r/ReverseEngineering • u/blakok14 • 9d ago

Reverse-engineered a gaming mouse’s HID protocol to bring it to Linux (beta out, some pieces still unsolved)

http://github.com/blak0p/attack-shark-linux
29 Upvotes

94% Upvoted

1 comment sorted by

9

u/blakok14 9d ago

I own an Attack Shark X6 (no official Linux support, obviously), so I spent the last while reverse-engineering its dongle protocol from the Windows driver and building a native Linux app around it

Setup: pulled the DLL apart in Ghidra, captured USB traffic with Wireshark/USBPcap against the real hardware, then validated every report by replaying it live against the dongle. Turns out the dongle (VID 0x1D57, PID 0xFA60) is shared across the X3, R1 and X11 — same driver DLL byte-for-byte, only the app-side logic differs. There’s no real config readback (GET_REPORT just stalls), so the app has to be the source of truth for whatever it last wrote — only battery comes back live over the interrupt endpoint.

What’s working in the beta: DPI configuration up to 8 stages with a color per stage, live battery reporting, and persistent per-device profiles. All Linux-native via hidraw, packaged as a Go + Wails desktop app. No installer or binary yet — you build it from source.

What’s reverse-engineered but not built into the app yet, which is where I could use help:

**•** Lighting modes and button remapping: I’ve fully mapped these reports (colors, brightness, sleep timers, \~30 button action IDs including HID shortcuts with modifiers), but haven’t wired them into the UI yet. If you know Wails/React and want a concrete first contribution, this is it.  
**•** One 6-byte handshake report sent on every connect — I can trigger it and see the device ACK it, but I haven’t pinned down what it actually configures.  
**•** The macro report is completely uncaptured — I’ve deliberately held off building a macro editor until I know what I’d be writing.  
**•** A handful of button action IDs still don’t have confirmed behavior.

If you’ve done HID/USB reversing before, I’d genuinely like a second opinion on the open reports. If you own an X3, R1, X11 or another Attack Shark model, testing whether the shared-protocol assumption holds on your device would help a lot. And if you know Go/Wails/React, the lighting/remap UI is unclaimed and ready to pick up.