About this project

This project transforms the Hanwang PV60 (Ai Pointer) voice pen from a presentation clicker into an input device. The actual manufacturer is Shenzhen Dosmono Technology (dosmono), with Hanwang as the OEM brand. Main features: short-press up/down keys for page turning or scrolling; long-press up for Enter, long-press down for Backspace; press the voice key once to open the microphone and trigger the IME voice hotkey (Right Alt), press again to stop; hold the voice key to enter air mouse mode (gyroscope-controlled cursor); tray display shows battery percentage, connection status, and interception method. The hardware is a USB composite device (VID_0611 / PID_3001) containing a USB Audio microphone, HID keyboard, HID mouse, and a 33-byte send/receive channel on vendor page 0xFF00. All key presses and configuration go through the vendor page. The documentation records the key code and battery report formats (millivolts little-endian, official percentage formula), and notes that the pen reports battery only once every 10 seconds while awake. The implementation relies on the Interception keyboard filter driver to cleanly intercept the pen's key presses. The README explicitly warns that this driver may be flagged as suspicious by online game anti-cheat systems (ACE, Vanguard, VAC/EAC/BattlEye, etc.), and recommends uninstalling the driver and rebooting before gaming. After uninstallation, the program falls back to a low-level keyboard hook degraded mode; functionality remains available but long presses will leak characters. The README also documents several empirical findings: long-press behavior is occupied by firmware macros and cannot be cleanly intercepted by user-mode hooks; the vendor DLL (kwma_x64.dll) corrupts the process heap and must be isolated in a separate child process with watchdog restart; the SDK falsely reports success for a sleeping pen, requiring re-sending commands and probing liveness via read-only requests; some IMEs ignore SendInput events with injection flags, requiring keys to be sent at the driver level, and virtual-key to scan-code conversion requires MAPVK_VK_TO_VSC_EX; firmware macros cannot be modified through configuration, and configuration writes are volatile. The repository contains the main program, an audio host child process, multiple reverse-engineering diagnostic tools (packet capture, A/B comparison, command enumeration, liveness stress testing, etc.), and design documents. Building requires the .NET 8 SDK and can be published as a self-contained single file. Third-party components (the vendor DLL and Interception) are not distributed with the repository and must be prepared separately; without the vendor DLL, voice functionality is disabled while other features work normally. Paths are currently hardcoded to D:\pen-hack\, and configuration changes take effect immediately after saving. The license is GNU GPL v3, covering only the project's own code.