Emulating Microchip RN4871 as HID Keyboard

-
Steps to emulate RN4871 as a keyboard (HOGP - HID Over GATT Profile)

 Step 1: Open the COM port of the RN4871 on any serial terminal (putty). Baud rate:115200

Step 2: Type '$$$' to enter into Command Mode
Step 3: Type '+' for echo back the command we typed
Step 4: Type 'SF,2' to perform Factory reset
Step 5: Type '$$$' to enter back into Command Mode
Step 6: Type '+' for echoing back the commands we typed
Step 7: Type 'SN,KEYBOARD' to give the BLE device name: KEYBOARD
Step 8: Type 'SDA, 03C1' to set Appearance in GAP Service as Keyboard
Step 9: Type 'PS,180F' . 180F is the Battery Service UUID
Step 10: Type 'PC,2A19,02,01'. we defined battery characteristic of Read property with 1 byte value
Step 11: Type 'PS,180A'. 180A is the UUID of Device Information
Step 12: Type 'PC,2A50,02,07' . 2A50 is the UUID of PnPID
Step 13: Type 'PS,1812'. 1812 is the UUID of HID Information
Step 14:  Type 'PC,2A4B,02,02'. 2A4B UUID of Report Map characteristic contains value specifying formatting and other information of input report, output report and feature report data transferred between a HID Device and HID host.
Step 15: Type 'PC,2A22,12,08'. 2A22 is the UUID of Boot Keyboard Input Report, used to provide HID hosts operating in Boot Protocol Mode with a simplified method of discovering certain HID Service characteristics. Only a single instance of this characteristics exists as part of HID service.
Step 16: Type 'PC,2A32,0E,08'. 2A32 is the UUID of Boot Keyboard output report, used to 
provide HID hosts operating in Boot Protocol Mode with a simplified method of discovering certain HID Service characteristics. Only a single instance of this characteristics exists as part of HID service.
Step 17: Type 'PC,2A4A,02,04'. 2A4A is the UUID of the HID information used to hold the set of values known as HID Device's HID Attributes
Step 18: Type 'PC,2A4C,04,01'. 2A4C is the UUID of the HID Control Point used to defines the following HID Commands


From LS Command you can get the handle, run the following commands:
SHW,(battery handle),20 //battery level is 0x20
SHW,(PnPID),013A5B2A6B8C90 //PnPID, 01(key),3A5B(Vendor ID),2A6B(Product ID),8C90(Product Version)
SHW,(Report Map),2A22 //Report Map, referenced characteristic is Boot keyboard input
SHW,(input report),0000000000000000 //default 0. (Boot Keyboard Input)
SHW,(output report),0000000000000000 //default 0.(Boot keyboard output)
SHW,(HID Infomation),01100003 //bcdHID = 0x0110(v1,10), bCountryCode = 0x00, Flags = 0x03.
SHW,(HID Control Point),01 //Exit suspend


 Reset the device and now open Bluetooth settings page on Android. It will show Keyboard name and now you can pair it, each time you come near to it, pairing will happen automatically

Comments

  1. Unknown30 June 2019 at 00:45

    Hey, you mind sharing how to send "media key events" over to android/ios device? ie. Play/pause etc.

    i got my device to identify the module as input device, but cant get it receive any input

    ReplyDelete
  2. DOS29 May 2023 at 06:15

    Hi, I've been trying to get this module to work as a keyboard emulation for a long time.
    Does the "code" really work, or does the "code" still work with newer firmware?
    Is it not necessary to start an "A" command for advertisement at the end?
    I just don't see a Bluetooth keyboard on the Windows PC and also on the Mac.

    BTW, this is the only place on the internet where I found a keyboard emulation with the RN487x microchip modules.

    ReplyDelete

Post a Comment

Popular posts from this blog

bb.utils.contains yocto

-
Image
bb.utils.contains  is most commonly used function in Yocto. grep in poky directory returned with 696 count. $ grep -nr 'bb.utils.contains' poky/ | wc -l 696 It's definition is present in 'poky/bitbake/lib/bb/utils.py' file This function returns third argument if the second argument is subset of the first argument else returns fourth argument Let's take an example to understand this. You can see from the above screenshot, when the second argument is a subset of first argument, "present" was returned, else "notpresent" was returned We can also use bb.utils.contains inside if loop. This we can use inside a recipe. if ${@bb.utils.contains('SOMEFLAG','NEWVALUE3','true','false',d)}; then     FOO = 'HELLO' fi
Read more

make config vs oldconfig vs defconfig vs menuconfig vs savedefconfig

-
Image
Building the Linux Kernel is a two-step process: Configuring the Kernel options Building the Kernel with those options. There are many methods available for configuring the kernel. make config: Text-based Configuration.  Options are prompted one after another. All options need to be answered Access to former options is not possible make menuconfig: Menu-driven user interface Allows to navigate forwards and backward directly between features Allows to load and save files with filenames different from ".config" Provides search feature It uses ncurses library for GUI. If the ncurses library is not installed, make menuconfig option fails. To install ncurses library on Ubuntu: sudo apt-get install libncurses5-dev make defconfig: Creates a ".config" file with default options from the ARCH supplied defconfig Configurations are generally stored in the directory: arch/$(ARCH)/configs $ ls arch/x86/configs/ i386_defconfi
Read more

PR, PN and PV Variable in Yocto

-
PN : Represents the name of the recipe. The name is usually extracted from the recipe file name. PR:  Represents the revision of the recipe. Default value for this revision is "r0". Subsequent revisions of the recipe conventionally will have "r1", "r2" and so on. PV:  Represents the version of the recipe. Normally extracted from the recipe file name. For example: ffmpeg_3.4.2.bb recipe. ${PN} : ffmpeg ${PV} : 3.4.2
Read more