Hardware

Texas Instruments CC2544 based dongle

USB descriptors from RQR24.10 / RQR24.11 and the bootloaders listed below:

Common
  bcdUSB                 : 0x0200
  Device class           : 0x00 (defined per interface)
  Manufacturer           : Logitech
  Serial number          : none (iSerialNumber = 0)
  Configurations         : 1, bus-powered, 98 mA declared

Application
  VID:PID                : 046d:c52b
  Product                : USB Receiver
  bcdDevice              : 0x2410 / 0x2411
  EP0 max packet         : 32 bytes
  Configuration          : 84 bytes, 3 interfaces, remote wakeup
  Interface 0            : HID boot keyboard (03/01/01), interrupt IN 0x81,  8 bytes, 8 ms
  Interface 1            : HID boot mouse    (03/01/02), interrupt IN 0x82,  8 bytes, 2 ms
  Interface 2            : HID++ / DJ        (03/00/00), interrupt IN 0x83, 32 bytes, 2 ms
  HID report descriptors : 59 / 148 / 98 bytes (interfaces 0 / 1 / 2)

Bootloader (BOT03.01 / BOT03.02)
  VID:PID                : 046d:aaac
  Product                : USB BootLoader
  bcdDevice              : 0x0301 / 0x0302
  EP0 max packet         : 32 bytes
  Configuration          : 34 bytes, 1 interface, no remote wakeup
  Interface 0            : HID               (03/00/00), interrupt IN 0x81, 32 bytes, 1 ms
  HID report descriptor  : 25 bytes

Firmwares

Downloads

Bootloaders

Remarks

  • RQR24.07 & RQR24.11 are compatible with bootloaders >= 02B0009 (signature needed).
  • RQR24.03, RQR24.05, RQR24.06 & RQR24.10 are compatible with bootloaders <= 01B0008.
  • RQR24.06 / RQR24.07 and RQR24.10 / RQR24.11 are paired releases for the two bootloader layouts; the signed application area is 0x0800 bytes smaller.
  • Each pair has 44 changed bytes in the common application range, excluding the trailer: four version bytes and forty bytes relocating the NVM pages by -0x0800 (including XDATA aliases and erase-page numbers).
  • Application binaries start at 0x0400; the address suffix identifies file offset zero. They include the application area and CRC, without receiver pairing data.
  • The .07 / .11 binaries have their final four marker bytes set to ff ff ff ff, as required by the signature. They can be sent to the bootloader and verified directly with OpenSSL (see Notes).
  • bootloader 01B0008 comes from the official .03 / .05 / .06 HEX files. Its upper segment stops at 0x7fef; the missing sixteen flash-protection bytes have not been filled.
  • bootloader 02B0009 was recovered from the receiver running RQR24.11_B0036. Two reads matched, and its application matched the official update. The signed .07 / .11 updates do not include this bootloader.
  • Bootloader segments retain their original bytes and version fields.

Digests

SHA2-256(RQR24.03_B0027_0x0400.bin)               = ac55870c927962e6eea2a830a48d757f187ef5d0f80e8931ffb90a7ef968705b
SHA2-256(RQR24.05_B0029_0x0400.bin)               = a7558316c0c14b845b2adceeda41145084884d4140b618594afad0ad63bfa53e
SHA2-256(RQR24.06_B0030_0x0400.bin)               = 983b2630a174730ca5628b631f993afa2dae7aeb472f38659b8eb77f0a91769b
SHA2-256(RQR24.07_B0030_0x0400.bin)               = 3baad7a9c5bf5f2b9390e2144916aafbcb436c14ce2cec47391aaf3baa44586f
SHA2-256(RQR24.07_B0030_sign.bin)                 = e0540d4600f250e0c0c753d729ad6dc34db3e7f76073b7d1dc6a86ff03fe0b20
SHA2-256(RQR24.07_B0030_sign.rev.bin)             = 844e17338313280b368ca20f4f702adc568b73bd26ad9ba2dbc0111ef28df1c9
SHA2-256(RQR24.10_B0036_0x0400.bin)               = 08370d0147544865218845f791bfdd38213ee3936721f76e511f9ecad85d114b
SHA2-256(RQR24.11_B0036_0x0400.bin)               = 4e75f873551f3f5f9f2164ade2daf98638e372f775cb4848ed736e8b86b3b939
SHA2-256(RQR24.11_B0036_sign.bin)                 = bdf476396827b1f671388bff6da34a9cad423dbdaed719084535dbe474938d48
SHA2-256(RQR24.11_B0036_sign.rev.bin)             = 5cd6710674ee115855697f3153e97de633c0545070d15dc2f64e3722721cb8f9
SHA2-256(RQR24_bootloader_01B0008_0x0000.bin)     = bc97cab123c7d44c4a883935d818d46e134b9e8caf70b43b14c1f9be2a25df43
SHA2-256(RQR24_bootloader_01B0008_0x7400.bin)     = b9741cf7f6387e8ea3cfba37404ff891b2a1d1789dab0fd593fe540c8a972671
SHA2-256(RQR24_bootloader_02B0009_0x0000.bin)     = ef47d8abf608840824a6ea427dd3b94254aa72351382bad7749be46c0e8e2d44
SHA2-256(RQR24_bootloader_02B0009_0x6c00.bin)     = 8ebb707679cb96f746b263fac9cdd1ffc26e90769c9737b15536355706cb0318

Useful commands

To extract the application and bootloader segments from an Intel HEX file:

> srec_cat -o RQR24.06_B0030_0x0400.bin -binary RQR24.06_B0030.hex -intel -crop 0x0400 0x6c00 -offset -0x0400
> srec_cat -o RQR24_bootloader_01B0008_0x0000.bin -binary RQR24.06_B0030.hex -intel -crop 0x0000 0x0400
> srec_cat -o RQR24_bootloader_01B0008_0x7400.bin -binary RQR24.06_B0030.hex -intel -crop 0x7400 0x7ff0 -offset -0x7400

For .shex files, separate type 0x00 application records from type 0xfd signature records before conversion. Signature addresses are not program-memory addresses.

Check CRC

The application stores a CRC-16/CCITT-FALSE (poly = 0x1021, init = 0xffff) in little-endian order, followed by the four-byte validation marker. The calculation starts at 0x0400 and excludes these final six bytes. The CRC is at 0x6bfa-0x6bfb, or 0x63fa-0x63fb for the smaller RQR24.07 / RQR24.11 images.

The signed releases retain this CRC; its two bytes are included in the RSA/SHA-256 verification. Recalculated values match the stored bytes in all six application downloads:

Firmware CRC16 Stored bytes
RQR24.03_B0027 f8c4 c4 f8
RQR24.05_B0029 10a8 a8 10
RQR24.06_B0030 d39a 9a d3
RQR24.07_B0030 9ad7 d7 9a
RQR24.10_B0036 52c2 c2 52
RQR24.11_B0036 1d49 49 1d

Check signature

> openssl pkeyutl -verify -inkey logitech_c-u0007_pubkey.der -pubin -rawin -digest sha256 -sigfile RQR24.11_B0036_sign.rev.bin -in RQR24.11_B0036_0x0400.bin
Signature Verified Successfully

or if firmware hash is wanted:

> openssl pkeyutl -verifyrecover -inkey logitech_c-u0007_pubkey.der -pubin -in RQR24.11_B0036_sign.rev.bin | openssl asn1parse -inform DER -i
    0:d=0  hl=2 l=  49 cons: SEQUENCE
    2:d=1  hl=2 l=  13 cons:  SEQUENCE
    4:d=2  hl=2 l=   9 prim:   OBJECT            :sha256
   15:d=2  hl=2 l=   0 prim:   NULL
   17:d=1  hl=2 l=  32 prim:  OCTET STRING      [HEX DUMP]:4E75F873551F3F5F9F2164ADE2DAF98638E372F775CB4848ED736E8B86B3B939

> openssl dgst -sha256 RQR24.11_B0036_0x0400.bin
SHA2-256(RQR24.11_B0036_0x0400.bin)= 4e75f873551f3f5f9f2164ade2daf98638e372f775cb4848ed736e8b86b3b939

Notes

BOT03.01_B0008
  Firmware memory        : 0x0400 (0x6800)
  NVM page 0             : 0x6c00 (0x0400)
  NVM page 1             : 0x7000 (0x0400)
  Bootloader low segment : 0x0000 (0x0400)
  Bootloader upper dump  : 0x7400 (0x0bf0)
  Flash-protection bytes : 0x7ff0-0x7fff (not supplied)
  Update protection      : CRC-16/CCITT-FALSE
    poly = 0x1021
    init = 0xffff
    Covered addresses    : 0x0400-0x6bf9
    CRC16 address        : 0x6bfa-0x6bfb (little-endian)
    Validation marker    : 0x6bfc-0x6bff (fe c0 ad de)

BOT03.02_B0009
  Firmware memory        : 0x0400 (0x6000)
  NVM page 0             : 0x6400 (0x0400)
  NVM page 1             : 0x6800 (0x0400)
  Bootloader low segment : 0x0000 (0x0400)
  Bootloader upper area  : 0x6c00 (0x1400)
  Flash-protection bytes : 0x7ff0-0x7fff (included)
  Update protection      : PKCS#1 v1.5 - RSA 2048/SHA256
    Covered addresses    : 0x0400-0x63ff
    CRC16 address        : 0x63fa-0x63fb (little-endian, included in SHA-256)
    Validation marker    : 0x63fc-0x63ff (ff ff ff ff during verification)
    N(le) = 0xde8ec27ec39e5f183515261c462beddf9111d7e5455cb984c04c9ee876d61f49
              6eeaea0f2dd1a45591b8d68174f4c5c1cc5e83a0934c870cc7cad0cd2ecce73d
              57235b7563fdf5b9295a46d41d94f9205c63ad33a6bc5842e6709ea78e00c198
              9e219bf03df76941f9a63d66959812e9ceca3400535e4dc1441d182e4fbb2662
              1ec44aa3be55295337c34ec0395fcdb2692716fc60225e77f5559dba66f750e0
              c90ffec5ad8f096d3a9553cebdd8f0b9be86f8479c0475133e38eb6a0df162c8
              2e89ed83d43ae02a88c05ddbbb63f2d738777466d81d226a36158d4eb72a1591
              d921c91084b6484e512130b02c36bae22f8b3a92d3c722e81dbb404ead56ff69
    e = 0x17 (23)

Both layouts use two alternating 1 KiB NVM pages.

The RSA public key is the same as the Nordic C-U0007. Signature bytes are stored little-endian in the .shex type 0xfd records; use the _sign.rev.bin files with OpenSSL.

When programming the last 128-byte application block at 0x6380, bootloader 02B0009 forces the four marker bytes to 0xff (code at 0x6ea1-0x6ebe). It writes fe c0 ad de at 0x63fc after successful verification (code at 0x6f48-0x6f55).

The downloaded .07 / .11 binaries already contain these four ff bytes, preserving the size and CRC. They produce the same staged application in the bootloader and match the signatures directly:

RQR24.11_B0036, final six bytes
  Official update        : 49 1d fe c0 ad de
  Download               : 49 1d ff ff ff ff
                           CRC   marker

Receiver used here: RQR24.11_B0036 / bootloader 02B0009.

The .10 / .11 release notes list the CVE-2019-13055 fix and restrictions on keystrokes emitted by pointing devices.

Downloads

Channels

Frequency is: 2400 MHz + channel

Firmware channel table

Literal table at code address 0x0bfe in RQR24.11_B0036.

 5,  8, 11, 14, 17, 20, 23, 26, 29, 32, 35, 38, 41, 44, 47, 50, 53, 56, 59, 62, 65, 68, 71, 74

Devices under test

Same device subset as in the Nordic tests.

 5,  8,     14, 17,                 32, 35,     41, 44,                     62, 65,     71, 74

Pairwise hop table

Observed device hopping from the Nordic tests; not extracted from the TI firmware.

 5   <==>   14                  29   <==>   38                          59   <==>   68
     8   <==>   17                  32   <==>   41      47   <==>   56      62   <==>   71
        11   <==>   20                  35   <==>   44                          65   <==>   74

                                                41   <===   50
                                                    44   <===   53

For that device subset, minor interference hops are:

 5   <==>   14                      32   <==>   41                          62   <==>   71
     8   <==>   17                      35   <==>   44                          65   <==>   74

Scan sequence

Scanner sequence for that device subset; not a literal sequence found in the TI binary.

 5 -> 32 -> 62 ->  8 -> 35 -> 65 -> 14 -> 41 -> 71 -> 17 -> 44 -> 74 (->  5 -> ...)

References