One-Handed Keyboard (through reverse engineering!)

I’ve been using an ergonomic keyboard for a few years now. Specifically, one of several models of the Matias Ergo Pro. I say “one of several” because a few of these have broken on me. Luckily, Matias support has been easy to work with and have sent me replacements and given me discounts. While my most recent keyboard has had no issues, I am left with a pile of old keyboard hardware. Most of the issues were with USB in the right half of the board, so the left halves of the are presumably fine. Let’s make something out of them!

The keyboard halves are connected though a 3.5mm TRRS jack. I reached out to Matias to ask what protocol they used, but was told the left half of the boards didn’t contain any active circuitry and simply “expanded the key matrix.” Multiplexing all of those keys on only 4 connections is impossible so I was a bit suspicious. Lo and behold: when I cracked open the enclosure I found a microcontroller. Oh well. Can’t expect them to give me design secrets just like that.

Testing setup using a cheap logic analyzer. During testing, I plugged the halves into each other

The MCU in question is a SN8F26E65 by SONIX. Looking at the datasheet I found the following pinout:

Pins 1, 28, 27, and 26 are all routed out through the 3.5mm jack

According to the pinout, the halves could be using I2C or UART (pins 27/28). I thought I2C was more likely for chips communicating inside a singular product. I hooked up my logic analyzer and got the following:

No data on D1 (presumed to be SCLK) up until +3s – That’s when I started mashing CAPSLOCK

Almost entirely gibberish – not very encouraging. And hey look – no clock! That’s weird. I only get pulses on that line when I press CAPSLOCK. Could these actually be RX and TX lines?

Using a virtual keyboard to toggle CAPS confirmed my suspicion

It’s a UART, with data only sent back to RX when the left keyboard half has to turn the CAPS light on. I futzed around until I determined the baud rate and encoding. Here’s what I came up with:

keypressrelease
`07C7
108C8
210D0
39858
400C0
51FDF
q01C1
w8949
e9151
r19D9
t1ADA
a8343
s0BCB
d13D3
f9B5B
g1CDC
z8545
x0DCD
c15D5
v9D5D
b9E5E
esc04C4
undo8444
cut8848
copy03C3
paste8242
fn05C5
tab02C2
caps8A4A
shift0ACA
ctrl17D7
win14D4
alt8646
space0ECE
F18F4F
F29757
F39252
F49454

The pattern relating press to release is RELEASE = PRESS XOR C0. I plan to use this information to make a module that I can connect the keyboard half to (without modifying the original hardware). Then I can potentially make another useful keyboard! Stay tuned for updates.