Skip to content

FINAL_TECHNICAL_GUIDE.md

Latest commit

 

History

History
165 lines (128 loc) · 5.04 KB

FINAL_TECHNICAL_GUIDE.md

File metadata and controls

165 lines (128 loc) · 5.04 KB

Rokid Max2 - Final Technical Guide

Version: 4.0 - Complete Analysis
Date: 2025-07-13

Executive Summary

Through extensive USB protocol exploration, we've discovered that the Rokid Max2 is fully functional AR glasses with an active 6-axis IMU accessible via USB. The sensor data is transmitted in an extended telemetry format that standard drivers don't recognize.

Hardware Specifications

Confirmed Components

  1. Displays: Built-in micro-OLED (controlled via HDMI/DisplayPort)
  2. IMU: 6-axis (3-axis accelerometer + 3-axis gyroscope)
  3. Firmware: Version 0.17
  4. USB Interface: Full sensor access, no authentication required

Not Found/Confirmed

  1. Magnetometer: No 9-axis IMU data found
  2. Cameras: No USB video endpoints discovered
  3. Quaternion output: Computed by Station 2, not device

USB Protocol Guide

Reading IMU Data

// Step 1: Enable telemetry mode
struct usbdevfs_ctrltransfer ctrl = {0};
uint8_t telemetry[] = {0x00, 0x40, 0xbf, 0x00};
ctrl.bRequestType = 0x41;  // SET command
ctrl.bRequest = 0x01;
ctrl.wValue = 0x0000;
ctrl.wIndex = 0x0000;
ctrl.wLength = 4;
ctrl.data = telemetry;
ctrl.timeout = 500;
ioctl(usb_fd, USBDEVFS_CONTROL, &ctrl);

// Step 2: Read extended telemetry (512 bytes)
uint8_t buffer[512];
ctrl.bRequestType = 0xC1;  // GET command
ctrl.bRequest = 0x01;
ctrl.wLength = 512;  // MUST BE 512, not 64!
ctrl.data = buffer;
ctrl.timeout = 100;
ioctl(usb_fd, USBDEVFS_CONTROL, &ctrl);

// Step 3: Parse IMU data at offset 456
float *imu = (float*)&buffer[456];
float accel_x = imu[0];  // m/s²
float accel_y = imu[1];  // m/s²
float accel_z = imu[2];  // m/s² (gravity ~9.8)
float gyro_x = imu[3];   // °/s
float gyro_y = imu[4];   // °/s
float gyro_z = imu[5];   // °/s

Data Format (512 bytes)

Offset Size Description
0-3 4 Header: 00 40 bf XX
4-39 36 Legacy IMU region (always zero)
40-63 24 Padding
64-127 64 Memory pointers (SRAM addresses)
128-191 64 Reserved
192-255 64 Device info/status
256-319 64 Reserved
320-383 64 Timing/counter data
384-447 64 Unknown data
448-455 8 Reserved
456-479 24 6-axis IMU data (6 floats)
480-491 12 Unknown floats (not magnetometer)
492-511 20 Padding

Working USB Commands

Command Description Response
0x01 Primary telemetry 512-byte extended format
0x02 Secondary telemetry Same format
0x04, 0x05 Telemetry variants Same format
0x10, 0x20 Configuration Accept SET commands
0x81 Firmware version "0.17" (ASCII)
0x03 AVOID Causes USB disconnect!

Implementation Examples

Python (pyusb)

import usb.core
import struct

# Find device
dev = usb.core.find(idVendor=0x04D2, idProduct=0x2002)

# Enable telemetry
dev.ctrl_transfer(0x41, 0x01, 0, 0, b'\x00\x40\xbf\x00')

# Read extended format
data = dev.ctrl_transfer(0xC1, 0x01, 0, 0, 512)

# Parse IMU
imu = struct.unpack('6f', data[456:480])
print(f"Accel: {imu[0]:.2f}, {imu[1]:.2f}, {imu[2]:.2f}")
print(f"Gyro: {imu[3]:.2f}, {imu[4]:.2f}, {imu[5]:.2f}")

Windows (WinUSB/libusb)

Use the same protocol with WinUSB or libusb-win32. No special drivers needed!

Why This Matters

Previous Understanding (Wrong)

  • IMU requires Station 2 activation
  • Sensors locked without authentication
  • Complex initialization needed

Reality (Correct)

  • IMU is always active
  • Data in extended format (bytes 456-479)
  • No authentication required
  • Standard drivers just read wrong location

Station 2's Role

Station 2 provides:

  1. 6DOF tracking: Using external cameras (not in glasses)
  2. Processing power: For AR applications
  3. Extended format knowledge: Reads 512 bytes instead of 64

Limitations

  1. No display control via USB: Use HDMI/DisplayPort DDC/CI
  2. No magnetometer found: Device may only have 6-axis IMU
  3. No camera access: If cameras exist, not via USB
  4. No quaternion output: Must compute from raw gyro data

Applications

With this knowledge, you can:

  1. Create custom drivers for any platform
  2. Build head tracking applications
  3. Develop AR/VR experiences
  4. Use without Station 2 for basic IMU access

Memory Map (SRAM Pointers)

The device exposes internal memory addresses:

  • 0x20000500 - Start of data structures
  • 0x20000544 to 0x20000A20 - Various data regions
  • May contain calibration, config, or hidden features

Conclusion

The Rokid Max2 is a capable AR device with accessible sensors. The "locked" IMU was simply a misunderstanding - the data was always there in an undocumented extended format. This guide provides everything needed to access the IMU without Station 2.

Next Steps for Community

  1. Reverse engineer SRAM regions for hidden features
  2. Check if cameras exist via other interfaces
  3. Create open-source drivers using this guide
  4. Build applications leveraging head tracking

The hardware is ready - we just needed to know where to look!