Fun with Logitech MX900 Bluetooth receivers

For some time now, I have been partial to cordless mice; they’re much less of a hastle to use than “conventional” mice, especially if you use a laptop primarily.  Several months ago, I decided to upgrade from a Logitech MX700 cordless optical mouse to an MX900 Bluetooth optical mouse, so that with my new Bluetooth-enabled laptop, I would not need to bring the bulky charger/base station it to plug into my computer at work every day.

As it would happen, the MX900 base station has a Bluetooth receiver that you can use (in conjunction with the WIDCOMM – now Broadcom – Bluetooth stack) to connect to other Bluetooth devices out there.  At the time when I first got the mouse, I didn’t really see this as all that useful, as my laptop already had an integrated Bluetooth receiver that was supposed by the Microsoft Bluetooth stack included with Windows XP SP2.  Recently, however, I got a second Bluetooth enabled device – a new cell phone – and decided that I might as well see what I could do with getting one of my other computers at my apartment talking to it.

 Now, a bit of background about the MX900 base station.  It’s actually a pretty neat thing – during boot (and even in normal operating system use, if you don’t have the right software installed), the MX900 will act as if it were a standard HID USB mouse even though it is actually connected through Bluetooth – “HID emulation mode”, as I call it.  This is a cool feature because it allows you to use your standard USB mouse drivers with the MX900 without having to go install all of Logitech’s drivers and the like before the mouse will work.  Additionally, if your BIOS supports USB input devices (most modern ones do), you can use the MX900 there even though it functions over Bluetooth.

As a result of the handy HID emulation mode feature of the MX900, I can already use it as a mouse on my other, non-Bluetooth computers as if it were a plain USB mouse, with the operating system none the wiser.  Therein is the rub, however; in order for me to be able to connect the MX900 base station to non-keyboard/mouse devices, I need to be able to convince Windows that it is actually a full fludged Bluetooth receiver and not just a USB mouse.  Normally, Logitech’s SetPoint software installs a program that runs when you log in to Windows and magically turns the MX900 base station into Bluetooth HCI mode, that is, native Bluetooth receiver mode – assuming you had installed the WIDCOMM bluetooth stack, that is.

 So, I set out to install SetPoint on my test computer.  Unfortunately, this didn’t really work out as planned.  The computer I had available to work with was running Windows Server 2003 and it seems that the SetPoint installer for the version I needed wasn’t exactly well tested on Windows Server 2003.  The installer would tend to blow up with heap corruption right away, making it impossible to do anything.  I then tried running the installer under the Windows XP SP2 compatibility layer (right click the .exe, there is a compatibility option in the propsheet if you an administrator).  This got me a bit further, but the Logitech installer inevitibly crashed.

Looking around a bit, there was actually a more recent version of SetPoint available (Logitech supports 2.22 with the MX900, the latesting being 2.60 which is designed for Logitech’s Bluetooth keyboard and mouse suite).  I figured that it was worth a try to install 2.60 and see if that worked.  Sure enough, the installer actually didn’t crash this time, but unfortunately, it would not accept that I had a Bluetooth device that was compatible with it; I got stuck at a dialog that instructed me to connect my Logitech Bluetooth device and hit OK, or skip the installation of the Bluetooth support and install “just plain” SetPoint.  Well, that sucks – the whole point of this excercise was to get Bluetooth working on the test computer, not Logitech’s middleware.

Poking around in my temp directory, I noticed that while the installer was running, one of the temporary directories it created seemed to have a second installer for the WIDCOMM Bluetooth stack (WIDCOMM – now Broadcom - does not make their software directly available for download to end users, and instead requires them to get it bundled with hardware from an equipment manufacturer).  A-ha – maybe there was light at the end of the tunnel, after all.  While the Logitech installer was waiting for me to hit Next in one of the wizard steps, I manually launched the WIDCOMM installer from the temp directory that the Logitech installer had created.  The installer actually worked fine, except that it too complained that it could not detect an active Bluetooth device (fortunately, though, it allowed me the option of continuing the install anyway).

After the WIDCOMM installer finished, I canceled out of the Logitech install and went to see if I could convince the WIDCOMM stack that I really did have a Bluetooth device.  After not getting anywhere on my own, I turned to Google, where I found a number of people complaining about the same problem (about not being able to turn their MX900 receivers to native HCI mode), but no quick solution for Windows.  I did, however, find something for Linux – a program called “hid2hci” that knew how to turn an MX900 Bluetooth receiver to a HCI mode.  Fortunately, source code was included, so it was easy enough to see what it was doing.  Unfortunately, I don’t really have a whole lot of experience with USB, on Windows or other platforms, and what I needed to do was port hid2hci to Windows.

The linux program is fairly simple.  Even with my limited knowledge of USB, what it was doing appeared to be straightforward enough.  The program sends three vendor-specific HID output reports (a HID report is the basic way to either report information from a device to the computer or change a setting on the device for HID devices) to the MX900 receiver.  After receiving the special three HID reports, the MX900 changes its PnP ID and appears to the operating system as a different piece of hardware, an HCI Bluetooth receiver.

 So, I got started working on a Windows version of hid2hci.  The first step was to crack open the Windows DDK documentation (you can download the DDK with the free KMDF 1.1 ISO distribution) and start looking around for ways to talk to USB devices.  It turns out that there is already a rather full featured API to do this, from both user mode and kernel mode.  Because all I really needed to do here was to send three custom commands to the MX900, I picked the user mode HID API to start with.

The user mode HID APIs live in hid.dll and come in two flavors: HID Parser routines (prefixed HidP_), and HID Device/Driver routines (prefixed HidD_).  The former provide a high level interface for formatting, preparing, and parsing the actual USB HID reports, while the latter deal with actually sending and receiving USB HID reports.  The API is a bit cumbersome, but it turns out to not be too hard to use.  The basic idea is:

  1. Open a handle to the HID device that you want to talk to with CreateFile.
  2. Call HidD_GetPreparsedData to load the preparsed data for the collection.  This basically retrieves all sorts of information about the HID device ahead of time in one blob that is later used by the HID Parser routines to ensure that you are matching the report formats used by the device.
  3. Call HidD_GetAttributes and HidD_GetCaps to make sure that the device is the one you meant to connect to and supports the HID usages that you are going to use.  Here, I wanted to verify that the vendor specific usage page 0xFF00, usage 0x0001 is present (as this is where I wanted to send the magic 3 reports to turn the receiver to HCI mode).
  4. Build the HID report.  I originally attempted to do this using the high level HID Parser APIs, but I couldn’t get it to work right – the HID Parser APIs kept complaining that the usage I requested didn’t exist.  I assume that this is because Logitech never bothered to completely describe the format of the HID reports for this vendor specific usage, resulting in the high level parser becoming unhappy if you asked it to format a report for that usage.  As a result, I just built the report manually by just writing the raw data into the report buffer and prepending the HID report ID (0x10) to the report data.
  5. Send the completed report to the device.  There are two ways to do this – WriteFile and HidD_SetOutputReport.  I attempted to use WriteFile first, but it always failed with ERROR_ACCESS_DENIED.  Not being an expert on HID devices, I tried the other documented routine (HidD_SetOutputReport) send the report, which worked fine.  HidD_SetOutputReport internally just sends a special IOCTL to the driver for the device you open, so the code paths are in fact different.

Steps 4 and 5 will basically need to be repeated for each of the three HID reports that we need to send to the Bluetooth receiver.

 There are a couple of other things that you need to do in order to get this to work that I glossed over.  In particular, you need to actually find the device that you want to open with CreateFile.  The best way to do this is by using the SetupDi family of APIs to enumerate all HID devices.  We can then verify that each device has the expected vendor ID, product ID, and HID usages before we try to send it the magical commands to convert the device to native HCI mode.

After putting all of these steps together, I had something that appeared to do what the Linux hid2hci program did.  Sure enough, when I ran my prototype hid2hci port on my test box, a new device appeared in Device Manager, which was detected by the WIDCOMM Bluetooth stack as a Cambridge Silicon Radio Bluetooth Receiver.  Success!

The device itself stays in native HCI mode until it is reset (i.e. rebooting the computer or unplugging the receiver itself), so the HCI conversion program needs to either periodically scan for devices to switch to HCI mode, or register for a device change notification in order to enable full Bluetooth functionality if you reboot or disconnect the Bluetooth receiver.

The source code for my Logitech HID-to-HCI convertor program is available for download if you are interested in it.  You will need Windows DDK installed in order to build it.  Alternatively, you can download the binary if you just want the program and don’t want to install the development environment to build it.  It takes two command line arguments: the hexadecimal vendor ID and hexadecimal product ID of the device that it should switch from HID emulation mode to native HCI mode.  You can find these under Device Manager if you are using Windows XP SP2 or Windows Server 2003 SP1 by going to your device’s property sheet and going to the details tab, then selecting the Hardware Ids listbox item.  The device you want is probably going to be named “USB Composite Device”.  If you are using an MX900, then you can use 046d for the vendor ID and c705 for the product ID.  There is no harm in running the program repeatedly after it has already switched your device(s) to HCI mode.

62 Responses to “Fun with Logitech MX900 Bluetooth receivers”

  1. sabrex says:

    I’ve read through this thread and I don’t understand where exactly I’m supposed to find the widcomm stack installation file after I’ve run the setpoint 4.60 installer. I don’t see it in c:\windows\temp … and I don’t seem to have a temp folder in c:\users\username … What is the name of the widcomm stack installer, and where is it located? Thanks. This is on Vista x32

  2. Jarko says:

    I got my mx900 logitech bt hub working with windows xp sp3’s native stack!

    If you would like to do the same thing all you need to do is to:
    1) remove all widcomm and logitech software (if any)
    2) plug the hub and convert it to hci mode (your wireless mouse stops working at this point!)
    3) When new device wizard pops up, choose not to find any drivers from windows update, then at the next step choose the ‘list or specific location’ option. Then at the 3rd step check the ‘Don’t search I’ll choose the driver to install’ option. Now UNPLUG YOUR DEVICE! Then press next. If i remember correctly, choose ‘Bluetooth radio’ and when the list with manufactuers and their devices comes, choose ‘Cambridge silicon radio’ and the device is ‘Generic radio/cambridge /bluetooth’, i’m not 100% sure :( but it was cambridges’s some generic device under bt radio anyway.
    4) wait the wizard to got finished
    5) connect and convert your mx900 bt hub. Windows now recognizes the device correctly.
    6) pair your mouse (don’t use password)
    7) enjoy :)

  3. tftranstrum says:

    Thanks for a great fix… you created it back in Aug 2006 and it is still applicable today (Oct 2008).

    I purchased a Dell-branded (Logitech) BT Keyboard and Mouse with my recent Dell PC purchase (WinXP Pro).

    Dell Item 330-0437 BLUETOOTH KEYBOARD/MOUSE, BLK, ENG
    Dell Keyboard D/PN: GM952
    Dell Mouse D/PN: UN733
    Dell USB BT Receiver D/PN: DR985

    When installing, it automatically launched and recognized the two devices (HID Only), however only the SetPoint 3.21.29 program appeared to be installed. Widcomm Bluetooth Software 5.1.0.2700 was on the installation disk, but it did not install.

    Similar to most cases above, I could not get the BT Receiver to be recognized as a BT Hub nor to get it to recognize other BT devices.

    I browsed the supplied Dell BT Install Disk and manually installed Widcomm…didn’t help.

    The BT Receiver has a small blue button, used to manually activate the discovery process. Like a couple of other cases above, I found a forum that suggested to removed the BT Receiver, allowing a moment for the hardware to be disabled, then while pressing the blue button, reinsert the BT Receiver and this would activate the “HCI” mode. Sure enough, the BT Hub was recognized, and it created/activated new hardware entries for the BT KB and BT Mouse. AND it was now a visible BT Hub and could discover other BT devices. However, of course, as soon as I rebooted, it was no longer recognized.

    Then I found your site. I manually started the hub again (pressed the blue button and inserted the receiver), I went to Hardware Manager and wrote down the VID and PID codes for the BT Hub (046D C709), KB (046D C70E) and Mouse (046D C70A). I downloaded your compiled binary LHID2HCI.exe above and ran it at the command prompt using the BT Hub VID / PID numbers (\LHID2HCI.exe 046D C709)… it did not activate. So I re-ran it for the Mouse IDs (\LHID2HCI.exe 046D C70A) and it worked like a charm.

    So I simply copied your tool to the root directory (c:\) and created a batch file (hid2hci.bat) with only the command line (c:\LHID2HCI.exe 046D C70A), and added it to my Startup Folder.

    Again, it worked well for me. Upon reboot, the BT KB and Mouse were recognized as generic USB HID KB and Mouse, but then as I logged into Windows, it activated the HCI mode and the BT Hub was recognized and all worked as intended.

    However, I created a new BT connection for my smart phone to sync with my PC (maps to the COM3 port). I found that when rebooting, the system would attempt to resolve the COM3 port before the Startup folder ran my batch file.

    So I simply followed your instructions (Nov 4th 2007 post above) and used Microsoft Resource Kit Tools INSTSERV.exe and SRVANY.exe to create a Service that automatically starts and executes my batch file. Works perfectly. I can now reboot and all active BT devices work without interruption or manual intervention.

    Thanks again for the great fix!

  4. cgb says:

    Just wanted to post and thank you for the fix. This worked perfectly on the diNovo Edge Keyboard Receiver. For mine the correct command string was “lhid2hci 046d c714”. This was done on Vista 64 and no need to install driver, picked up automatically.

  5. Xsempre says:

    Is there a way to reverse?

    This tool got my MX900 setup to work as it should in Vista x64 for the greater part: the hub was turned from a HID into a HCI device and after installing I could pair it with my mouse. I changed it, because I wanted to also be able to sync with my mobile phone over BT. However for some reason this will not work: nokia PC suite recognizes my BT enabled mobile phone, but always tells me “cannot authenticate phone”. I therefore plan on buying a new BT dongle (from Belkin or whatever) but then I prefer to have my MX900 to be working as a HID device again. So can I reverse what was done by the lhid2hci.exe tool? System Restore is not helping me here: for some reason it crashes…
    Thank you for all your great efforts!

  6. Catalin Sanda says:

    Great post, thanks, got me on the right track.

    I had a similar problem after updating the Broadcom Bluetooth stack to the latest version available on their website (at this time 5.5.0.7400), the dongle will not enter HCI mode so the stack will not recognize the radio.

    I updatet to a newer version of SetPoint (4.80.130) but still no luck.

    I used the solution described here, btw for MX 5000 one must issue a “lhid2hci 046D C70A” command, the Dongle will switch to HCI mode, but immediately switch back to HID mode. After some trial and error I found out that LBTServ.exe (a bluetooth helper service from Logitech) was switching it back. After stopping the service I was able to switch the dongle in HCI mode without problems.

    Running lhid2hci at startup didn’t seem to me like an elegant solution to the problem; after all it’s the job of the Logitech software to manage the mode of the dongle.

    I turned my attention back to the LBTServ service and after analyzing with Process Monitor what registry keys it reads and of course after some trial and error I managed to find the key which tells it how to initialize the dongle.

    The key is in HKEY_LOCAL_MACHINE\SOFTWARE\Logitech\Bluetooth and it’s called BTMode. The initial value was 3 and after switching it to 2 everything worked like it was supposed to. The dongle will be switched automagically to HCI mode on logon, it will also work if you unplug and then replug the dongle etc.

    Hope this helps somebody.

    Catalin

  7. balatro says:

    Thanks Catalin you saved my day. My system was stuck in HID mode but now I can sync my phone with the bluetooth dongle that came with my new diNovo Media Desktop Laser.

  8. I have recently bought a Logitech diNovo Mini for my Media Center PC, a mini Bluetooth keyboard with a small touchpad. The problem with this keyboard is that unlike other Logitech Bluetooth keyboard/mouse bundles, the USB dongle is not supported to act as a Bluetooth hub (it actually sais so on their site) and no version of SetPoint will switch it to HCI mode or install the Broadcom stack. Using lhi2hci (for diNovo Mini the command is: “lhid2hci 046d c71f”) I managed to switch de device to HCI mode and of course it will act as a standard Bluetooth hub.
    Running lhid2hci at startup will only partially solve the problem, because it will not switch a newly inserted dongle (this never happens in my case) and will not HCIfy a dongle after resume (I usually put the computer in standby instead of powering it down), so I decided to build a Windows service to do that.
    The service is based on lhid2hci and the source code and an installer can be found at http://code.google.com/p/lbtservice/
    As a note, for the diNovo Mini, Broadcom’s Web Installer will not install the stack (probably they blacklisted the dongle), but any OEM supplied version will work. For Windows 7 I used http://drivers.softpedia.com/get/Other-DRIVERS-TOOLS/Others/Acer-TravelMate-4730-Notebook-Broadcom-Bluetooth-Driver-621500-for-Win7.shtml

  9. bmunday says:

    kudos on the MVP, also on this device. It’s an extraordinary device.
    Bringing this forward to W2k8 Svrx64 is trouble. All the x64 issues are rough.

    @Catalin Sanda, how did you aquiare the Broadcom BT 5.5.0.7400 stack? I cannopt downlaod it in segments and the installer checks OS before downlaod?!!

    My default Logitech install( 10/8/2009)-4.8.something; was using HKLM/SOFTWARE/Logitech/Bluetooth/BTMode=2 already, although I may have installed it while lhid2hci’ing the BT base station (logitech-mx900) or while I had manually DISABLED LBTServ. Nothing I could do there. SO no improvement here.

    Any driver I change it too during detection as a BT hub encounters a code 52 startup issue: it cannot get past lack of driver signing being a problem. I think Svr2008 is in a form of denial.

    @catalain: how did you get the device driver to start without driver signing? Via disabling enforcement?

  10. Hector says:

    Catalin, thank you for your post. It made it possible for me to use my Logitech DiNovo cordless desktop laser with a USB KVM switch.

    It seems you can’t use a paired device on a USB switch. So I used the method above, but I did the opposite – I set the key HKEY_LOCAL_MACHINE\SOFTWARE\Logitech\Bluetooth “BTMode” to a value of 3 on both computers and rebooted.

    The system no longer puts the dongle into bluetooth mode.

    The dongle now hotplugs the keyboard, media pad, and mouse on both systems. One system is Windows 7, the other is XP with SP3. It takes a few moments for the hotplug to work, but it’s to be expected with this arrangement.

    I’m going to toss the search phrase logitech bluetooth usb kvm in here for the search engines to feed on.

    -Hector

  11. Giovanni says:

    Great post, thank you. Your page has been very useful to hack my Dell Truemobile 370 bluetooth interface. I used and modified your code for Dell Truemobile 370. See my page at http://www.giovanni.panozzo.it/mysw/tmhid2hci/

    Giovanni

  12. Lazaros says:

    I want to thank you for making my life a bit easier and bringing some functionality back to the cradle of mx900.