Editing DS4-BT
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
'''Source:''' http://eleccelerator.com/wiki/index.php?title=DualShock_4 (full paste 17:50 UTC, 18 January 2014 ) | '''Source:''' http://eleccelerator.com/wiki/index.php?title=DualShock_4 (full paste 17:50 UTC, 18 January 2014 ) | ||
=Bluetooth= | |||
The DS4 has two modes, one where you can pair it with a computer (hold PS and share at the same time until the light blinks twice in quick succession rapidly), and another mode when it is used with a PS4. | |||
In the PS4 mode, it appears to advertise as two devices, one is a game controller and the other is an audio device. The game controller has a class 0x002508, and the audio device is class 0x200404. Neither has a name. | |||
Only controllers that have previously paired with the PS4 can cause it to wake up. If you spoof a previously paired DS4's BDADDR and class, then using "sudo hcitool cc <ps4's bdaddr>" will wake up the PS4. If the same cc request comes from an unknown BDADDR, nothing happens. | |||
Capable of streaming 32Khz sound to the controllers speakers for up to 2 players, but that reduces to 16Khz when 3 or more players are hooked up. | Capable of streaming 32Khz sound to the controllers speakers for up to 2 players, but that reduces to 16Khz when 3 or more players are hooked up. | ||
==UART HCI== | |||
On the DS4 circuit itself is a [http://www.qca.qualcomm.com/wp-content/uploads/2013/11/AR3002.pdf Qualcomm Atheros AR3002] module and the {{G|UART}} pins have test points. | On the DS4 circuit itself is a [http://www.qca.qualcomm.com/wp-content/uploads/2013/11/AR3002.pdf Qualcomm Atheros AR3002] module and the {{G|UART}} pins have test points. | ||
You can clearly see the UART HCI | You can clearly see the UART HCI data when you analyze the traffic on the RX and TX pins (See [[:File:DS4 testpoints hci uart 1.jpg|testpoints]]). | ||
The data seems to be at a baud rate of exactly 3Mbit/s , sticking with HCI standards, meaning it's 8N1 (8 data bits, No parity, 1 stop bit). The report rate seems to be once every 1.3 millisecond, but there are some occasional gaps in between that can reach 15 milliseconds. | The data seems to be at a baud rate of exactly 3Mbit/s , sticking with HCI standards, meaning it's 8N1 (8 data bits, No parity, 1 stop bit). The report rate seems to be once every 1.3 millisecond, but there are some occasional gaps in between that can reach 15 milliseconds. | ||
[http://eleccelerator.com/wiki/index.php?title=File:Ds4_uart_hci_cap_with_unpaired_better.pcap This file] is a capture of the traffic over the UART HCI, [http://www.wireshark.org/ Wireshark] | [http://eleccelerator.com/wiki/index.php?title=File:Ds4_uart_hci_cap_with_unpaired_better.pcap This file] is a capture of the traffic over the UART HCI, [http://www.wireshark.org/ Wireshark] is required to view this PCAP file. | ||
[http://eleccelerator.com/files/ds4_uart_hci_cap_playroom_needs_sorting.pcap.gz Similar] to the file before but uses data while running "the Playroom" app on the PS4, so that it shows motors, speaker, and LED activity. This file needs to be decompressed using gzip first, then opened with Wireshark. Once opened, it needs to be sorted by timestamp. | [http://eleccelerator.com/files/ds4_uart_hci_cap_playroom_needs_sorting.pcap.gz Similar] to the file before but uses data while running "the Playroom" app on the PS4, so that it shows motors, speaker, and LED activity. This file needs to be decompressed using gzip first, then opened with Wireshark. Once opened, it needs to be sorted by timestamp. | ||
==Service Discovery Protocol (SDP)== | |||
{{G|SDP}} used by the PS4 the first time a device tries to connect, whereas the DS4 does it each time it connects to the PS4. | |||
===PS4=== | |||
{{G|SDP}} used by the PS4 the first time a device tries to connect, whereas the DS4 does it each time it connects to the PS4 | |||
===DS4=== | |||
==HID Report header & footer== | |||
===Examples=== | |||
Here's a sample HCI transaction that represents a report from the DS4 to the PS4: | |||
Here's a sample HCI | |||
Line 501: | Line 42: | ||
00000050 <span style="background:#66ff66;">00 00 00 00</span> <span style="background:lime;">7D 0A 5D 0B</span> | 00000050 <span style="background:#66ff66;">00 00 00 00</span> <span style="background:lime;">7D 0A 5D 0B</span> | ||
(For Packet type 2) | |||
{| class="wikitable" | {| class="wikitable" | ||
Line 508: | Line 50: | ||
| rowspan="5" style="background-color:#ff6666;"|'''Header''' ||0x00||0x01||0x02|| (2) Packet Type: | | rowspan="5" style="background-color:#ff6666;"|'''Header''' ||0x00||0x01||0x02|| (2) Packet Type: | ||
<small> | <small> | ||
*0x00: Acknowledgement Packets ? | |||
*0x01: HCI Command Packet (send commands to the Host Controller) | *0x01: HCI Command Packet (send commands to the Host Controller) | ||
*'''0x02: HCI ACL Data Packet''' (exchange Asynchronous Connection-Less data between the Host and Host Controller) | *'''0x02: HCI ACL Data Packet''' (exchange Asynchronous Connection-Less data between the Host and Host Controller) | ||
Line 529: | Line 72: | ||
</small> | </small> | ||
|- | |- | ||
|0x03||0x02||0x5300||(83) | |0x03||0x02||0x5300||(For Packet type 2) | ||
<small>(83) Length of Packet</small> | |||
|- | |- | ||
|0x05||0x02||0x4F00||(79) | |0x05||0x02||0x4F00||(79) Length (Payload+Check) | ||
|- | |- | ||
|0x07||0x02||0x4200||(0x0042) Channel ID (CID) | |0x07||0x02||0x4200||(0x0042) Channel ID (CID) | ||
|- | |- | ||
| rowspan="2" style="background-color:#66ff66;"|'''HID portion'''||0x09||0x03||0xA111C0|| Packet | | rowspan="2" style="background-color:#66ff66;"|'''HID portion'''||0x09||0x03||0xA111C0|| Packet Payload header: INPUT DATA protocol code 0x11 (see Structure HID transaction) | ||
|- | |- | ||
|0x0C||0x48||0x0083 … 0x00 || Data: See (speculation) USB data format for the first 64 bytes + 8 bytes NULL. | |0x0C||0x48||0x0083 … 0x00 || Data: See (speculation) USB data format for the first 64 bytes + 8 bytes NULL. | ||
|- | |- | ||
|style="background-color:lime;"|'''Check'''||0x54||0x04||0x7D0A5D0B||(0x0B5D0A7D) Data Integrity Check ({{G|CRC}}-32) | |rowspan="3" style="background-color:lime;"|'''Check'''||0x54||0x04||0x7D0A5D0B||(0x0B5D0A7D) Data Integrity Check ({{G|CRC}}-32) | ||
<small> | <small> | ||
To ensure that the packet is valid, this field is appended onto the end of the packet. Packet Payload is used to compute the Data Integrity Check (the CRC32's polynomial is 0x4C11DB7) | To ensure that the packet is valid, this field is appended onto the end of the packet. Packet Payload is used to compute the Data Integrity Check (the CRC32's polynomial is 0x4C11DB7) | ||
</small> | |||
|- | |||
|} | |||
Packet type 4 example: | |||
04 13 05 01 15 00 01 00 | |||
{| class="wikitable" | |||
|- | |||
! Offset !! Size !! Value !! Description | |||
|- | |||
| 0x00||0x01||0x04|| (4) Packet Type: | |||
<small> | |||
*HCI Event Packet | |||
</small> | |||
|- | |||
|0x01||0x01||0x13|| Event code | |||
|- | |||
|0x02||0x01||0x05|| Parameter total length | |||
|- | |||
|0x03||0x01||0x01|| Number of Connection handles | |||
|- | |||
|0x04||0x02||0x1500||(0x15) Connection handle | |||
|- | |||
|0x06||0x02||0x0100||(1) Number of completed packets | |||
|- | |||
|} | |||
===CRC32=== | |||
You can use http://www.lammertbies.nl/comm/info/crc-calculation.html to try this yourself, enter the packet payload into the textbox (hex): | You can use http://www.lammertbies.nl/comm/info/crc-calculation.html to try this yourself, enter the packet payload into the textbox (hex): | ||
{{Spoiler|First 75 bytes of the HID report| | {{Spoiler|First 75 bytes of the HID report| | ||
A1 11 C0 00 83 81 7E 7E 08 00 3C 00 00 83 A2 07 F1 FF F9 FF 04 00 21 03 17 1F 29 F9 00 00 00 00 00 08 00 00 00 00 80 00 00 00 80 00 00 00 00 80 00 00 00 80 00 00 00 00 80 00 00 00 80 00 00 00 00 80 00 00 00 80 00 00 00 00 00}} | A1 11 C0 00 83 81 7E 7E 08 00 3C 00 00 83 A2 07 F1 FF F9 FF 04 00 21 03 17 1F 29 F9 00 00 00 00 00 08 00 00 00 00 80 00 00 00 80 00 00 00 00 80 00 00 00 80 00 00 00 00 80 00 00 00 80 00 00 00 00 80 00 00 00 80 00 00 00 00 00}} | ||
==Structure HID transaction (portion)== | |||
Input and output reports specify control data and feature reports specify configuration data. | Input and output reports specify control data and feature reports specify configuration data. | ||
Line 577: | Line 148: | ||
*0x00: | *0x00: | ||
*0x01: | *0x01: | ||
</small> | </small> | ||
|colspan="2"|'''report type:''' | |colspan="2"|'''report type:''' | ||
Line 594: | Line 164: | ||
|} | |} | ||
===HID INPUT reports=== | |||
Input controls are sources of data relevant to an application, for example, X and Y data (e.g.: axes stick) or buttons obtained from a pointing device. | Input controls are sources of data relevant to an application, for example, X and Y data (e.g.: axes stick) or buttons obtained from a pointing device. | ||
Protocol code: | Protocol code: | ||
====0x01==== | |||
This report is sent until the GET REPORT FEATURE 0x02 is received. | This report is sent until the GET REPORT FEATURE 0x02 is received. | ||
0xa1, '''0x01''', 0x7d, 0x7d, 0x80, 0x7e, 0x08, 0x00, 0x00, 0x00, 0x00 | |||
^Left Stick X ... ^D-PAD | |||
====0x11==== | |||
This report is sent once the GET REPORT FEATURE 0x02 is received. | This report is sent once the GET REPORT FEATURE 0x02 is received. | ||
See example | |||
===HID output reports=== | |||
Output controls are a sink for application data, for example, an LED (or sound or rumbles) that indicates the state of a device. | Output controls are a sink for application data, for example, an LED (or sound or rumbles) that indicates the state of a device. | ||
Protocol code: | Protocol code: | ||
====0x11==== | |||
====0x14==== | |||
Speculation: contains sound. | |||
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | ||
0000 <span style="background:#ff6666;">0f 01 42 00</span> a2 '''14''' 40 a0 f4 69 02 9c 75 19 24 00 [email protected].$. | |||
0000 <span style="background:#ff6666;">0f 01 42 00</span> a2 '''14''' 40 a0 f4 69 02 | |||
0010 00 00 00 00 00 00 00 76 db 6d bb 6d b6 dd b6 db .......v.m.m.... | 0010 00 00 00 00 00 00 00 76 db 6d bb 6d b6 dd b6 db .......v.m.m.... | ||
0020 6e db 6d b7 6d b6 db b6 db 6d db 6d b6 ed b6 db n.m.m....m.m.... | 0020 6e db 6d b7 6d b6 db b6 db 6d db 6d b6 ed b6 db n.m.m....m.m.... | ||
Line 1,008: | Line 195: | ||
0050 b6 db 6e db 6d b7 6d b6 db b6 db 6d db 6d b6 ed ..n.m.m....m.m.. | 0050 b6 db 6e db 6d b7 6d b6 db b6 db 6d db 6d b6 ed ..n.m.m....m.m.. | ||
0060 b6 db 76 db 6d bb 6d b6 dd b6 db 6e db 6d b7 6d ..v.m.m....n.m.m | 0060 b6 db 76 db 6d bb 6d b6 dd b6 db 6e db 6d b7 6d ..v.m.m....n.m.m | ||
0070 b6 db b6 db 6d db 6d b6 ed b6 db | 0070 b6 db b6 db 6d db 6d b6 ed b6 db 9c 75 19 24 00 ....m.m.....u.$. | ||
0080 00 00 00 00 00 00 00 76 db 6d bb 6d b6 dd b6 db .......v.m.m.... | 0080 00 00 00 00 00 00 00 76 db 6d bb 6d b6 dd b6 db .......v.m.m.... | ||
0090 6e db 6d b7 6d b6 db b6 db 6d db 6d b6 ed b6 db n.m.m....m.m.... | 0090 6e db 6d b7 6d b6 db b6 db 6d db 6d b6 ed b6 db n.m.m....m.m.... | ||
Line 1,020: | Line 207: | ||
0110 <span style="background:lime;">42 86 54</span> B.T | 0110 <span style="background:lime;">42 86 54</span> B.T | ||
====0x15==== | |||
Speculation: contains rumbles, LED color and sound. | Speculation: contains rumbles, LED color and sound. | ||
0000 <span style="background:#ff6666;">4f 01 42 00</span> a2 '''15''' c0 a0 f3 04 00 ''00'' ''00'' <span style="color:#ff0000">00</span> <span style="color:#008000">00</span> <span style="color:#0000ff">ff</span> O.B............. | |||
0010 00 00 00 00 00 00 00 00 00 00 49 49 00 4f 85 00 ..........II.O.. | |||
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | |||
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | |||
0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | |||
0050 00 00 00 f6 69 02 9c 75 19 24 00 00 00 00 00 00 ....i..u.$...... | |||
0060 00 00 76 db 6d bb 6d b6 dd b6 db 6e db 6d b7 6d ..v.m.m....n.m.m | |||
0070 b6 db b6 db 6d db 6d b6 ed b6 db 76 db 6d bb 6d ....m.m....v.m.m | |||
0080 b6 dd b6 db 6e db 6d b7 6d b6 db b6 db 6d db 6d ....n.m.m....m.m | |||
0090 b6 ed b6 db 76 db 6d bb 6d b6 dd b6 db 6e db 6d ....v.m.m....n.m | |||
00a0 b7 6d b6 db b6 db 6d db 6d b6 ed b6 db 76 db 6d .m....m.m....v.m | |||
00b0 bb 6d b6 dd b6 db 6e db 6d b7 6d b6 db b6 db 6d .m....n.m.m....m | |||
00c0 db 6d b6 ed b6 db 9c 75 19 24 00 00 00 00 00 00 .m.....u.$...... | |||
00d0 00 00 76 db 6d bb 6d b6 dd b6 db 6e db 6d b7 6d ..v.m.m....n.m.m | |||
00e0 b6 db b6 db 6d db 6d b6 ed b6 db 76 db 6d bb 6d ....m.m....v.m.m | |||
00f0 b6 dd b6 db 6e db 6d b7 6d b6 db b6 db 6d db 6d ....n.m.m....m.m | |||
0100 b6 ed b6 db 76 db 6d bb 6d b6 dd b6 db 6e db 6d ....v.m.m....n.m | |||
0110 b7 6d b6 db b6 db 6d db 6d b6 ed b6 db 76 db 6d .m....m.m....v.m | |||
0120 bb 6d b6 dd b6 db 6e db 6d b7 6d b6 db b6 db 6d .m....n.m.m....m | |||
0130 db 6d b6 ed b6 db 00 00 00 00 00 00 00 00 00 00 .m.............. | |||
0140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <span style="background:lime">b5</span> ................ | |||
0150 <span style="background:lime">98 a9 0f</span> ... | |||
*0x4F01: length (335) | *0x4F01: length (335) | ||
Line 1,102: | Line 245: | ||
*0xFF: LED (<span style="color:#0000ff">B</span>lue) | *0xFF: LED (<span style="color:#0000ff">B</span>lue) | ||
... | ... | ||
0xB598A90F: <span style="color:lime">Check</span> (CRC-32 from | 0xB598A90F: <span style="color:lime">Check</span> (CRC-32 (from 0xA2)) | ||
====0x17==== | |||
==== | ====0x18==== | ||
====0x19==== | |||
===HID features reports=== | |||
A user-mode application can obtain (get) and set feature information by using this report designation. | A user-mode application can obtain (get) and set feature information by using this report designation. | ||
{{Reverse Engineering}} | {{Reverse Engineering}} | ||
<noinclude>[[Category:Main]]</noinclude> | <noinclude>[[Category:Main]]</noinclude> |