Hardware

Nordic NRF24LU1+ based dongle

USB descriptors from RQR12.10 / RQR12.11 and the bootloaders listed below:

Common
  bcdUSB                 : 0x0200
  Device class           : 0x00 (defined per interface)
  Manufacturer           : Logitech
  Serial number          : none (iSerialNumber = 0)
  Configurations         : 1, bus-powered, 98 mA declared

Application
  VID:PID                : 046d:c52b
  Product                : USB Receiver
  bcdDevice              : 0x1210 / 0x1211
  EP0 max packet         : 8 bytes
  Configuration          : 84 bytes, 3 interfaces, remote wakeup
  Interface 0            : HID boot keyboard (03/01/01), interrupt IN 0x81,  8 bytes, 8 ms
  Interface 1            : HID boot mouse    (03/01/02), interrupt IN 0x82,  8 bytes, 2 ms
  Interface 2            : HID++ / DJ        (03/00/00), interrupt IN 0x83, 32 bytes, 2 ms
  HID report descriptors : 59 / 148 / 93 bytes (interfaces 0 / 1 / 2)

Bootloader (BOT01.02 / BOT01.04)
  VID:PID                : 046d:aaaa
  Product                : USB BootLoader
  bcdDevice              : 0x0102 / 0x0104
  EP0 max packet         : 32 bytes
  Configuration          : 34 bytes, 1 interface, no remote wakeup
  Interface 0            : HID               (03/00/00), interrupt IN 0x81, 32 bytes, 1 ms
  HID report descriptor  : 25 bytes

Interface triplets are class / subclass / protocol. Endpoint sizes are maximum packet sizes; intervals are bInterval values in milliseconds. The application VID/PID is shared by Nordic and TI receivers; bcdDevice identifies the firmware family.

Firmwares

Downloads

Bootloaders

Remarks

  • RQR12.09 & RQR12.11 are compatible with bootloaders >= 04B0016 (signature needed)
  • RQR12.05, RQR12.07, RQR12.08 & RQR12.10 (/patched) are compatible with bootloaders <= 02B0015 ;
  • RQR12.09 & RQR12.11 are the same as RQR12.08 & RQR12.10, but the first ones were made to be compatible with 04B0016 bootloader size ;
  • bootloader 04B0016 (and > ?) need a valid signature to be pushed in RAM before writing the last (first) byte ;
  • provided bootloaders are now generic (reference firmware version removed from them) ;
  • usually you cannot upload a new bootloader on an official Logitech dongle without SPI access + full erase (see Infopage - Configuration): there are here to experiment.
  • “source” code of the patch integrated in RQR12.10_B0032_patched.bin is available in RQR12.10_B0032_read_mem.asm

Digests

SHA2-256(RQR12.05_B0028.bin)                 = 8fd0cbd7932541805a943a5b72536564dac5ecfa58302d7b760617bbad5e9f6a
SHA2-256(RQR12.07_B0029.bin)                 = 16f699ed0373acedefd9ee9cd0b0f26afa94a78028cbb90d3cc5ff6f5a9a228e
SHA2-256(RQR12.08_B0030.bin)                 = 8ffee0cafc7a6ebf5d058d0d8a11498621c7cdef7a0c5ebf148bc190646407ea
SHA2-256(RQR12.09_B0030.bin)                 = 43b44ec1f6959cf5974329000847dcd5cc510c11ad62af4f2d048f0f74f7559f
SHA2-256(RQR12.10_B0032.bin)                 = aeda60a060898692cf41a11577461f80a78ed993545ad4ef744e2f7a6cd9d5ae
SHA2-256(RQR12.10_B0032_patched.bin)         = 400564d1e02c9c89fa827dfc3a002fd7eafffd8908a8e14b3626304e63e08ae2
SHA2-256(RQR12.11_B0032.bin)                 = e7db69331e8a09165b377889de561f12f309976d36c86caf11ad68cbc9f87f8f
SHA2-256(RQR12_bootloader_02B0014_0x7400.bin)= c08de6a8e0364b2234e73400f3ce58d6132ea11eee972b13310333670707b635
SHA2-256(RQR12_bootloader_02B0015_0x7400.bin)= c7bc2c7e293034547e11dda1e8e6a05572b07455304194ad1cd7076bc8c82489
SHA2-256(RQR12_bootloader_04B0016_0x6c00.bin)= 06d0ad91d48f3e1e6f06ab832f2f12098e9c27f5e565b86370550bf5c5f0faf3
SHA2-256(RQR21.00_B0007.bin)                 = 54cb6e853f27464c2c52b3a65c82d4f094a046c8dcb09b559b24ba1f22450cb0

Useful commands

To transform a valid Intel HEX file into padded (0xff) binary:

> srec_cat -o myfirmware.bin -binary myfirmware.hex -intel -fill 0xff 0x0 -maximum-address "(" myfirmware.hex -intel ")"

Check CRC

The application stores a CRC-16/CCITT-FALSE (poly = 0x1021, init = 0xffff) in its final two bytes, in big-endian order. The calculation covers the preceding bytes, starting at 0x0000. The CRC is at 0x67fe-0x67ff in the 0x6800-byte images, or 0x63fe-0x63ff in the smaller RQR12.09 / RQR12.11 images.

The signed releases retain this CRC; its two bytes are included in the RSA/SHA-256 verification. Recalculated values match the stored bytes in all eight application downloads:

Firmware CRC16 Stored bytes
RQR12.05_B0028 8114 81 14
RQR12.07_B0029 64fb 64 fb
RQR12.08_B0030 10a1 10 a1
RQR12.09_B0030 ff42 ff 42
RQR12.10_B0032 4e06 4e 06
RQR12.10_B0032_patched ba76 ba 76
RQR12.11_B0032 0f96 0f 96
RQR21.00_B0007 fabe fa be

Check signature

> openssl pkeyutl -verify -inkey logitech_c-u0007_pubkey.der -pubin -rawin -sigfile RQR12.11_B0032_sign.rev.bin -in RQR12.11_B0032.bin
Signature Verified Successfully

or if firmware hash is wanted:

> openssl pkeyutl -verifyrecover -inkey logitech_c-u0007_pubkey.der -pubin -in RQR12.11_B0032_sign.rev.bin | openssl asn1parse -inform DER -i
    0:d=0  hl=2 l=  49 cons: SEQUENCE
    2:d=1  hl=2 l=  13 cons:  SEQUENCE
    4:d=2  hl=2 l=   9 prim:   OBJECT            :sha256
   15:d=2  hl=2 l=   0 prim:   NULL
   17:d=1  hl=2 l=  32 prim:  OCTET STRING      [HEX DUMP]:E7DB69331E8A09165B377889DE561F12F309976D36C86CAF11AD68CBC9F87F8F

> openssl dgst -sha256 RQR12.11_B0032.bin
SHA2-256(RQR12.11_B0032.bin)= e7db69331e8a09165b377889de561f12f309976d36c86caf11ad68cbc9f87f8f

Notes

BOT01.02_B0015 / BOT01.02_B0014 (!)
  Firmware memory        : 0x0000 (0x6800)
  NVM device data        : 0x6c00 ( 0x400)
  NVM key data           : 0x7000 ( 0x400)
  Bootloader memory      : 0x7400
  Update protection      : CRC-16/CCITT-FALSE (on Firmware memory)
    poly = 0x1021
    init = 0xffff
    CRC16 address : 0x67fe-0x67ff
  InfoPage               : 5a5affffffffffffffffffCHIPIDCHIP
                           ffffffffffffffffffffffffffffffff
                           3a00ff00ff...
    Configuration - 3a00ff00ff:
      Areas:
        Unprotected: 0x0000 (0x7400) - NUPP=0x3a
        Protected  : 0x7400 ( 0x800) - NUPP=0x3a & DAEN=1
        Data       : 0x7c00 ( 0x400) - DAEN=1
      SPI read:
        mainblock  : no - RDISMB=1
        infopage   : yes - RDISIP=0
      Boot         : 0x7400 (protected) STP=1 (odd 1's at the last memory line (f1 ff ...)
      Debug        : no - DBG=0

BOT01.04_B0016
  Firmware memory        : 0x0000 (0x6400)
  NVM device data        : 0x6400 ( 0x400)
  NVM key data           : 0x6800 ( 0x400)
  Bootloader memory      : 0x6c00
  Update protection      : PKCS#1 v1.5 - RSA 2048/SHA256 (on Firmware memory)
    N(le) = 0xde8ec27ec39e5f183515261c462beddf9111d7e5455cb984c04c9ee876d61f49
              6eeaea0f2dd1a45591b8d68174f4c5c1cc5e83a0934c870cc7cad0cd2ecce73d
              57235b7563fdf5b9295a46d41d94f9205c63ad33a6bc5842e6709ea78e00c198
              9e219bf03df76941f9a63d66959812e9ceca3400535e4dc1441d182e4fbb2662
              1ec44aa3be55295337c34ec0395fcdb2692716fc60225e77f5559dba66f750e0
              c90ffec5ad8f096d3a9553cebdd8f0b9be86f8479c0475133e38eb6a0df162c8
              2e89ed83d43ae02a88c05ddbbb63f2d738777466d81d226a36158d4eb72a1591
              d921c91084b6484e512130b02c36bae22f8b3a92d3c722e81dbb404ead56ff69
    e = 0x17 (23)
  InfoPage               : 5a5affffffffffffffffffCHIPIDCHIP
                           ffffffffffffffffffffffffffffffff
                           3600ff00ff...
    Configuration - 3600ff00ff:
      Areas:
        Unprotected: 0x0000 (0x6c00) - NUPP=0x36
        Protected  : 0x6c00 (0x1000) - NUPP=0x36 & DAEN=1
        Data       : 0x7c00 ( 0x400) - DAEN=1
      SPI read:
        mainblock  : no - RDISMB=1
        infopage   : yes - RDISIP=0
      Boot         : 0x6c00 (protected) STP=1 (odd 1's at the last memory line (f1 ff ...)
      Debug        : no - DBG=0

For RQR12.10 / RQR12.11, device data and key data occupy separate 1 KiB NVM areas:

NVM                     RQR12.10          RQR12.11
  Device data           0x6c00-0x6fff     0x6400-0x67ff
  Key data              0x7000-0x73ff     0x6800-0x6bff

Device records
  Alignment              : 0x10 bytes
  Record tag             : first byte

Key slots
  Device slots           : 6
  Slot stride            : 0x20 bytes
  Slot tag               : first byte
  Key data               : 16 bytes at slot offset 0x01

The 16-byte key data contains the RF address prefix, device and receiver WPIDs, and key material; it is not the derived AES key.

Downloads

Channels

Frequency is: 2400 MHz + channel

Firmware channel table

in firmware: channel 5 is at index 1, index 0 is adjusted to index 1

 5,  8, 11, 14, 17, 20, 23, 26, 29, 32, 35, 38, 41, 44, 47, 50, 53, 56, 59, 62, 65, 68, 71, 74

Devices under test

 5,  8,     14, 17,                 32, 35,     41, 44,                     62, 65,     71, 74

Pairwise hop table

experimentally verified, minor interference

 5   <==>   14                  29   <==>   38                          59   <==>   68
     8   <==>   17                  32   <==>   41      47   <==>   56      62   <==>   71
        11   <==>   20                  35   <==>   44                          65   <==>   74

                                                41   <===   50
                                                    44   <===   53

With devices I used, it limits minor interference hops to:

 5   <==>   14                      32   <==>   41                          62   <==>   71
     8   <==>   17                      35   <==>   44                          65   <==>   74

Scan sequence

 5 -> 32 -> 62 ->  8 -> 35 -> 65 -> 14 -> 41 -> 71 -> 17 -> 44 -> 74 (->  5 -> ...)

References