Logitech Unifying receiver

[endes0] has been hacking with USB HID recently, and a Logitech M185 mouse’s USB receiver has fallen into their hands . Unlike many Logitech mice, this one doesn’t include a Unifying receiver, though it’s capable of pairing to one. Instead, it comes with a pre-paired CU0019 receiver that, it turns out, is based on a fairly obscure TC32 chipset by Telink, the kind we’ve seen in cheap smart wristbands . If you’re dealing with a similarly obscure MCU, how do you even proceed? In this case, GitHub had a good few tools developed by other hackers earlier — a Ghidra integration , and a tool for working with the MCU using a USB-UART and a single resistor. Unfortunately, dumping memory through the MCU’s interface was unreliable and frustrating. So it was time to celebrate when fuzzing the HID endpoints uncovered a memory dump exploit, with the memory dumper code helpfully shared in the blog post. From a memory dump, the exploration truly began — [endes0] uncovers a fair bit of dongle’s inner workings, including a guess on which project it was based on, and even a command putting the dongle into a debug mode where a TC32-compatible debugger puts this dongle fully under your control. 2. maybe you could buy the same chip on digikey/lcsc/aliexpress and replace the chip on the mouse’s PCB? and, well doneeeeee! 2. Been working on/with that chipset one for quite some years now, best example is the Xiaomi Mi Thermometer Custom firmware :) Also, I was unable to make TlsrTools work. And ended up writing my own Pico-based debugger bridge. It’s faster (I think), cross-platform, and doesn’t need the resistor; there’s just a single connection from the Pico to the SWS pin. 1. wait what it looks exactly like my M185, how can you tell? 2. I don’t believe that’s correct. The M235 has side grip panels that are concave and the top panel comes to more of a point at the rear of the mouse, whereas the shiny grey plastic surround on the M185 has a more “constant width” look from the top, as shown in the pic here. 1. I have two Logitech K 235 wireless keyboards that apparently have a unique dongle. The original dongles disappeared. Any thought on how to pair them with another dongle as they won’t pair with the unifying receiver? 2. Never happened for me. Unless it’s a deliberate “tweak” in the Logitech software, the “newer”, non-Unifying M185s were not seen by the Unifying receivers ever, and I tried several times over the years, until I realized there are 2 versions of this mouse. 1. I fucking love how that comment promptly attracted two people who know exactly how different Logitech mice look like Please be kind and respectful to help make the comments section excellent. (Comment Policy ) This site uses Akismet to reduce spam. Learn how your comment data is processed.