Corsair K70 RGB USB protocol reverse engineering part 1

Corsair K70 RGB reverse engineering
-----------------------------------

How To:

1. On a Linux machine, set up VirtualBox and install Windows in it.

2. Install Corsair Utility Engine software inside that Windows VM.

3. Install Wireshark on Linux

4.  sudo modprobe usbmon

5.  Attach the Corsair K70 RGB keyboard USB device to the VM

6.  Let CUE detect the keyboard, then set a color profile for the LEDs

7.  Open Wireshark on the host OS as root, select the usbmon interface with the most data activity (as CUE continuously feeds the LED packets to the keyboard)

8.  Monitor for a short period then stop, you will notice that the packets repeat.

Observations:

- LED data appears to consume 5 USB frames

- Corsair Utility Engine continuously spams LED data to keyboard

- First half of USB data is USB protocol header, data from 0x0040 to end is actual LED protocol

- One "start" packet and four "data" packets

"Start" packet
--------------

- Starts with 0x0727000 D8000000 with the rest of the data as 0x00

"Data" packets
--------------

- Ordered 01, 02, 03, 04

- Starts with 0x7FXX3C00 where XX is 01, 02, or 03 depending on packet in sequence, except in the fourth packet, which is 0x7F042400.

- LED data seems to only go up to 7, i.e. 0x00 to 0x77.

- Certain byte positions are fixed as 0 or 7.

Packet 0x01
-----------

Black:

7F 01 3C 00  77 77 77 77  77 77 77 77  77 77 77 77
77 77 77 77  77 77 77 77  77 77 77 77  77 77 77 77
77 77 77 77  77 77 77 77  77 77 77 77  77 77 77 77
77 77 77 77  77 77 77 77  77 77 77 77  77 77 77 77

White:

7F 01 3C 00  00 00 00 00  07 77 00 00  07 70 00 77
00 00 00 00  00 77 00 00  70 00 70 77  00 00 00 00
00 77 00 00  70 00 00 77  00 00 70 00  00 77 00 00
00 00 00 77  00 00 00 00  00 77 00 00  00 07 00 77

Packet 0x02
-----------

Black:

7F 02 3C 00  77 77 77 77  77 77 77 77  07 77 77 77
77 77 77 77  77 77 77 77  77 77 77 77  77 77 77 77
77 77 77 77  77 77 77 77  77 77 77 77  77 77 77 77
77 77 77 77  77 77 77 77  77 77 77 77  77 77 77 77

White:

7F 02 3C 00  00 00 70 00  00 77 00 00  00 07 00 77
00 00 00 00  07 77 00 00  07 70 00 77  00 00 00 00
00 77 00 00  70 00 70 77  00 00 00 00  00 77 00 00
70 00 00 77  00 00 70 00  00 77 00 00  00 00 00 77

Packet 0x03
-----------

Black:

7F 03 3C 00  77 77 77 77  77 77 77 77  77 77 77 77
77 77 77 77  77 77 77 77  07 77 77 77  77 77 77 77
77 77 77 77  77 77 77 77  77 77 77 77  77 77 77 77
77 77 77 77  77 77 77 77  77 77 77 77  77 77 77 77

White:

7F 03 3C 00  00 00 00 00  00 77 00 00  00 07 00 77
00 00 70 00  00 77 00 00  00 07 00 77  00 00 00 00
07 77 00 00  07 70 00 77  00 00 00 00  00 77 00 00
70 00 70 77  00 00 00 00  00 77 00 00  70 00 00 77

Packet 0x04
-----------

Black:

7F 04 24 00  77 77 77 77  77 77 77 77  77 77 77 77
77 77 77 77  77 77 77 77  77 77 77 77  77 77 77 77
77 77 77 77  07 77 77 77  00 00 00 00  00 00 00 00
00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00

White:

7F 04 24 00  00 00 70 00  00 77 00 00  00 00 00 77
00 00 00 00  00 77 00 00  00 07 00 77  00 00 70 00
00 77 00 00  00 07 00 77  00 00 00 00  00 00 00 00
00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00