BLE version is out! More info on Wac0m RipOff BLE edition
I reverse engineered the Wacom I2C EMR pad taken from Lenovo YOGA Book, first started by probing all pads connected to the Wacom board. There're 8 pins total connected to touchscreen flat flex board which is connected to YOGA's mainboard. the main character of this project is W9013 the REALLY SECRET Wacom proprietary chip that ONLY Wacom engineer team and those who signed NDA has access to datasheet (Try search it up, You won't find it ;P). I started by peeling of the copper sheet that protecting the board against EMI, since this technology (Wacom EMR) rely on radio emission similar to RFID and NFC. take a look at the second pic in project gallery. I labeled 6 pins plus the main Vcc/Vdd rail. all the pins labeled with number are corresponding to FPC connector pin order
1. Unknow
2. SCL (No pull-up D:)
3. SDA (No pull-up D:)
4. Unknow
5. IRQ, goes low when w9013 is ready to send data packet
6. Chip Reset Active low, useful for re-establish/initialize I2C comm.
7. 3v3 Vdd
8. GND
(I suspect that the remain pins are used for IRQ on other detection, Because this chip is very similar to one used in Samsung Galaxy Note 8.0 tab, btw my dad own one of these, might try probing later too).
The host seems to used 1MHz I2C, but I confirmed that the w9013 works with 400kHz and 100kHz too (on my F1C100s and STM32).
I first ported the Wacom i2c driver from mainline Linux kernel to STM32 (using STM32CubeIDE). I by using the STM32F3 DISCO board. Plus I can share the I2C bus with onboard sensor ( that have 2 10k Pull-ups). Also the onboard ST-Link provide the 8MHz clock for HSE and Serial ACM for debugging.
the STM32F3 is capable of USB device (USB gadget I would say). And I use the USB HID feature and writing my own HID descriptor. The tool that I use is HID descriptor tool from usb.org (by the way, the latest version is younger that me just ~1 year xD). but the output of the program is in non-friendly-C format, so I literally wrote entire thing in C array.
I then later ported the code to Teensyduino. Running on Teensy ++ 2.0 board. I modified the USB HID description and report to match with the Windows HID report requirement.
I've tested with Windows 7, 10 and 11 also with Linux. And it works perfectly!
Here is the video of this project :
It would be really neat if what you learned here found its way into a hack to digitize a notebook screen.