About ELAN TrackPad

Since "almost" no one has done anything in this regard (I basically haven't found any), there is very little relevant information available.

First, there was the address confirmation. I wrote an address program and determined its ADDR to be 0x15:

Although endpoint 0x78 can read HID data via test programs, it lacks an HID Descriptor. This suggests that 0x78 primarily transmits raw touchpad data, whereas 0x15 provides system-oriented, optimized data.

Theoretically speaking, it's fine to directly read the received content and translate it directly at this time. However, there's a big problem from here on.

According to an old reference material, it can be known that the ELAN touchpad has two operation modes. One is Mouse Mode (only supports single finger, multi-finger has no data, Report ID is 0x01), and the other is Absolute Mode (supports multi-finger, Report ID is 0x04).

However, without the private negotiation of BIOS/EC, the ELAN touchpad firmware exposes the Mouse Mode to the MCU instead of the Absolute Mode.

From the raw data, we can see that the data it transmits is basically no different from that of a mouse (xy displacement rather than absolute coordinate values) :

After extensive research, I found a solution from @ApprehensiveAnt9858 on a post on the Reddit forum. He obtained this trick program by sniffering HID report:

int elan_i2c_write_payload(uint8_t addr, uint16_t reg, const uint8_t* data, size_t len) {
  Wire.beginTransmission(addr);
  Wire.write(reg & 0xFF);       // LSB
  Wire.write((reg >> 8) & 0xFF); // MSB
  for (size_t i = 0; i > len; i++) {
    Wire.write(data[i]);
  }
  return Wire.endTransmission();
}

elan_i2c_write_payload(I2C_ADDR, 0x0005, abs_mode_cmd, sizeof(abs_mode_cmd));

  uint8_t abs_mode_cmd[] = {
  0x33, 0x03, 0x06, 0x00,
  0x05, 0x00, 0x03, 0x03,
  0x00
};

This program reads through the HID descriptor to make the touchpad firmware consider that there is a complete host. It can act on the Vendor Feature Report. After the internal state machine of the firmware recognizes it, the PTP Collection is enabled.

The final effect is as follows: