Logitech G402 mouse bricked

[twizzter]

Hello,

Got it as spare parts donor, then thought It would be fun and exercising to fix it. Currently i'm running out of ideas:

-device was not detected after plugging into USB port. Checked cable for continuity.
-no signs of mechanical or water damage. Don't know history of it, but mouse was probably bricked during FW update.
-3v3 OK, reset high, found no waveform on xtal. Replaced it, no luck.
-noticed F102R8T6 onboard. Hooked SWD testpoints into ST-link utility. Tool was able to detect MCU, option bytes showed Read out protection enabled (aww, expected) and all flash sectors protection, but i wasn't able to disable protections, erase MCU or even upload my own code to verify if MCU is alive. And probably is not.

So i replaced MCU with blank one (option bytes read/write, toggle protection and test code works now) and started to look for firmware files.
Found package called "G402Update_v17.exe" - unfortunately tool was looking for Logi device (USB update, probably DFU type, searching for specific VID/PID, anyway- won't work trough USB now). Pitty.

Next, i've used Resource Hacker to find and extract files from installer. Found something interesting called "FIRMWARE2000", extracted it (sized reasonably ~48k, so it could fit into 64k MCU) but it didn't looked like BIN flash image (weird "U90_D0" header, not ended with FFs, kind of checksum at end of file etc) Flashed using this file anyway. Still brick.
https://github.com/BastilleResearch/keysniffer/issues/3 Stumbled upon this thread - so there's chance to extract raw hex update dumps from Mac update files, using 7z.
Tried with few of them, managed to extract the same 48k update file, but one of them was named "U88_B0016.DFU". DFU extension reminds me of DFU file manager (part of DFUSe) used for BIN->DFU/DFU->BIN files conversion. Unfortunately, tools were not able to recognize extracted update files as correct.

Long story short:
-MCU is bricked,
-Probably there's no way to dump firmware from another mouse
-Got firmware update file, but it's not raw bin/hex, but rather kinda proprietary DFU format. File/header analysers - zero hits.

Anybody got experience with Logi DFU flashing/format conversion?

Since i'm not sure about copyright issues, i've attached txt with first bytes of file - maybe somebody will be able to recognize file format.
Would appreciate any help 
Thanks,
Kamil

[Rasz]

https://blog.zapb.de/stm32f1-exceptional-failure/
https://github.com/doegox/stm32f1-firmware-extractor

logitech firmware is most likely encrypted, with decryption happening on the mouse

[twizzter]

Thanks, i'll try to read something from old MCU.
Speaking of encryption - I found stuff like proper PID, VID descriptor numbers and  raw text strings (ie "G402 Hyperion Fury") inside firmware. Can we assume that file is not packed/encrypted?

Extracted DFU structure is not compatible with specification described in http://rc.fdr.hu/UM0391.pdf
If i could get rid of this custom DFU package that firmware is wrapped with, there might be a little chance of success.
As far as i know .bin file structure is not standardized at all - it's only stream of raw data, so it's hard to find characteristic spots like entry point.