Overview

USB VID 0x046d
USB PID 0xc52b

Message Sub ID
0x80 SET_REGISTER
0x81 GET_REGISTER
0x82 SET_LONG_REGISTER
0x83 GET_LONG_REGISTER
0x8F ERROR_MSG

Notifications
0x40 Device Disconnection
0x41 Device Connection
0x4A Unifying Receiver Locking Change information

Registers
0x00 Enable HID++ Notifications
0x02 Connection State
0xB2 Device Connection and Disconnection (Pairing)
0xB3 Device Activity
0xB5 Pairing Information
(more undocumented below)

Not documented:
Long register B5 (Pairing Information) - nn=03 "Receiver information?"
Send: 10 FF 83 B5  03 00 00 00 - Short (10) message for receiver (FF) to retrieve
	long register (83) PairingInfo (B5) with special param 03 00 00 00.
Recv: 11 FF 83 B5  03 AF 4F 95  EA 05 06 0E  00 00 00 00  00 00 00 00
11 - Long message
FF - Receiver target
83 - LONG_REGISTER_RESPONSE
B5 - Pairing Info
03 - "Receiver information"?
AF 4F 95 EA - Serial Number of receiver
05 - dunno, also seen: 02, 18
06 - Max Device Capability? (not sure, but it is six)
0E - dunno, also seen: 32, 47
00 00 00 00  00 00 00 00 - padding?
Remaining information:
- Wireless Status (0x03)
- ModelId (0x46d c52b)
- Handle: 0xff000001 (0xff is device ID, 01 is internal to the software, ordered)
- Dfu Status (0x1)
- Is Dfu Cancellable (yes)

DFU = Device Firmware Upgrade
0x00 - Up-to-date
0x01 - Unknown
0x02 - Available
0x03 - Initiated
0x04 - Failed
0x05 - Succeeded
0x06 - Newer software needed
0x06 - Unrecoverable

Short register F1 - "Version information" (guessed)
Header: 10 FF 81 (short msg, receiver is target, GET_REGISTER)
Data: F1 nn xx yy (xx yy is empty for request and contains version for response)
nn=01 xx,yy=12 01
nn=02 xx,yy=00 19
nn=03 error 03 (Invalid address) (but returns 00 07 for keyboard)
nn=04 xx,yy=02 14
Displayed firmware version: 012.001.00019 (x1 . y1 . x2 y2)
Displayed bootloader version: BL.002.014 (BL . x4 . y4)

More undocumented short regs **for K800 keyboard**:
17 rw Illumination info
get 00 00 00 - Retrieve illimunation status?
rsp: 3C 00 02 - (illimunation is disabled)
set 3C 00 01 - Activate illumination only when I start typing
set 3C 00 02 - Disable keyboard illumination
Notif [10 ix 17] 3C 00 00 0n received when the keyboard illumination level is
changed. (n = 1..5; 1=off; 5=full brightness) (NOTE: needs notif flag 00 02 00)

01 rw "Keyboard hand detection?"
get 00 00 00 - retrieve keyboard hand detection status?
rsp: 00 00 20 - (hand detection is disabled)
set 00 00 00 - Enable hand detection
set 00 00 20 - Disable hand detection

09 rw "F key functions"
get 00 00 00 - Retrieve F key function state
rsp: 00 00 00 - (F key functions are not swapped)
set 00 01 00 - Swap F key functions
set 00 00 00 - Do not swap F key functions

00 rw ENABLED_NOTIFS, 10 02 00, 10 is Battery info, buy what is 02?
After writing FF FF FF, reading the register shows 13 02 00
.1 .. .. - If enabled, keys like Web and Mute are passed over the HID protocol
	with short message type=03. This presumably allows the user to customize
	key bindings.
.2 .. .. - If enabled, Fn+F8 (Sleep button) generates a HID++ short message
	instead of a key event that is captured by the Linux input layer
	(10 ix 04  0s 00 00 00 where s=1 when pressed and s=0 when released).
10:53:54.914 Recv       report_id=10 short device=01 DEV1 type=04 SYSTEM_CONTROL
params=01 00 00 00
1. .. .. - battery status (documented) (see also below, register/type 07)
.. .2 .. - backlight changes (pressing Fn+F[56])
(more details about bits 0 and 1 of flag 1 in keyboard.txt)

07 r Likely the battery status of the kbd, not observed for M525 mouse
get 00 00 00
rsp: 07 00 00 - (Battery full?)
rsp: 01 00 00 - (Battery almost empty? Flashing red light on keyboard)
Undocumented short type=07 for KBD dev: 10 02 07  01 00 00 00; sent when
pressing the Fn+F7 key for battery information. 01 is presumably the battery
level (red, danger, etc))
(on kbd enable, 10 02 07  01 00 00 00 is sent ONLY if notification is enabled
after NOTIF_DEVICE_PAIRED (0x41) / ?NOTIF_PAIR_ACCEPTED (0x4B); not observed
when battery is not near dead)

Format: 10 DEVID 07   <battery level> <some magic> 00 00
(or: response to reading register, 10 DEVID 81 07   07 <batlvl> <magic> 00)
Battery level:
00 is not possible for battery level, when the keyboard went off because of zero
	power, 01 was still the reported value
01 - red zone
03 - one bar
05 - two bars
07 - three bars
Some magic:
00 - after unplugging/when not connected
22 - fully charged
25 - charging
26 - notification when battery is fully charged [10 ix 07] 07 26 00 00
NOTE: 10 ix 07 notifications are only available when r0bit4 (Battery status) of
Enable Hid++ Notifications (type=0x00) is enabled. This notification is then
sent when pressing the Fn+F7 (battery) key or when an event happens (battery
full).

Recv    report_id=10 short device=02 DEV2 type=41 NOTIF_DEVICE_PAIRED     params=04 A1 10 20 				# Hello, I am a device!
Recv    report_id=20 unkn  device=02 DEV2 type=42 NOTIF_CONNECTION_STATUS params=00 00 00 00  00 00 00 00  00 00 00 00	# wtf is this?
Recv    report_id=10 short device=02 DEV2 type=4B ?NOTIF_PAIR_ACCEPTED    params=01 00 00 00 				# Guessed: pair succeeded?
Send    report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=00 ENABLED_NOTIFS  params=10 00 00 	# Enable battery status notifs
Recv    report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=00 ENABLED_NOTIFS  params=00 00 00 	# succesfully set
Recv    report_id=10 short device=02 DEV2 type=07                         params=01 00 00 00				# battery low notif!

17 rw ???

Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=17   params=00 00 00 
        report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=17   params=3C 00 01 
Send    report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=17   params=3C 00 01 
        report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=17   params=00 00 00 
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=01   params=00 00 00 
        report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=01   params=00 00 00 
Send    report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=01   params=00 00 00 
        report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=01   params=00 00 00 
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=09   params=00 00 00 
        report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=09   params=00 00 00 
Send    report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=09   params=00 00 00 
        report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=09   params=00 00 00 
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=07   params=00 00 00 
        report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=07   params=07 00 00 
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=00 ENABLED_NOTIFS  params=00 00 00 
        report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=00 ENABLED_NOTIFS  params=10 02 00 
Send    report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=00 ENABLED_NOTIFS  params=10 02 00 
        report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=00 ENABLED_NOTIFS  params=00 00 00 
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=17   params=00 00 00 
        report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=17   params=3C 00 01 
Send    report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=17   params=3C 00 01 
        report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=17   params=00 00 00 
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=01   params=00 00 00 
        report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=01   params=00 00 00 
Send    report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=01   params=00 00 00 
        report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=01   params=00 00 00 
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=09   params=00 00 00 
        report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=09   params=00 00 00 
Send    report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=09   params=00 00 00 
        report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=09   params=00 00 00 
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=07   params=00 00 00 
        report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=07   params=07 00 00 

Enabled HID++ Notifications for receiver
Serial number: 03AF4F95 (shipped with K800 keyboard)
Firmware version: 012.001.00019
Bootloader version: BL.002.014
Supported notifs: 00 09 00

Serial number: 08D89AA6 (shipped with M525 mouse)
Firmware version: 024.000.00018
Bootloader version: BL.000.006
Supported notifs: 00 19 00
		     ^--- besides Wireless notifs (r1bit1) and Software present
(r1bit3) it also supports another flag: r1bit4 (unknown functionality)


Documented in hidpp10:
Allows for testing protocol version.
Request: 10 DeviceIndex 00 1n 00 00 uu
- n is SwId
- UU is "ping data" defined by SW
Responses:
HID++ 1.0: 10 ix  8F  00 Fn 01 00 (ERR_INVALID_SUBID)
HID++ 2.0: 10 ix 00 1n 02 00 UU
HID++ X.Y: 10 ix 00 1n XX YY UU

Discovery:
1. Get Reg 00
2. Set Reg 00 to value from (1) with bit 0 of the second byte enabled (v1[1] |= 1)
3. Send read CONNECTION_STATE register for total number of devices
4. Write CONNECTION_STATE 02 00 00 register
5. (4) triggers a 0x41 notification (Device Paired notification) for each
   device. Note, device index does not have to start at 1 (if device got
   unpaired before).
5. Got response for (3).
6. (disable discovery) Get Reg 00
7. Set Reg 00 to value from (6) with bit 0 of the second byte disabled (v1[1] &= ~1)

Startup (all targeted at receiver, notifications come from device 1..6):
 1. Get receiver details from pairing info register (serial number, etc)
 2. Get firmware version (recv)
 3. Get bootloader version (recv)
 4. Get enabled notifications
 5. Enable wireless notifications (set enabled notifs reg)
 6. Read connection state register for number of machines
    for each machine from (6):
    7. Write params to connection state register (02 00 00 was written) (read
       returns after (8)) (possibly a "trigger report all paired devices")
    8. (7) immediately triggers a Device Paired notification for a previously paired dev
    9. Send/Read request for paired device device name
    10. Send/Read request for paired device extended info (serial, .., location of power switch)
11. Read fw+bootloader version information again (this seems useless?)

A1. Pairing starts: write DEVICE_PAIRING register, enable pairing with timeout (read returns after (A2))
A2. (A1) triggers Receiver Lock Changed notification (subid=0x41) (reason: no error)
A3. On timeout, Receiver Lock Changed notification is received (reason: timeout)
A4. (close button) On close, DEVICE_PAIRING register is written to disable pairing discovery
A5. Receiver Lock Changed notification is immediately received (reason: timeout)

Advanced:
B1. Advanced button is pressed. Polling starts, every x time, DEVICE_ACTIVITY register request is sent/read
B2. Unpair device, Device Unpaired notification (subid=0x40) received (reason:
    device disconnected) (note, report id 10 and 20 received, ignore 20)

Send    report_id=10 short device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=03 00 00 
        report_id=11 long  device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=03 AF 4F 95  EA 05 06 0E  00 00 00 00  00 00 00 00 
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=01 00 00 
        report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=01 12 01 
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=02 00 00 
        report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=02 00 19 
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=03 00 00 
        report_id=10 short device=FF RECV type=8F _ERROR_MSG              SubID=81 GET_REG  reg=F1 VERSION_INFO?  err=03 INVALID_ADDRESS  
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=04 00 00 
        report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=04 02 14 
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=00 ENABLED_NOTIFS  params=00 00 00 
        report_id=10 short device=FF RECV type=81 GET_REG                 reg=00 ENABLED_NOTIFS  params=00 01 00 
Send    report_id=10 short device=FF RECV type=80 SET_REG                 reg=00 ENABLED_NOTIFS  params=00 01 00 
        report_id=10 short device=FF RECV type=80 SET_REG                 reg=00 ENABLED_NOTIFS  params=00 00 00 
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=02 CONNECTION_STATE  params=00 00 00 
        report_id=10 short device=FF RECV type=81 GET_REG                 reg=02 CONNECTION_STATE  params=00 01 00 
Send    report_id=10 short device=FF RECV type=80 SET_REG                 reg=02 CONNECTION_STATE  params=02 00 00 
        report_id=10 short device=01 DEV1 type=41 NOTIF_DEVICE_PAIRED     params=04 61 10 20 
        report_id=10 short device=FF RECV type=80 SET_REG                 reg=02 CONNECTION_STATE  params=00 00 00 
Send    report_id=10 short device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=40 00 00 
        report_id=11 long  device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=40 04 4B 38  30 30 00 00  00 00 00 00  00 00 00 00 
Send    report_id=10 short device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=30 00 00 
        report_id=11 long  device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=30 FB 84 1B  86 1A 40 00  00 07 00 00  00 00 00 00 
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=01 00 00 
        report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=01 12 01 
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=02 00 00 
        report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=02 00 19 
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=03 00 00 
        report_id=10 short device=FF RECV type=8F _ERROR_MSG              SubID=81 GET_REG  reg=F1 VERSION_INFO?  err=03 INVALID_ADDRESS  
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=04 00 00 
        report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=04 02 14

No paired devices, start pairing:
 1. Enable device pairing (response read returns after (2))
 2. Got receiver lock notification (locking open)

 3. Enable device, got Device Paired notif (kbd, link encrypted, link not established)
 4. Send read request for device name (response in (6))
 (5. got report_id=20 for device paired notif)
 5. Got Receiver Lock changed notification (lock closed)
 6. Response for device name (sent in (4)), Send/Read request for paired device
    extended info (serial, .., location of power switch)
 7. Got Device Paired notif (kbd, link encrypted, link established, link with payload)
 8. (??) Send dev1 [header 10 01 00] 12 28 3F 94
 9. Got notification ("Pair accepted"?) [header 10 01 4B] 01 00 00 00
10. Dev1 request (8) returned error message (err=01 SUCCESS)
11. Read dev1 register 0D, but it returns an error (err=02 INVALID_SUBID)
12. Request/read dev1 register 07
13. Read dev1 firmware, bootloader version
14. Read recv firmware, bootloader version
15. Write DEVICE_PAIRING register (close lock)
16. Got Receiver Lock changed notification (lock closed) (was already closed in (5) though)

Send    report_id=10 short device=FF RECV type=80 SET_REG                 reg=B2 DEVICE_PAIRING  params=01 53 3C 
        report_id=10 short device=FF RECV type=4A NOTIF_RECV_LOCK_CHANGED params=01 00 00 00 
        report_id=10 short device=FF RECV type=80 SET_REG                 reg=B2 DEVICE_PAIRING  params=00 00 00 

        report_id=10 short device=01 DEV1 type=41 NOTIF_DEVICE_PAIRED     params=04 61 10 20 
Send    report_id=10 short device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=40 00 00 
        report_id=20 unkn  device=01 DEV1 type=41 NOTIF_DEVICE_PAIRED     params=00 10 20 1A  40 00 00 00  00 00 00 00 
        report_id=10 short device=FF RECV type=4A NOTIF_RECV_LOCK_CHANGED params=00 00 00 00 
        report_id=11 long  device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=40 04 4B 38  30 30 00 00  00 00 00 00  00 00 00 00 
Send    report_id=10 short device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=30 00 00 
        report_id=11 long  device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=30 FB 84 1B  86 1A 40 00  00 07 00 00  00 00 00 00 
        report_id=10 short device=01 DEV1 type=41 NOTIF_DEVICE_PAIRED     params=04 A1 10 20 
Send    report_id=10 short device=01 DEV1 type=00                         params=12 28 3F 94 
        report_id=10 short device=01 DEV1 type=4B ?NOTIF_PAIR_ACCEPTED    params=01 00 00 00 
        report_id=10 short device=01 DEV1 type=8F _ERROR_MSG              SubID=00   reg=12   err=01 SUCCESS  
Send    report_id=10 short device=01 DEV1 type=81 GET_REG                 reg=0D   params=00 00 00 
        report_id=10 short device=01 DEV1 type=8F _ERROR_MSG              SubID=81 GET_REG  reg=0D   err=02 INVALID_SUBID  
Send    report_id=10 short device=01 DEV1 type=81 GET_REG                 reg=07   params=00 00 00 
        report_id=10 short device=01 DEV1 type=81 GET_REG                 reg=07   params=07 00 00 
Send    report_id=10 short device=01 DEV1 type=81 GET_REG                 reg=F1 VERSION_INFO?  params=01 00 00 
        report_id=10 short device=01 DEV1 type=81 GET_REG                 reg=F1 VERSION_INFO?  params=01 22 01 
Send    report_id=10 short device=01 DEV1 type=81 GET_REG                 reg=F1 VERSION_INFO?  params=02 00 00 
        report_id=10 short device=01 DEV1 type=81 GET_REG                 reg=F1 VERSION_INFO?  params=02 00 19 
Send    report_id=10 short device=01 DEV1 type=81 GET_REG                 reg=F1 VERSION_INFO?  params=03 00 00 
        report_id=10 short device=01 DEV1 type=81 GET_REG                 reg=F1 VERSION_INFO?  params=03 00 07 
Send    report_id=10 short device=01 DEV1 type=81 GET_REG                 reg=F1 VERSION_INFO?  params=04 00 00 
        report_id=10 short device=01 DEV1 type=81 GET_REG                 reg=F1 VERSION_INFO?  params=04 02 01 
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=01 00 00 
        report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=01 12 01 
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=02 00 00 
        report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=02 00 19 
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=03 00 00 
        report_id=10 short device=FF RECV type=8F _ERROR_MSG              SubID=81 GET_REG  reg=F1 VERSION_INFO?  err=03 INVALID_ADDRESS  
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=04 00 00 
        report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=04 02 14 

Send    report_id=10 short device=FF RECV type=80 SET_REG                 reg=B2 DEVICE_PAIRING  params=02 53 94 
        report_id=10 short device=FF RECV type=80 SET_REG                 reg=B2 DEVICE_PAIRING  params=00 00 00 
        report_id=10 short device=FF RECV type=4A NOTIF_RECV_LOCK_CHANGED params=00 00 00 00 

Somewhere in the below stream is the battery condition of the M525 mouse (good).
It could also be that there is no battery information at all and that SetPoint
is faking the information. I have tried brand-new Duracell batteries and the
output is still the same.
Send    report_id=10 short device=01 DEV1 type=00                         params=05 00 03 00 
Recv    report_id=11 long  device=01 DEV1 type=00                         params=05 02 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 
Send    report_id=10 short device=01 DEV1 type=02 MOUSE                   params=05 00 00 00 
Recv    report_id=11 long  device=01 DEV1 type=02 MOUSE                   params=05 01 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 
Send    report_id=10 short device=01 DEV1 type=02 MOUSE                   params=15 00 00 00 
Recv    report_id=11 long  device=01 DEV1 type=02 MOUSE                   params=15 00 52 51  4D 27 02 00  28 00 40 13  00 00 00 00  00 
Send    report_id=10 short device=01 DEV1 type=04 SYSTEM_CONTROL          params=05 00 00 00 
Recv    report_id=11 long  device=01 DEV1 type=04 SYSTEM_CONTROL          params=05 5A 05 00  00 00 00 00  00 00 00 00  00 00 00 00  00 
Send    report_id=10 short device=01 DEV1 type=0B                         params=15 01 00 00 
Recv    report_id=11 long  device=01 DEV1 type=0B                         params=15 01 04 00  00 00 00 00  00 00 00 00  00 00 00 00  00 

The mouse got some messages when SetPoint is closed:
Send    report_id=10 short device=01 DEV1 type=0B                         params=15 00 00 00
Recv    report_id=11 long  device=01 DEV1 type=0B                         params=15 00 04 00  00 00 00 00  00 00 00 00  00 00 00 00  00
Send    report_id=10 short device=01 DEV1 type=04 SYSTEM_CONTROL          params=05 00 00 00
Recv    report_id=11 long  device=01 DEV1 type=04 SYSTEM_CONTROL          params=05 5A 05 00  00 00 00 00  00 00 00 00  00 00 00 00  00

Back to alive (very, very red battery for keyboard):
Recv    report_id=10 short device=02 DEV2 type=41 NOTIF_DEVICE_PAIRED     params=04 A1 10 20
Recv    report_id=20 unkn  device=02 DEV2 type=42 NOTIF_CONNECTION_STATUS params=00 00 00 00  00 00 00 00  00 00 00 00
Send    report_id=20 unkn  device=02 DEV2 type=0E LEDS                    params=00 00 00 00  00 00 00 00  00 00 00 00

All registers for K800 (HID++ 1.0):
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=00 ENABLED_NOTIFS  params=00 00 00
Recv    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=00 ENABLED_NOTIFS  params=00 00 00
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=01 KBD_HAND_DETECT?  params=00 00 00
Recv    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=01 KBD_HAND_DETECT?  params=00 00 00
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=07 BATTERY?  params=00 00 00
Recv    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=07 BATTERY?  params=03 00 00
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=09 FN_KEY_SWAP?  params=00 00 00
Recv    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=09 FN_KEY_SWAP?  params=00 00 00
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=17 ILLUMINATION_INFO?  params=00 00 00
Recv    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=17 ILLUMINATION_INFO?  params=3C 00 01
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=51   params=00 00 00 
Recv    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=51   params=00 00 00
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=54   params=00 00 00
Recv    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=54   params=FF 00 00
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=D0   params=00 00 00
Recv    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=D0   params=00 00 00
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=F1 VERSION_INFO?  params=00 00 00
Recv    report_id=10 short device=02 DEV2 type=8F _ERROR_MSG              SubID=81 GET_REG  reg=F1 VERSION_INFO?  err=03 INVALID_ADDRESS
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=F2   params=00 00 00
Recv    report_id=10 short device=02 DEV2 type=8F _ERROR_MSG              SubID=81 GET_REG  reg=F2   err=02 INVALID_SUBID
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=F3   params=00 00 00
Recv    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=F3   params=00 00 00
Send    report_id=10 short device=02 DEV2 type=83 GET_LONG_REG            reg=0F   params=00 00 00 
Recv    report_id=11 long  device=02 DEV2 type=83 GET_LONG_REG            reg=0F   params=FF FB 00 00  02 40 02 5C  00 00 00 00  0F F9 00 80

Observations about reading regs:
- The M525 HID++ 2.0 device does not reply with anything useful to any register
  request (GET_REG or GET_LONG_REG with 00 params).
- eading an unknown register on K800 keyboard (HID++ 1.0) yields:
Recv    report_id=10 short device=02 DEV2 type=8F _ERROR_MSG              SubID=81 GET_REG  reg=FE   err=02 INVALID_SUBID  
Recv    report_id=10 short device=02 DEV2 type=8F _ERROR_MSG              SubID=83 GET_LONG_REG  reg=FE   err=02 INVALID_SUBID  
- On a M525 mouse (HID++ 2.0), this shows SUCCESS instead:
Recv    report_id=10 short device=01 DEV1 type=8F _ERROR_MSG              SubID=81 GET_REG  reg=FE   err=01 SUCCESS  
Recv    report_id=10 short device=01 DEV1 type=8F _ERROR_MSG              SubID=83 GET_LONG_REG  reg=FE   err=01 SUCCESS  
