AJ179 Protocol Documentation

A technical deep-dive into the reverse-engineered USB HID protocol used by AJAZZ, Attack Shark, VXE, and other PAW3395/PAW3950 mice equipped with CompX (248A/249A) and Yichip (3151) dongles.

Connection & Endpoints

The mouse exposes multiple USB collections. Configuration is done exclusively over the Vendor-defined collection:

Usage Page: 0xFF00
Usage: 0x01
Report ID: Usually 0x00 (Windows apps often require prefixing payloads with 0x00 for the Report ID, making the actual transfer size 65 bytes instead of 64).

Packet Header Structure

All SET and GET commands follow a strict header format. Commands are typically sent as 64-byte blocks with a checksum at byte 0x20 (32).

Byte [0] = 0x00 // Windows Report ID padding (optional on Mac/Linux depending on API)
Byte [1] = CMD  // Command byte (e.g. 0x03 for SET DPI, 0x13 for GET DPI)
Byte [2] = 0x00
Byte [3] = 0x01
Byte [4] = 0x25 // Optional meta byte (often 0x25 for DPI or 0x21 for rates)
... payload ...
Byte [32] = Checksum

The checksum is calculated by summing 9 triples from offsets 5 through 31.

Commands List

Command	Hex	Description
`SET DPI`	`0x03`	Writes DPI stages and active index.
`GET DPI`	`0x13`	Reads DPI stages and active index.
`SET RATE`	`0x02`	Sets polling rate (125Hz, 250Hz, 500Hz, 1000Hz).
`GET RATE`	`0x12`	Reads polling rate.
`SET LIGHT`	`0x05`	Sets RGB mode, speed, and brightness.
`GET LIGHT`	`0x15`	Reads RGB settings.
`SET SENSOR`	`0x06`	Configures LOD, Ripple Control, and Angle Snapping.
`GET SENSOR`	`0x16`	Reads Sensor Settings.
`STATUS`	`0x10`	Polls for battery and sleep state.
`MACRO`	`0x08`	Reads/Writes chunked macro streams.
`KEYMAP`	`0x09`	Full 6-button keymap table.

Note: GET commands are consistently exactly 0x10 higher than their corresponding SET commands.

DPI Configuration (0x03 / 0x13)

DPI packets contain up to 6 stages. The active stage is defined in the upper nibble of byte [5], and the number of stages is in the lower nibble.

Byte [4] = 0x25
Byte [5] = (activeIndex << 4) | count
Byte [6-7] = Stage 1 (Little Endian)
Byte [10-11] = Stage 2
...

The raw wire value for PAW3395 sensors is calculated as: wire = (DPI / 50) - 1.

Sensor Configuration (0x06 / 0x16)

Sensor packets configure advanced PAW3395 features.

Byte [4] = 0x21
Byte [5] = Lift-Off Distance (1 = 1mm, 2 = 2mm)
Byte [6] = Angle Snapping (0 = Off, 1 = On)
Byte [7] = Ripple Control (0 = Off, 1 = On)

Hardware DPI Interrupts (0xC2)

Unlike standard mice, the AJ179 does not require polling to detect physical DPI button presses. When the user presses the physical DPI button on the mouse, the receiver spontaneously broadcasts an interrupt report over the Vendor collection.

This interrupt packet bypasses the standard 0x13 format and uses a secret 0xC2 command byte:

Byte [0] = 0x00 // Windows padding
Byte [1] = 0xC2 // Interrupt Command
Byte [2] = (activeIndex << 4) | 0x06 // e.g. 0x06, 0x16, 0x26...
Byte [3-4] = Active DPI Wire Value (Little Endian)

This allows configurators to update their UI in real-time without polling the mouse and saturating the USB bus.