SetPoint-less MediaPad Driver (ver. 5.92.28 from 04/03/2018)

The class may lack some functions such as autoscroll, but the file could be updated from time to time.

Some times ago I found in a spring flea market an oddity from the year 2003: the Logitech Mediapad from the diNovo series. Mix between the numeric keypad, the multimedia remote and the calculator, working with Bluetooth and granted with a clock, the device allowed offline formulas and some preview of mail and AIM conversations (blast from the past). The last thanks to its 3-lined crystal display.

Immediatly my getbacker spirit saw the potential of the subject, and how it could be used at notifications end, as a secondary display. I acquired it for a mere price and started my quest.

However, things got complex because unlike some devices like the LiveView or the i-Buddy, no .NET library seemed already available to control it. A good excuse to start some reverse engineering!


The numeric keypad connects via Bluetooth (no LTE because 2003) using a PIN. Once connected, it works OOTB for basic features like calc and keypad. To use its advanced features, we need to setup the SetPoint dedicated software (older versions on FileHippo). Pretty heavy (80 mo), it lets you make the Mediapad ring (integrated beeper), set up a welcome message, sync the clock and configure the special keys. Some display functionalities require Windows Media Player 9 and AIM, making it obsolete. Maybe we'll find a way to give it a new life before the end of the present article.

The SetPoint software is made, like its siblings, of some executables and .dll files. ILSpy doesn't check it as managed code (.NET), depends.exe and Nirsoft DLL Export Viewer extracted from them a lot of functions but nothing explicit like blink_mediapad_led() that we could call with PInvoke. XML files contain localized messages for the Mediapad display, but the clues stop here.

The sound test button: a key SetPoint feature

Pillar of Bluetooth reverse engineering and more: the exchanged data sniffing. To proceed, we use the good ole WireShark, using a dongle filtered with WinPCap or LibUSB. There's also the more intuitive USBLyzer software (paid with a month of trial).

We filter data passing through the Bluetooth interface as we trigger the "Sound Test" SetPoint button. In and Out packets are captured and listed, ready to be studied.

Here is a recorded packet, containing the 0XA2 byte, which marks a DATA write transaction for HID devices (keyboards, mouses, gamepad...). Maybe we got the bytes making the Mediapad sing!

0x10, 0x00, 0x80, 0x50, 0x02, 0x00, 0x00

We create a C# console program thanks to SharpDevelop, a lightweight and efficient IDE. We attempt a Bluetooth connection on the device (32Feet), targeting the HID-dedicated Bluetooth Service.

BluetoothAddress ba = new BluetoothAddress(0xXXXXXXXXXXXX);
BluetoothClient client = new BluetoothClient();
client.Connect(ba, BluetoothService.HumanInterfaceDevice);
client.GetStream().Write(new byte[]{ 0x10, 0x00, 0x80, 0x50, 0x02, 0x00, 0x00 });

Sadly, it doesn't work. The service doesn't allow requests. Thus, we go for a standard USB HID connection, by using the HidLibrary.

In order to connect to a device we'll need the VID (Vendor ID) and PID (Product ID)

foreach(HidDevice mediaPadSocket in HidDevices.Enumerate(0x046D, 0xB3E1)){ //VID-PID connection
    mediaPadSocket.Write(new byte[]{ 0x10, 0x00, 0x80, 0x50, 0x02, 0x00, 0x00 }); //beep packet

And here comes the beep!

I can hear the numeric keypad beeping with joy. Success!

Now we got a good base, we can generate a handy little class. Through my numerous researches and attempts I encountered the Bluez-diNovo project, aiming to bring Mediapad support to Linux' Bluez Bluetooth stack. Although in C++, il contains the packets list. Thus, thanks to Tim Hentenaar for that open sourced work wich spared me some additional brainstorming and capture pain.

"When I'm bored, I hack some calcs :)"

One library, infinite possibilities

Now that I can display what I choose on the improved calculator, why not integrating it to MusicPeek?

Previous Post Next Post