The last time Hackerfall tried to access this page, it returned a not found error. A cached version of the page is below, or clickhereto continue anyway

Applying Logic to the Surface Touch Cover

Applying Logic to the Surface Touch Cover

13 August 2015

Thanks to Saleaes generous student discount, I was finally able to purchase a Logic 4 logic analyzer and start probing at the Surface Touch Cover. I hooked it up to my previous breakout board and recorded the signals on the pins at power-on and while pressing various keys.

After some analysis, it turns out my hypothesis about the protocol in my previous post was off the mark. Instead of HID over I2C, the keyboard uses duplex serial communication, and thankfully so, as serial is much easier to analyze and implement than the HID over I2C spec.

The serial configuration used is a bit strange:

I took a capture of the board at power-on and parsed some of the data into a spreadsheet. You can find it here or embedded down below. The cells are color-coded to make some of the patterns more apparent.

Some observations:

Im hoping to boil this information down to the minimum required to communicate with the Surface and replay enough packets to press a key.

Feel free to drop me a line if you discover something interesting or want the original capture data.

Continue reading on edwardsh.in