This is a collection of tools for reading, patching and flashing the Novatouch TKL firmware.
See also vekkt0r.github.io for some more info about Novatouch keyboard reversing.
This is just a quick hack that has only been tested by me. It is very dependent on a specific version of the firmware and if your keyboard has another firmware things will most probably break. The checksum of the original firmware will be checked before patching. If checksum differs the patching will abort.
It is possible you will brick your keyboard by using these tools.
Make sure you store a copy of your original firmware safely.
- Python2
- MSP430 toolchain
- mspdebug OR python-msp430-tools (depending on flash method)
The keyboard can be programmed in two ways:
- Use JTAG or Spy-Bi-Wire (SBW) programming interface and a MSP430 programmer (for example Launchpad).
- Use built-in bootstrap loader (BSL) to flash via USB.
This is the most secure way of programming the keyboard since it should always (if CM has not changed JTAG fuses lately) be possible to read out the original firwmware and verify it’s the version the patches work against.
Connect MSP430 programmer with Spy-Bi-Wire to the GNS, TEST, RST on the Novatouch programming connector (CN2):
+--------------------+ |CN2 | ++-+-+-+-+-+-+-+-+-+-+ 10 | | | | | | | | | | 1 + | | + | + + + + + | | | | | +-----+ RST | +---------+ TEST +-----------+ GND
Not sure what the name is of the connector type on the keyboard, I just soldered wires to the pins on the backside of the connector.
The MSP430F5510 has a built in bootstrap loader that can be used to flash via USB. To enter the bootloader the PUR pin of the MSP must be connected to VBUS during power up.
With stable hands it should be possible to do this without any soldering.
- Disconnect keyboard from computer.
- Connect wire between pin 1 on CN1 and PUR pin on MSP (see this image for exact locations).
- Connect keyboard to computer.
- Disconnect wire between PUR and VBUS.
- New USB device with VID 0x2047 / PID 0x0200 should show up on computer, named “Texas Instruments MSP430 USB HID Bootstrap Loader”.
To flash with a programmer connect keyboard (as per instructions above) and then run:
$ make flash
To flash with USB BSL first make sure the keyboard is in BSL mode (as per instructions above) and then run:
make -f Makefile.bsl flash
This will fetch the original firmware (main flash only), do some patching, and then flash the patched firmware back to the Novatouch.
The patches done by default are:
- Replace caps-lock with ctrl
- Switch place of the ‘backspace’ and \ keys
- Add hook function for entering BSL (bootloader) mode with fn + F1 + F4
Edit the patch.py file to do other key mappings, hopefully it’s understandable with the overly commented code.
This a table representation of the actual key matrix. The row is the
lowest 3 bits of key id and the column is the 4 bits above that
(id = xCCCCRRR). I.e. key_id = R + (C<<3), where R is the 0 indexed row
from the table below and C is the 0 indexed column. For example tab =
5 + (2<<3) = 21.
First row contains row id:s and first column is column id:s, rest of the table is the keys..
| 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 0 | 2 | 1 | tilde | 3 | f1 | 4 | 6 | 5 | 9 | 8 | 7 | 0 | ins | - | bkspc | = |
| 1 | alt_l | super_l | ctrl_l | esc | spc | alt_r | left | super_r | ctrl_r | fn | ||||||
| 2 | f5 | f8 | f7 | f6 | f9 | printscr | f10 | f12 | f11 | |||||||
| 3 | z | shift_l | x | f4 | c | b | v | , | m | n | . | / | right | shift_r | ||
| 4 | s | a | caps | d | f2 | f | h | g | l | k | j | ; | ’ | ret | ||
| 5 | w | q | tab | e | f3 | r | y | t | o | i | u | p | del | [ | \ | ] |
| 6 | up | pause | pgup | |||||||||||||
| 7 | home | down | scroll | end |