reMarkable 2 pogo pins reverse engineering

Hardware

The reMarkable 2 tablet has two USB interfaces, one of which is in the form of USB-C at the bottom, while the other is in the form of 5 pins on the bottom left side. The USB interfaces are driven by a MAX77818 capable of USB back power (OTG) for which the back power capable bus is wired to the pogo pins.

The ID pin is capable of talking single wire serial at 115200 baud 8n1.

Structure of a serial frame sent via ID pin

Direction:
- 2E (keyboard to device)
- 3A (device to keyboard)
Length: amount of bytes in the data part + 1
Data: refer to commands
Checksum: inversion of sum of all data bytes + 1

Commands

Data content usually consists of a command and arguments given to it. Possible commands are:

Tablet to keyboard:
- 02!: firmware write and validate
- 04 : enter "app mode"
- 05!: enter suspend
- 06!: firmware write and validate (CRC)
- 07!: firmware write packet
- 08!: firmware write init
- 09 : request auth key from peripheral (sent from device to keyboard, no arguments)
- 0F!: reboot
- 20 : read register (batching possible, arguments are which registers to read)
- 21!: write register
Keyboard to tablet:
- 40 : keep-alive (every 0.5s on no activity, no arguments)
- 51 : keystroke (contains key pressed and key counter)

Known registers

02 : firmware version (2 byte)
04 : device_class (4 byte)
05 : serial number (char array, 4x4 byte)
06 : firmware_start_address (unsigned 4 byte)
07 : device_name (string, 12 byte)
10 : keyboard_layout (unsigned 1 byte)
11 : language (enum, 1 byte)
12 : rm_serial_number (string, 15 bytes)
20!: mfg_log
30!: keep-alive interval

Keyboard connection flow

Tablet notices (pull-down/pull-up?) on pogo pins
Tablet requests register read (cmd 20, arg 07) -> keyboard responds with String "rMkeyboard01"
Tablet requests batched register read (cmd 20, args 02 11 04 06 10 07 05 12) -> keyboard responds with data requested.
Tablet requests an auth code (cmd 09) -> keyboard responds with the key "@O8eO77%o^4*1GE@oeodd#WMa%8Kr6v@" and is zero-terminated.
Tablet goes into "app mode" (cmd 04) -> keyboard acknowledges. This entire negotiation happens within 30ms.

pabloaul/rm2-pogo-com