Reverse engineering an optical mouse

I promised to write a post about how this optical mouse and the sensor works. I disassambled the mouse and connected the USBee logical analizyer to the SCLK, SDIO, MOTSWK pins. As I mentioned, it contains a PAW3205DB sensor chip.


The chip uses a half-dupex SPI bus to communicate with the integrated Nordic 2.4 GHz transciever chip. The SPI clock frequency is 166.6 KHz. Further details and timings of the communication can be seen in the datasheet, as well as the schematic for wireless mice.

startup without receiver

First I captured the startup sequence and decoded what happens. There is a configuration process, before the mouse starts to send the motion data.

00 30    read product ID1    default
01 50    read product ID2    default
09 00    read write_protect    enabled
89 A5    write_protect disable?
09 A5    read write_protect    disabled
01 50    read product ID2    default
89 00    enable write_protect
06 04    read configuration    MOTSWK level sensitive, 1000 CPI
86 00    write configuration    set CPI to 400
06 04    read configuration    CPI 1000
86 04    write configuration    CPI 1000
1F 3A    unknown
85 BC    write operation mode    enable sleep1 and sleep2 mode, force enter sleep2, LED shutter enable


86 08    write configuration    power down mode

—550 ms

86 80    write configuration    full chip reset
— 8ms

85 B9    write operation mode    force wake up
86 80    write configuration     full chip reset
86 06   write configuration      CPI 1600
06 06   read cinfiguration    CPI 1600


00 30   read product ID1    default
02 86   read motion status    motion, no Y owerflow no x verflow, 1600 CPI
03 FF   read DeltaX        +127
04 00   read DeltaY        0


00 30
02 86
03 FF                +127
04 FB                +123

00 30
02 86
03 FB                +123
04 FE                +126

There are some strange things for me. I won’t do so much config in my code. Some of them seems to be useless.

One important thing is, when the receiver is not connected to a computer, the startup sequence stops after the power down command.

Motion is queried each 8ms. Which is strange again, because the HID descriptor says, the polling interval is 4ms. It seems to be that this mouse is not a well engineered thing 🙂 The query consists of a Product ID read, which is for checking if the controller and the sensor chip is in synch. (If not, there is a re-sync method on the clock line). The motion status is read after. If there was motion, DATAX and DATAY is read, otherwise not.

The MOTSWK pin is a signal, it stays low while there is valid data in DATAX or DATAY registers. I think I wont need this signal for my application.

That’s it. It seems to be fairly simple for the first glance. Next I’m going to hook up the STM32F4 DISCOVERY board to the optical sensor chip, and figure out an optimal way to communicate with it.


One thought on “Reverse engineering an optical mouse

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s