECV type=81 GET_REG reg=F1 VERSION_INFO? params=03 00 00 report_id=10 short device=FF RECV type=8F _ERROR_MSG SubID=81 GET_REG reg=F1 VERSION_INFO? err=03 INVALID_ADDRESS Send report_id=10 short device=FF RECV type=81 GET_REG reg=F1 VERSION_INFO? params=04 00 00 report_id=10 short device=FF RECV type=81 GET_REG reg=F1 VERSION_INFO? params=04 02 14 No paired devices, start pairing: 1. Enable device pairing (response read returns after (2)) 2. Got receiver lock notification (locking open) 3. Enable device, got Device Paired notif (kbd, link encrypted, link not established) 4. Send read request for device name (response in (6)) (5. got report_id=20 for device paired notif) 5. Got Receiver Lock changed notification (lock closed) 6. Response for device name (sent in (4)), Send/Read request for paired device extended info (serial, .., location of power switch) 7. Got Device Paired notif (kbd, link encrypted, link established, link with payload) 8. (??) Send dev1 [header 10 01 00] 12 28 3F 94 9. Got notification ("Pair accepted"?) [header 10 01 4B] 01 00 00 00 10. Dev1 request (8) returned error message (err=01 SUCCESS) 11. Read dev1 register 0D, but it returns an error (err=02 INVALID_SUBID) 12. Request/read dev1 register 07 13. Read dev1 firmware, bootloader version 14. Read recv firmware, bootloader version 15. Write DEVICE_PAIRING register (close lock) 16. Got Receiver Lock changed notification (lock closed) (was already closed in (5) though) Send report_id=10 short device=FF RECV type=80 SET_REG reg=B2 DEVICE_PAIRING params=01 53 3C report_id=10 short device=FF RECV type=4A NOTIF_RECV_LOCK_CHANGED params=01 00 00 00 report_id=10 short device=FF RECV type=80 SET_REG reg=B2 DEVICE_PAIRING params=00 00 00 report_id=10 short device=01 DEV1 type=41 NOTIF_DEVICE_PAIRED params=04 61 10 20 Send report_id=10 short device=FF RECV type=83 GET_LONG_REG reg=B5 PAIRING_INFO params=40 00 00 report_id=20 unkn device=01 DEV1 type=41 NOTIF_DEVICE_PAIRED params=00 10 20 1A 40 00 00 00 00 00 00 00 report_id=10 short device=FF RECV type=4A NOTIF_RECV_LOCK_CHANGED params=00 00 00 00 report_id=11 long device=FF RECV type=83 GET_LONG_REG reg=B5 PAIRING_INFO params=40 04 4B 38 30 30 00 00 00 00 00 00 00 00 00 00 Send report_id=10 short device=FF RECV type=83 GET_LONG_REG reg=B5 PAIRING_INFO params=30 00 00 report_id=11 long device=FF RECV type=83 GET_LONG_REG reg=B5 PAIRING_INFO params=30 FB 84 1B 86 1A 40 00 00 07 00 00 00 00 00 00 report_id=10 short device=01 DEV1 type=41 NOTIF_DEVICE_PAIRED params=04 A1 10 20 Send report_id=10 short device=01 DEV1 type=00 params=12 28 3F 94 report_id=10 short device=01 DEV1 type=4B ?NOTIF_PAIR_ACCEPTED params=01 00 00 00 report_id=10 short device=01 DEV1 type=8F _ERROR_MSG SubID=00 reg=12 err=01 SUCCESS Send report_id=10 short device=01 DEV1 type=81 GET_REG reg=0D params=00 00 00 report_id=10 short device=01 DEV1 type=8F _ERROR_MSG SubID=81 GET_REG reg=0D err=02 INVALID_SUBID Send report_id=10 short device=01 DEV1 type=81 GET_REG reg=07 params=00 00 00 report_id=10 short device=01 DEV1 type=81 GET_REG reg=07 params=07 00 00 Send report_id=10 short device=01 DEV1 type=81 GET_REG reg=F1 VERSION_INFO? params=01 00 00 report_id=10 short device=01 DEV1 type=81 GET_REG reg=F1 VERSION_INFO? params=01 22 01 Send report_id=10 short device=01 DEV1 type=81 GET_REG reg=F1 VERSION_INFO? params=02 00 00 report_id=10 short device=01 DEV1 type=81 GET_REG reg=F1 VERSION_INFO? params=02 00 19 Send report_id=10 short device=01 DEV1 type=81 GET_REG reg=F1 VERSION_INFO? params=03 00 00 report_id=10 short device=01 DEV1 type=81 GET_REG reg=F1 VERSION_INFO? params=03 00 07 Send report_id=10 short device=01 DEV1 type=81 GET_REG reg=F1 VERSION_INFO? params=04 00 00 report_id=10 short device=01 DEV1 type=81 GET_REG reg=F1 VERSION_INFO? params=04 02 01 Send report_id=10 short device=FF RECV type=81 GET_REG reg=F1 VERSION_INFO? params=01 00 00 report_id=10 short device=FF RECV type=81 GET_REG reg=F1 VERSION_INFO? params=01 12 01 Send report_id=10 short device=FF RECV type=81 GET_REG reg=F1 VERSION_INFO? params=02 00 00 report_id=10 short device=FF RECV type=81 GET_REG reg=F1 VERSION_INFO? params=02 00 19 Send report_id=10 short device=FF RECV type=81 GET_REG reg=F1 VERSION_INFO? params=03 00 00 report_id=10 short device=FF RECV type=8F _ERROR_MSG SubID=81 GET_REG reg=F1 VERSION_INFO? err=03 INVALID_ADDRESS Send report_id=10 short device=FF RECV type=81 GET_REG reg=F1 VERSION_INFO? params=04 00 00 report_id=10 short device=FF RECV type=81 GET_REG reg=F1 VERSION_INFO? params=04 02 14 Send report_id=10 short device=FF RECV type=80 SET_REG reg=B2 DEVICE_PAIRING params=02 53 94 report_id=10 short device=FF RECV type=80 SET_REG reg=B2 DEVICE_PAIRING params=00 00 00 report_id=10 short device=FF RECV type=4A NOTIF_RECV_LOCK_CHANGED params=00 00 00 00 Somewhere in the below stream is the battery condition of the M525 mouse (good). It could also be that there is no battery information at all and that SetPoint is faking the information. I have tried brand-new Duracell batteries and the output is still the same. Send report_id=10 short device=01 DEV1 type=00 params=05 00 03 00 Recv report_id=11 long device=01 DEV1 type=00 params=05 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Send report_id=10 short device=01 DEV1 type=02 MOUSE params=05 00 00 00 Recv report_id=11 long device=01 DEV1 type=02 MOUSE params=05 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Send report_id=10 short device=01 DEV1 type=02 MOUSE params=15 00 00 00 Recv report_id=11 long device=01 DEV1 type=02 MOUSE params=15 00 52 51 4D 27 02 00 28 00 40 13 00 00 00 00 00 Send report_id=10 short device=01 DEV1 type=04 SYSTEM_CONTROL params=05 00 00 00 Recv report_id=11 long device=01 DEV1 type=04 SYSTEM_CONTROL params=05 5A 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Send report_id=10 short device=01 DEV1 type=0B params=15 01 00 00 Recv report_id=11 long device=01 DEV1 type=0B params=15 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 The mouse got some messages when SetPoint is closed: Send report_id=10 short device=01 DEV1 type=0B params=15 00 00 00 Recv report_id=11 long device=01 DEV1 type=0B params=15 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Send report_id=10 short device=01 DEV1 type=04 SYSTEM_CONTROL params=05 00 00 00 Recv report_id=11 long device=01 DEV1 type=04 SYSTEM_CONTROL params=05 5A 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Back to alive (very, very red battery for keyboard): Recv report_id=10 short device=02 DEV2 type=41 NOTIF_DEVICE_PAIRED params=04 A1 10 20 Recv report_id=20 unkn device=02 DEV2 type=42 NOTIF_CONNECTION_STATUS params=00 00 00 00 00 00 00 00 00 00 00 00 Send report_id=20 unkn device=02 DEV2 type=0E LEDS params=00 00 00 00 00 00 00 00 00 00 00 00 All registers for K800 (HID++ 1.0): Send report_id=10 short device=02 DEV2 type=81 GET_REG reg=00 ENABLED_NOTIFS params=00 00 00 Recv report_id=10 short device=02 DEV2 type=81 GET_REG reg=00 ENABLED_NOTIFS params=00 00 00 Send report_id=10 short device=02 DEV2 type=81 GET_REG reg=01 KBD_HAND_DETECT? params=00 00 00 Recv report_id=10 short device=02 DEV2 type=81 GET_REG reg=01 KBD_HAND_DETECT? params=00 00 00 Send report_id=10 short device=02 DEV2 type=81 GET_REG reg=07 BATTERY? params=00 00 00 Recv report_id=10 short device=02 DEV2 type=81 GET_REG reg=07 BATTERY? params=03 00 00 Send report_id=10 short device=02 DEV2 type=81 GET_REG reg=09 FN_KEY_SWAP? params=00 00 00 Recv report_id=10 short device=02 DEV2 type=81 GET_REG reg=09 FN_KEY_SWAP? params=00 00 00 Send report_id=10 short device=02 DEV2 type=81 GET_REG reg=17 ILLUMINATION_INFO? params=00 00 00 Recv report_id=10 short device=02 DEV2 type=81 GET_REG reg=17 ILLUMINATION_INFO? params=3C 00 01 Send report_id=10 short device=02 DEV2 type=81 GET_REG reg=51 params=00 00 00 Recv report_id=10 short device=02 DEV2 type=81 GET_REG reg=51 params=00 00 00 Send report_id=10 short device=02 DEV2 type=81 GET_REG reg=54 params=00 00 00 Recv report_id=10 short device=02 DEV2 type=81 GET_REG reg=54 params=FF 00 00 Send report_id=10 short device=02 DEV2 type=81 GET_REG reg=D0 params=00 00 00 Recv report_id=10 short device=02 DEV2 type=81 GET_REG reg=D0 params=00 00 00 Send report_id=10 short device=02 DEV2 type=81 GET_REG reg=F1 VERSION_INFO? params=00 00 00 Recv report_id=10 short device=02 DEV2 type=8F _ERROR_MSG SubID=81 GET_REG reg=F1 VERSION_INFO? err=03 INVALID_ADDRESS Send report_id=10 short device=02 DEV2 type=81 GET_REG reg=F2 params=00 00 00 Recv report_id=10 short device=02 DEV2 type=8F _ERROR_MSG SubID=81 GET_REG reg=F2 err=02 INVALID_SUBID Send report_id=10 short device=02 DEV2 type=81 GET_REG reg=F3 params=00 00 00 Recv report_id=10 short device=02 DEV2 type=81 GET_REG reg=F3 params=00 00 00 Send report_id=10 short device=02 DEV2 type=83 GET_LONG_REG reg=0F params=00 00 00 Recv report_id=11 long device=02 DEV2 type=83 GET_LONG_REG reg=0F params=FF FB 00 00 02 40 02 5C 00 00 00 00 0F F9 00 80 Observations about reading regs: - The M525 HID++ 2.0 device does not reply with anything useful to any register request (GET_REG or GET_LONG_REG with 00 params). - eading an unknown register on K800 keyboard (HID++ 1.0) yields: Recv report_id=10 short device=02 DEV2 type=8F _ERROR_MSG SubID=81 GET_REG reg=FE err=02 INVALID_SUBID Recv report_id=10 short device=02 DEV2 type=8F _ERROR_MSG SubID=83 GET_LONG_REG reg=FE err=02 INVALID_SUBID - On a M525 mouse (HID++ 2.0), this shows SUCCESS instead: Recv report_id=10 short device=01 DEV1 type=8F _ERROR_MSG SubID=81 GET_REG reg=FE err=01 SUCCESS Recv report_id=10 short device=01 DEV1 type=8F _ERROR_MSG SubID=83 GET_LONG_REG reg=FE err=01 SUCCESS