I am finalizing the reverse-engineering of a linux driver for the Perixx MX-2000 IIB mouse. One of the features the mouse has is arbitrary button mapping. I can assign a button to produce various keys or mouse buttons. I have recorded a few button assignments available in the Windows driver, and figured out a few myself, but there doesn't seem to be a discernible (to me) pattern to map the whole address space.
The keys behave like this: Two bytes control a particular mouse button. I have learned a few keys and modifiers, and will post below. Setting the mouse button to the hex value gives me keyboard output when clicked.
keyboard output | hex value
Volume Up |
Volume Down |
I've mapped through
0x8A00 but will spare you the whole table. The interesting things are that thing like XF86 commands appear pretty early, like in
0x6F00 is XF86AudioMicMute, or
0x6600 is the power off key.
As for the least significant byte, part of that is modifiers, applied as a mask. Ctl is
(1 << 0), shift is
(1 << 1), alt is
(1 << 2) and super/meta/windows is
(1<<3). So this way, shift+a (capital A) is
0x0402. Ctl+Alt+a would be
0x0405. All four modifiers give you
0x0F for the least sig. byte. Playing around with the high nybble of the LSB, say with values like
0x0440 gives me more keys, like XF86Mute. So it seems the address space is massive.
On top of this, there are some keys from the windows driver that presented as an entirely different scheme.
Output | hex value
aMouse Scroll up |
Mouse Scroll down |
WWW Search |
WWW Back |
WWW Forward |
Internet Expl Back |
0x8842 (presents as mouse button 8 in X11)
IE Forward |
0x9042 (mouse button 9)
My Computer |
Volume Up |
Volume Down |
And a few mouse buttons:
output | hex
Left Click |
Right Click |
Wheel Click |
and finally, these are internal mouse commands. They don't register any events on my linux machine, but do change things in the mouse's internal settings
action | hex
Cycle DPI setting |
DPI increase |
DPI decrease |
Cycle mouse profile |
Profile Up |
Profile Down |
And finally there is a special set that looks like
0x0a88 that point internally to macro memory.
I can't find any encoding schemes or keyboard mappings that might match this. Alphabetical keys? And If you notice, volume up is both
0xE920 while vol down is both
0xEA20. So somewhat of a light at the end of the tunnel that there is a consistent distance between those.
But really, I can't figure out a standard mapping this matches. Or any way to figure out all the keys without manually fiddling with the memory and looping through
0xFFFF and clicking with
xev each time.
Thoughts? is any of this familiar? or other patterns spotted?
edit: All key information I've mapped so far is in this gist including
0xFF00 (leaving LSByte
0x00). So there is still a massive address space left. And it still makes no sense to me with the extra keys from the windows driver like
0x9421 = XF86Explorer