Hacking the Areson L103G

The Medion MD 86079.

Several years ago, I bought a Medion laser gaming mouse, the MD 86079, at the local Aldi. I'd been using it quite happily for years, and was always amazed at the comfort and accuracy of it, especially on glossy surfaces. Recently, I recommended it to somebody else, only to find that Medion had stopped selling it and it wasn't available anywhere else, either.

So I started researching, to figure out who actually made these things - after all, Medion barely does any manufacturing themselves. I started out by searching for it on Google, but this failed to bring up any useful results. The next step was to check the manual - but that didn't turn up anything useful either. Then I got an idea - what if I looked for clues in the driver software?

Huh?

Certainly interesting, but not quite what I was looking for...

A hex dump of the relevant portion of the driver software.

Bingo! The manufacturer turned out to be Areson.

Some further searching on the manufacturer name led me to believe that the particular model was the L103G, since the exterior shape matched that of my mouse. However, when I searched for this model number a bit more... I started running across the Mtek Gaming Xtreme L103G and the Bross L103G. And, more interestingly, an earlier version of my mouse from Medion that was branded the "USB Mouse Areson L103G"! Apparently it had been staring me in the face for a while, and I failed to notice it.

Either way, the various other mice with the exact same build piqued my interest, and I started looking for other Areson L103G variants. And oh man, there were many. It started out with the Cyber Snipa mice, but as it turns out, Areson builds OEM mice for a large array of brands. Even the OCZ Dominatrix is actually just an Areson L103G! I've made a list of L103G variants and some other Areson-manufactured mice down this page.

Another thing that I noticed, was that all these L103G variants advertised configurable macro keys and DPI settings, up to sometimes 5000 DPI, while my mouse was advertised as hard-set 1600 DPI with just an auto-fire button, and only came with driver software that let me remap the navigational buttons.

Surely if these mice are all the same model, they would have the same chipset and thus the same capabilities? I also wondered why my DPI switching and autofire (macro) buttons didn't work under Linux - if these mice are programmable, then surely this functionality is handled by the mouse chipset and not by the driver?

It was time to fire up a Windows XP VM.

After some mucking around with VirtualBox to get USB passthrough to work (hey, openSUSE packagers, you should probably document that you've disabled that by default for security reasons!), I installed the original driver software for my Medion mouse. Apparently it's not even really a kernel driver - it seems to just be a piece of userspace software that sends signals to the device.

Sure enough, when I installed the driver, then disabled the USB passthrough, and thereby returned the device to the host (Linux) OS... the DPI switcher and macro button still worked fine, despite there being no driver to talk to anymore.

So, what was going on here?

My initial guess was that the mouse initially acts as a 'dumb' preconfigured USB/2.0 mouse, in order to have acceptable behaviour and DPI on a driver-less system, and that it would only enable the 'advanced features' (macros, DPI switching) if it got a signal from the driver saying that the configuration software was present. Now of course this makes sense for a highly configurable gaming mouse, but as my mouse didn't come with such software I found it a little odd.

So I fired up SnoopyPro, and had a look at the interaction that took place. Compared to a 'regular' 5 euro optical USB mouse - which I always have laying around as a spare - I noticed that two more interactions took place:

USB protocol dump, part 1.

USB protocol dump, part 2.

I haven't gotten around to looking at this in more detail yet (more to come!), but to me, that looks like it registers an extra non-standard configuration interface. Presumably, that interface is used for configuring the DPI and macros, and I suspect that the registration of it triggers enabling the DPI and macro buttons on the device.

USB protocol stuff aside, I wondered - is the hardware in my mouse really the same as that in the other models? And could I (ab)use that fact to configure my mouse beyond its advertised DPI?

The Trust GXT 33 control panel.

As it turns out, yes, I can!

The Trust GXT 33 is another Areson L103G model, advertised as configurable up to 5000 DPI. Its 'driver' software happily lets me configure my mouse up to those 5000 DPI - even though my Medion mouse was only advertised as 1600 DPI! I've changed the configuration (as you can see in the screenshot), and it really does take effect. It even keeps working after detaching it from the USB passthrough and thus returning it to Linux. And it doesn't stop there...

The Trust GXT 33 control panel, macro panel.

I can even configure macros for it. The interface isn't the most pleasant, but it works. And apparently, I now have some 5.7 KB of free storage space! I wonder if you could store arbitrary data in there...

Either way, back to the L103G. There is a quite wide array of variants of it, and I've made a list below for your perusal. Most of these are not sold anymore, but the Trust GXT 33 is - if it's sold near you (or any of the other L103G models are), I'd definitely recommend picking one up :)

A sidenote: some places reported particular mice (such as the Mtek L103G) as having a 1600 DPI sensor that can interpolate up to 3200 DPI with accuracy loss. However, even when cranking up mine to 5000 DPI, I did not notice any loss in quality - it is therefore possible that there are some differences between the sensors in different models.

The model list

Know of a model not listed here, or have a suggestion / correction / other addition? E-mail me!

	Medion MD 86079 Medion X81007 Medion L103G Advertised default DPI 400 / 800 / 1200 / 1600 Advertised maximum configurable DPI N/A, advertised as hard-set resolution. Native sensor resolution unclear. Actual maximum configurable DPI 5000 DPI Advertised macro features Hard-set, macro key enables auto-fire. Actual macro features Freely configurable mouse/keyboard macros, 5888 bytes internal storage space. Sold at... No longer available.
	Bross L103G Advertised default DPI Not listed. Advertised maximum configurable DPI 400 - 3200 DPI Actual maximum configurable DPI Not tested. Send me feedback! Advertised macro features Freely configurable mouse/keyboard macros. Actual macro features Not tested. Send me feedback! Notes Sold primarily in Turkey. Sold at... No longer available.
	Cyber Snipa Stinger Advertised default DPI Not listed. Advertised maximum configurable DPI 400 - 3200 DPI Actual maximum configurable DPI Not tested. Send me feedback! Advertised macro features Freely configurable mouse/keyboard macros, 3 profiles with 6 each. Actual macro features Not tested. Send me feedback! Notes Company (Cyber Snipa) appears to have gone defunct. E-mail bounces, Twitter compromised, most of their site broken. Sold at... No longer available.
	Mtek Gaming Extreme L103G Advertised default DPI 400 / 800 / 1600 / 2000 Advertised maximum configurable DPI 400 - 3200 DPI Actual maximum configurable DPI Not tested. Send me feedback! Advertised macro features Freely configurable mouse/keyboard macros. Actual macro features Not tested. Send me feedback! Notes Sold primarily in Brazil. Sold at... No longer available.
	Trust GXT 33 Advertised default DPI 450 / 900 / 1800 / 3600 Advertised maximum configurable DPI 3600 DPI native Actual maximum configurable DPI Not tested. Send me feedback! Advertised macro features Freely configurable mouse/keyboard macros. Actual macro features Not tested. Send me feedback! Notes Software for this mouse let me configure my Medion mouse to 5000 DPI. Not sure if also possible for the GXT 33 itself, or whether interpolation is involved. Sold at... Physical stores, online Dutch shops (from €35), Amazon (from $61.88).
	MSI StarMouse GS501 Advertised default DPI 400 / 800 / 1600 / 2400 Advertised maximum configurable DPI 1600 DPI native Actual maximum configurable DPI Not tested. Send me feedback! Advertised macro features Freely configurable mouse/keyboard macros. Macro key acts as mode/profile switch button. Two programmable buttons. Actual macro features Not tested. Send me feedback! Notes Slightly different shell design. Sold at... No longer available.
	OCZ Dominatrix Advertised default DPI 400 / 800 / 1600 / 2000 Advertised maximum configurable DPI 3200 DPI, unclear if native or interpolated Actual maximum configurable DPI Not tested. Send me feedback! Advertised macro features Freely configurable mouse/keyboard macros. Actual macro features Not tested. Send me feedback! Notes Slightly different shell; not a single-piece cover, and differently shaped DPI / macro keys. Possibly more customized. Sold at... No longer available.
	Revoltec FightMouse Pro Advertised default DPI 400 / 800 / 1600 / 2000 Advertised maximum configurable DPI 3200 DPI native Actual maximum configurable DPI Not tested. Send me feedback! Advertised macro features Freely configurable mouse/keyboard macros. Actual macro features Not tested. Send me feedback! Notes Same shell layout as the OCZ Dominatrix, but with carbon print. Sold at... No longer manufactured. Azerty (NL, €41,02), Amazon UK (£39.59)

Earlier/simpler models (no macros, etc.)

	Gigabyte GM-M6800 Advertised default DPI 800 / 1600 Advertised maximum configurable DPI Advertised as hard-set. Actual maximum configurable DPI Not tested. Send me feedback! Advertised macro features None. No physical macro button either. Actual macro features Not tested. Send me feedback! Notes This is an optical mouse, not a laser mouse! This appears to be a custom (cheaper) optical build. No LED illumination, no side-scroll, and no weight adjustment. Sold at... Online Dutch shops (from €14,39), Amazon (from $9.99).
	Gigabyte GM-M6880 Advertised default DPI 400 / 800 / 1600 (version 1 only supports 800 / 1600) Advertised maximum configurable DPI Advertised as hard-set. Actual maximum configurable DPI Not tested. Send me feedback! Advertised macro features None. No physical macro button either. Actual macro features Not tested. Send me feedback! Notes The same as the Gigabyte GM-M6800, but with a laser sensor and a differently colored shell. This appears to be a custom (cheaper) build. No LED illumination, no side-scroll, and no weight adjustment. Sold at... Online Dutch shops (from €12,77), Amazon (from $19.67).
	PureTrak Valor Advertised default DPI 800 / 1600 / 2400 / 3500 Advertised maximum configurable DPI 3500 DPI native Actual maximum configurable DPI Not tested. Send me feedback! Advertised macro features None. No physical macro button either. Actual macro features Not tested. Send me feedback! Notes This is an optical mouse, not a laser mouse! Similar shell to the OCZ Dominatrix and Revoltech FightMouse Pro, but without macro key. Has the same weight adjustment system as the standard L103G. Sold at... Online Dutch shops (from €24,90), Amazon (from $19.95).
	Sentey Whirlwind X Advertised default DPI 400 / 800 / 1600 / 3200 Advertised maximum configurable DPI 3200 DPI native Actual maximum configurable DPI Not tested. Send me feedback! Advertised macro features None. No physical macro button either. Actual macro features Not tested. Send me feedback! Notes This is an optical mouse, not a laser mouse! Similar shell to the PureTrak Valor, but no weight adjustment. Also no macro key. Pixart PAW-3305 chipset, rather than the AVAGO ADNS series that is common in this type of mouse. Sold at... Many stores (from $29.99), Amazon (sale $9.99, regular $34.99).
	CANYON CNR-MSG01 Advertised default DPI 400 / 800 / 1600 / 2400 (?) Advertised maximum configurable DPI 3200 DPI (possibly interpolated) Actual maximum configurable DPI Not tested. Send me feedback! Advertised macro features None. No physical macro button either. Actual macro features Not tested. Send me feedback! Notes This is an optical mouse, not a laser mouse! Similar shell to the regular L103G, but without macro key. No weight adjustment, likely no sidescroll either. Sold at... No longer available.