work/k75-rgb
in development · 2026
k75-rgb
a keyboard ignored the docs, so i read the firmware instead.
the redthunder k75 ships windows-only lighting software. i dumped the firmware, disassembled it, and rebuilt the protocol from evidence — a rust library that can set the matrix and save to flash, verified live over 2.4 ghz.
the story
it started as a support question — the rgb was off and nobody remembered the hotkey. the vendor software is windows-only, the "manual" is a leaflet, and the protocol is undocumented. the reasonable move was to buy a different keyboard. i disassembled the firmware instead.
the method is the project. every constant in the library traces to a disassembly offset or a captured packet; anything that is merely inferred is gated behind a Traced marker and never sent by default. no invented bytes, no plausible guesses — if a packet can’t be traced to evidence, it doesn’t ship.
the result so far: a forbid(unsafe) rust core with a cli that can paint the 126-slot led matrix, drive the case light frame-by-frame, and commit a config to flash that survives replug and the 2.4 ghz dongle. the 17-effect engine, register map, and recovery paths are documented for whoever comes next — including the part where the board briefly spoke only bootloader to me.
what it does
- colour write, matrix display, and flash save verified live — wired and over the 2.4 ghz dongle.
- full 64 kb firmware dump backed up before any probing; recovery (fn+esc, isp reflash) mapped before anything risky.
- 126-slot matrix layout decoded; 14 keys pinned to physical positions by watching the board.
- 17-effect engine decoded from the dispatcher table, including the fn+tab cycle order and both palette ramps.
- the library is forbid(unsafe) — unverified protocol paths are typed as Traced and refuse to send without an explicit opt-in.
decisions i’m proud of
▸ no invented packets. ever.
the fastest way to look like you reverse-engineered something is to send plausible-looking bytes and credit whatever happens. the rule here is harder: every packet must trace to a capture or a disassembly offset, and if it can’t, it doesn’t get sent. slower. correct.
▸ verified and traced are different states
the type system encodes how much i trust each protocol path. Verified means a human watched the LEDs change. Traced means the firmware disassembly says the path exists. the library refuses to collapse the two — confidence is a claim you earn with evidence, not a default.
▸ the docs are the deliverable
a reverse-engineering project that ends in a working repo but no readable evidence is a magic trick, not engineering. the register map, the effect table, the recovery guide — the paper trail is the point. whoever picks this up after me starts at 80%, not at zero.