Editing DS4-BT
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
'''Source:''' http://eleccelerator.com/wiki/index.php?title=DualShock_4 (full paste 17:50 UTC, 18 January 2014 ) | '''Source:''' http://eleccelerator.com/wiki/index.php?title=DualShock_4 (full paste 17:50 UTC, 18 January 2014 ) | ||
== Bluetooth == | == Bluetooth == | ||
Bluetooth is a wireless technology for creating personal networks operating in the 2.4 GHz unlicensed band, with a range of 10 meters. | |||
The [[DualShock 4]] has two modes, one where you can pair it with a computer (hold PS and share at the same time until the light blinks twice in quick succession rapidly), and another mode when it is used with a PS4. | The [[DualShock 4]] has two modes, one where you can pair it with a computer (hold PS and share at the same time until the light blinks twice in quick succession rapidly), and another mode when it is used with a PS4. | ||
In the PS4 mode, it appears to advertise as two devices (neither has a name), one is a game controller and the other is an audio device: | |||
In the PS4 mode, | |||
The game controller has a [https://www.bluetooth.org/en-us/specification/assigned-numbers/baseband class of Device/Service (CoD)] 0x002508: | The game controller has a [https://www.bluetooth.org/en-us/specification/assigned-numbers/baseband class of Device/Service (CoD)] 0x002508: | ||
Line 103: | Line 22: | ||
<small>(Online Generator http://bluetooth-pentest.narod.ru/software/bluetooth_class_of_device-service_generator.html)</small> | <small>(Online Generator http://bluetooth-pentest.narod.ru/software/bluetooth_class_of_device-service_generator.html)</small> | ||
Only controllers that have previously paired with the PS4 can cause it to wake up. If you spoof a previously paired DS4's BDADDR (is the unique address of a Bluetooth device, similar to the MAC address of a network card) and class, then using "sudo hcitool cc <ps4's bdaddr>" will wake up the PS4. If the same cc request comes from an unknown BDADDR, nothing happens. | |||
Capable of streaming 32Khz sound to the controllers speakers for up to 2 players, but that reduces to 16Khz when 3 or more players are hooked up. | |||
=== | ===UART HCI=== | ||
On the DS4 circuit itself is a [http://www.qca.qualcomm.com/wp-content/uploads/2013/11/AR3002.pdf Qualcomm Atheros AR3002] module and the {{G|UART}} pins have test points. | |||
You can clearly see the UART HCI data when you analyze the traffic on the RX and TX pins (See [[:File:DS4 testpoints hci uart 1.jpg|testpoints]]). | |||
The data seems to be at a baud rate of exactly 3Mbit/s , sticking with HCI standards, meaning it's 8N1 (8 data bits, No parity, 1 stop bit). The report rate seems to be once every 1.3 millisecond, but there are some occasional gaps in between that can reach 15 milliseconds. | |||
[http://eleccelerator.com/wiki/index.php?title=File:Ds4_uart_hci_cap_with_unpaired_better.pcap This file] is a capture of the traffic over the UART HCI, [http://www.wireshark.org/ Wireshark] is required to view this PCAP file. | |||
[http://eleccelerator.com/files/ds4_uart_hci_cap_playroom_needs_sorting.pcap.gz Similar] to the file before but uses data while running "the Playroom" app on the PS4, so that it shows motors, speaker, and LED activity. This file needs to be decompressed using gzip first, then opened with Wireshark. Once opened, it needs to be sorted by timestamp. | |||
=== Service Discovery Protocol (SDP) === | |||
{{G|SDP}} used by the PS4 the first time a device tries to connect, whereas the DS4 does it each time it connects to the PS4. | |||
==== PS4 ==== | ==== PS4 ==== | ||
<small>(without header (0x02 0x15 0x20 0x5C 0x01 0x58 0x01 0x40 0x00), see header section)</small> | |||
<small>(without | |||
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | ||
Line 254: | Line 79: | ||
<div style="height:350px; width:650px; overflow:auto"> | <div style="height:350px; width:650px; overflow:auto"> | ||
*<span style="background:#66ff66;">07</span> | *<span style="background:#66ff66;">07</span> Bluetooth SDP Protocol Data Unit (PDU): Service Search Attribute Response (0x7) | ||
<small>Service Search Attribute Request (0x6)</small> | |||
*<span style="background:#66ff66;">00 01</span> Transaction ID | *<span style="background:#66ff66;">00 01</span> Transaction ID | ||
*<span style="background:#66ff66;">01 53</span> Length | *<span style="background:#66ff66;">01 53</span> Length | ||
*<span style="background:#66ff66;">01 50</span> Length | *<span style="background:#66ff66;">01 50</span> Length | ||
*<span style="background:#ff66ff;">36| 01 4D</span> | *<span style="background:#ff66ff;">36| 01 4D</span> Metadata| Length | ||
Line 268: | Line 95: | ||
{0x010005 (65541)} | {0x010005 (65541)} | ||
*<span style="background:#96CDCD;">0x0001</span> Service Class ID List-->value: | *<span style="background:#96CDCD;">0x0001</span> Service Class ID List-->value: | ||
{<span style="background:#008080;">0x110A</span> Audio Source} | {<span style="background:#008080;">0x110A</span> Audio Source} | ||
*<span style="background:#96CDCD;">0x0004</span> Protocol Descriptor List-->value: | *<span style="background:#96CDCD;">0x0004</span> Protocol Descriptor List-->value: | ||
{<span style="background:#808080;">0x0100</span> L2CAP , 0x0019 } ,{ <span *style="background:#808080;">0x0019</span> Audio/Video Distribution Transport Protocol (AVDTP) , 0x0102 (258)} | {<span style="background:#808080;">0x0100</span> L2CAP , 0x0019 } ,{ <span *style="background:#808080;">0x0019</span> Audio/Video Distribution Transport Protocol (AVDTP) , 0x0102 (258)} | ||
Line 279: | Line 106: | ||
{ 0x010006 (65542) } | { 0x010006 (65542) } | ||
*<span style="background:#96CDCD;">0x0001</span> Service Class ID List-->value: | *<span style="background:#96CDCD;">0x0001</span> Service Class ID List-->value: | ||
{ <span style="background:#008080;">0x110B</span> Audio Sink } | { <span style="background:#008080;">0x110B</span> Audio Sink } | ||
*<span style="background:#96CDCD;">0x0004</span> Protocol Descriptor List-->value: | *<span style="background:#96CDCD;">0x0004</span> Protocol Descriptor List-->value: | ||
{ <span style="background:#808080;">0x0100</span> L2CAP , 0x0019 (25) } , { <span style="background:#808080;">0x0019</span> Audio/Video Distribution Transport Protocol (AVDTP) , 0x0102 (258) } | { <span style="background:#808080;">0x0100</span> L2CAP , 0x0019 (25) } , { <span style="background:#808080;">0x0019</span> Audio/Video Distribution Transport Protocol (AVDTP) , 0x0102 (258) } | ||
Line 292: | Line 119: | ||
{ <span style="background:#008080;">0x110E</span> Audio/Video Remote Control , <span style="background:#008080;">0x110F</span> Video Conferencing / A/V Remote Control Controller } | { <span style="background:#008080;">0x110E</span> Audio/Video Remote Control , <span style="background:#008080;">0x110F</span> Video Conferencing / A/V Remote Control Controller } | ||
<ref> | <ref> | ||
<small>The Audio/Video Remote Control Profile (AVRCP) specification v1.3 and later require that 0x110E also be included in the ServiceClassIDList before 0x110F for backwards compatibility</small> | <small>(NOTE: The Audio/Video Remote Control Profile (AVRCP) specification v1.3 and later require that 0x110E also be included in the ServiceClassIDList before 0x110F for backwards compatibility)</small> | ||
</ref> | </ref> | ||
*<span style="background:#96CDCD;">0x0004</span> Protocol Descriptor List-->value: | *<span style="background:#96CDCD;">0x0004</span> Protocol Descriptor List-->value: | ||
Line 329: | Line 156: | ||
*<span style="background:#96CDCD;">0x0200</span> Specification ID-->value: | *<span style="background:#96CDCD;">0x0200</span> Specification ID-->value: | ||
{ 0x0103 (259) } | { 0x0103 (259) } | ||
*<span style="background:#96CDCD;">0x0201</span> Vendor ID<ref | *<span style="background:#96CDCD;">0x0201</span> Vendor ID<ref>See [[DS4-USB|Device Descriptor]]</ref>-->value: | ||
{ 0x054C } (Sony Corp.) | { 0x054C } (Sony Corp.) | ||
*<span style="background:#96CDCD;">0x0202</span> Product ID-->value: | *<span style="background:#96CDCD;">0x0202</span> Product ID-->value: | ||
Line 339: | Line 166: | ||
*<span style="background:#96CDCD;">0x0205</span> Vendor ID Source-->value: | *<span style="background:#96CDCD;">0x0205</span> Vendor ID Source-->value: | ||
{ 0x0002 } | { 0x0002 } | ||
===== Notes: ===== | |||
{{reflist}} | |||
</div><br /> | </div><br /> | ||
==== DS4 ==== | ==== DS4 ==== | ||
This response is 708-byte long: the DS4 does not respect the 672-byte outgoing L2CAP MTU. | This response is 708-byte long: the DS4 does not respect the 672-byte outgoing L2CAP MTU. | ||
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | ||
00000000 07 00 01 02 BF 02 BC 36 02 B9 36 | 00000000 07 00 01 02 BF 02 BC 36 02 B9 36 02 61 09 00 00 ....¿.¼6.¹6.a... | ||
00000010 0A 00 01 00 01 09 00 01 35 03 19 11 24 09 00 04 ........5...$... | 00000010 0A 00 01 00 01 09 00 01 35 03 19 11 24 09 00 04 ........5...$... | ||
00000020 35 0D 35 06 19 01 00 09 00 11 35 03 19 00 11 09 5.5.......5..... | 00000020 35 0D 35 06 19 01 00 09 00 11 35 03 19 00 11 09 5.5.......5..... | ||
Line 385: | Line 216: | ||
00000240 08 35 06 09 04 09 09 01 00 09 02 08 28 00 09 02 .5..........(... | 00000240 08 35 06 09 04 09 09 01 00 09 02 08 28 00 09 02 .5..........(... | ||
00000250 09 28 01 09 02 0A 28 01 09 02 0B 09 01 00 09 02 .(....(......... | 00000250 09 28 01 09 02 0A 28 01 09 02 0B 09 01 00 09 02 .(....(......... | ||
00000260 0C 09 1F 40 09 02 0D 28 00 09 02 0E 28 00 36 | 00000260 0C 09 1F 40 09 02 0D 28 00 09 02 0E 28 00 36 00 ...@...(....(.6. | ||
00000270 | 00000270 52 09 00 00 0A 00 01 00 02 09 00 01 35 03 19 12 R...........5... | ||
00000280 00 09 00 04 35 0D 35 06 19 01 00 09 00 01 35 03 ....5.5.......5. | 00000280 00 09 00 04 35 0D 35 06 19 01 00 09 00 01 35 03 ....5.5.......5. | ||
00000290 19 00 01 09 00 09 35 08 35 06 19 12 00 09 01 03 ......5.5....... | 00000290 19 00 01 09 00 09 35 08 35 06 19 12 00 09 01 03 ......5.5....... | ||
Line 393: | Line 224: | ||
000002C0 09 '''00 02''' 00 .... | 000002C0 09 '''00 02''' 00 .... | ||
Specification ID 0x0200-->value: 0x0103 | |||
Vendor ID 0x0201-->value: 0x054C Vendor ID (VID) (Sony Corp.) | |||
Product ID 0x0202-->value: 0x05C4 (Sony Computer Entertainment Wireless Controller) | |||
Version 0x0203-->value: 0x0100 | |||
Primary Record 0x0204-->value: 0x01 | |||
Vendor ID Source 0x0205-->value: 0x0002 | |||
=== HID Report header & footer === | |||
==== Examples ==== | |||
Here's a sample HCI ACL Data Packet transaction that represents a report from the DS4 to the PS4: | |||
<span style="background:# | Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | ||
00000000 <span style="background:#ff6666;">02 15 20 53 00 4F 00 42 00</span> <span style="background:#66ff66;">A1 11 C0 00 83 81 7E</span> | |||
00000010 <span style="background:#66ff66;">7E 08 00 3C 00 00 83 A2 07 F1 FF F9 FF 04 00 21</span> | |||
00000020 <span style="background:#66ff66;">03 17 1F 29 F9 00 00 00 00 00 08 00 00 00 00 80</span> | |||
00000030 <span style="background:#66ff66;">00 00 00 80 00 00 00 00 80 00 00 00 80 00 00 00</span> | |||
00000040 <span style="background:#66ff66;">00 80 00 00 00 80 00 00 00 00 80 00 00 00 80 00</span> | |||
00000050 <span style="background:#66ff66;">00 00 00 00</span> <span style="background:lime;">7D 0A 5D 0B</span> | |||
{| class="wikitable" | |||
* | |- | ||
* | ! !! Offset !! Size !! Value !! Description | ||
* | |- | ||
| rowspan="5" style="background-color:#ff6666;"|'''Header''' ||0x00||0x01||0x02|| (2) Packet Type: | |||
<small> | |||
*0x01: HCI Command Packet (send commands to the Host Controller) | |||
*'''0x02: HCI ACL Data Packet''' (exchange Asynchronous Connection-Less data between the Host and Host Controller) | |||
*0x03: HCI SCO Data Packet (exchange Synchronous Connection-Oriented data) | |||
*0x04: HCI Event Packet (notify the Host when events occur) | |||
</small> | |||
|- | |||
|0x01||0x02||0x1520|| (0x2015) Control information (<sub>msb</sub>00 10 000000010101<sub>lsb</sub>): | |||
==== | '''for Packet type: 2''' | ||
{{ | <small> | ||
*Broadcast (BC) flag (most significant 2 bits): | |||
'''00 = point-to-point packet''' (no broadcast) (only two Bluetooth units involved) | |||
01 = Active Slave Broadcast (Up to 7 slaves can be active in the {{G|Piconet}}) | |||
10 = Parked Slave Broadcast (Up to 255 further slave devices can be inactive) | |||
*Packet boundary (PB) flag (2 bits): | |||
01 = continuing packet of a higher level message | |||
'''10 = first packet of a higher level message''' | |||
*Connection handle (least significant 12 bits): | |||
0x15 | |||
</small> | |||
|- | |||
|0x03||0x02||0x5300||(83) Length of Packet | |||
|- | |||
|0x05||0x02||0x4F00||(79) Length (Payload+Check) | |||
|- | |||
|0x07||0x02||0x4200||(0x0042) [[:File:BT-Wifi-channels.png|Channel ID]] (CID) | |||
|- | |||
| rowspan="2" style="background-color:#66ff66;"|'''HID portion'''||0x09||0x03||0xA111C0|| Packet Payload header: INPUT DATA protocol code 0x11 (see Structure HID transaction) | |||
|- | |||
|0x0C||0x48||0x0083 … 0x00 || Data: See (speculation) USB data format for the first 64 bytes + 8 bytes NULL. | |||
|- | |||
|rowspan="3" style="background-color:lime;"|'''Check'''||0x54||0x04||0x7D0A5D0B||(0x0B5D0A7D) Data Integrity Check ({{G|CRC}}-32) | |||
<small> | |||
To ensure that the packet is valid, this field is appended onto the end of the packet. Packet Payload is used to compute the Data Integrity Check (the CRC32's polynomial is 0x4C11DB7). | |||
You can use http://www.lammertbies.nl/comm/info/crc-calculation.html to try this yourself, enter the packet payload into the textbox (hex): | |||
{{Spoiler|First 75 bytes of the HID report| | |||
A1 11 C0 00 83 81 7E 7E 08 00 3C 00 00 83 A2 07 F1 FF F9 FF 04 00 21 03 17 1F 29 F9 00 00 00 00 00 08 00 00 00 00 80 00 00 00 80 00 00 00 00 80 00 00 00 80 00 00 00 00 80 00 00 00 80 00 00 00 00 80 00 00 00 80 00 00 00 00 00}} | |||
</small> | |||
|- | |||
|} | |||
{{Spoiler|HCI Command Packet example| | {{Spoiler|HCI Command Packet example| | ||
Line 458: | Line 319: | ||
</pre> | </pre> | ||
*0x01: HCI Command Packet | *0x01: HCI Command Packet (send commands to the Host Controller) | ||
*0x130C (0x0C13) Op-code (16 bits): identifies the command: | *0x130C (0x0C13) Op-code (16 bits): identifies the command: | ||
Line 489: | Line 350: | ||
}} | }} | ||
=== Structure HID transaction (portion) === | === Structure HID transaction (portion) === | ||
Line 577: | Line 378: | ||
*0x00: | *0x00: | ||
*0x01: | *0x01: | ||
</small> | </small> | ||
|colspan="2"|'''report type:''' | |colspan="2"|'''report type:''' | ||
Line 599: | Line 399: | ||
Protocol code: | Protocol code: | ||
===== 0x01 ===== | ===== 0x01 ===== | ||
This report is sent until the GET REPORT FEATURE 0x02 is received. | This report is sent until the GET REPORT FEATURE 0x02 is received. | ||
0xa1, '''0x01''', 0x7d, 0x7d, 0x80, 0x7e, 0x08, 0x00, 0x00, 0x00, 0x00 | |||
^Left Stick X ... ^D-PAD | |||
0x00, 0x00, 0x00 | |||
===== 0x11 ===== | ===== 0x11 ===== | ||
This report is sent once the GET REPORT FEATURE 0x02 is received. | This report is sent once the GET REPORT FEATURE 0x02 is received. | ||
See example | |||
==== HID output reports ==== | |||
==== HID | |||
Output controls are a sink for application data, for example, an LED (or sound or rumbles) that indicates the state of a device. | Output controls are a sink for application data, for example, an LED (or sound or rumbles) that indicates the state of a device. | ||
Protocol code: | Protocol code: | ||
===== 0x11 ===== | ===== 0x11 ===== | ||
===== 0x14 ===== | ===== 0x14 ===== | ||
Speculation: contains sound. | |||
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | ||
0000 <span style="background:#ff6666;">0f 01 42 00</span> a2 '''14''' 40 a0 f4 69 02 | 0000 <span style="background:#ff6666;">0f 01 42 00</span> a2 '''14''' 40 a0 f4 69 02 9c 75 19 24 00 [email protected].$. | ||
0010 00 00 00 00 00 00 00 76 db 6d bb 6d b6 dd b6 db .......v.m.m.... | 0010 00 00 00 00 00 00 00 76 db 6d bb 6d b6 dd b6 db .......v.m.m.... | ||
0020 6e db 6d b7 6d b6 db b6 db 6d db 6d b6 ed b6 db n.m.m....m.m.... | 0020 6e db 6d b7 6d b6 db b6 db 6d db 6d b6 ed b6 db n.m.m....m.m.... | ||
Line 1,008: | Line 426: | ||
0050 b6 db 6e db 6d b7 6d b6 db b6 db 6d db 6d b6 ed ..n.m.m....m.m.. | 0050 b6 db 6e db 6d b7 6d b6 db b6 db 6d db 6d b6 ed ..n.m.m....m.m.. | ||
0060 b6 db 76 db 6d bb 6d b6 dd b6 db 6e db 6d b7 6d ..v.m.m....n.m.m | 0060 b6 db 76 db 6d bb 6d b6 dd b6 db 6e db 6d b7 6d ..v.m.m....n.m.m | ||
0070 b6 db b6 db 6d db 6d b6 ed b6 db | 0070 b6 db b6 db 6d db 6d b6 ed b6 db 9c 75 19 24 00 ....m.m.....u.$. | ||
0080 00 00 00 00 00 00 00 76 db 6d bb 6d b6 dd b6 db .......v.m.m.... | 0080 00 00 00 00 00 00 00 76 db 6d bb 6d b6 dd b6 db .......v.m.m.... | ||
0090 6e db 6d b7 6d b6 db b6 db 6d db 6d b6 ed b6 db n.m.m....m.m.... | 0090 6e db 6d b7 6d b6 db b6 db 6d db 6d b6 ed b6 db n.m.m....m.m.... | ||
Line 1,019: | Line 437: | ||
0100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <span style="background:lime;">9f</span> ................ | 0100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <span style="background:lime;">9f</span> ................ | ||
0110 <span style="background:lime;">42 86 54</span> B.T | 0110 <span style="background:lime;">42 86 54</span> B.T | ||
===== 0x15 ===== | ===== 0x15 ===== | ||
Line 1,073: | Line 448: | ||
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | 0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | ||
0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | 0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | ||
0050 00 00 00 | 0050 00 00 00 f6 69 02 9c 75 19 24 00 00 00 00 00 00 ....i..u.$...... | ||
0060 00 00 76 db 6d bb 6d b6 dd b6 db 6e db 6d b7 6d ..v.m.m....n.m.m | 0060 00 00 76 db 6d bb 6d b6 dd b6 db 6e db 6d b7 6d ..v.m.m....n.m.m | ||
0070 b6 db b6 db 6d db 6d b6 ed b6 db 76 db 6d bb 6d ....m.m....v.m.m | 0070 b6 db b6 db 6d db 6d b6 ed b6 db 76 db 6d bb 6d ....m.m....v.m.m | ||
Line 1,080: | Line 455: | ||
00a0 b7 6d b6 db b6 db 6d db 6d b6 ed b6 db 76 db 6d .m....m.m....v.m | 00a0 b7 6d b6 db b6 db 6d db 6d b6 ed b6 db 76 db 6d .m....m.m....v.m | ||
00b0 bb 6d b6 dd b6 db 6e db 6d b7 6d b6 db b6 db 6d .m....n.m.m....m | 00b0 bb 6d b6 dd b6 db 6e db 6d b7 6d b6 db b6 db 6d .m....n.m.m....m | ||
00c0 db 6d b6 ed b6 db | 00c0 db 6d b6 ed b6 db 9c 75 19 24 00 00 00 00 00 00 .m.....u.$...... | ||
00d0 00 00 76 db 6d bb 6d b6 dd b6 db 6e db 6d b7 6d ..v.m.m....n.m.m | 00d0 00 00 76 db 6d bb 6d b6 dd b6 db 6e db 6d b7 6d ..v.m.m....n.m.m | ||
00e0 b6 db b6 db 6d db 6d b6 ed b6 db 76 db 6d bb 6d ....m.m....v.m.m | 00e0 b6 db b6 db 6d db 6d b6 ed b6 db 76 db 6d bb 6d ....m.m....v.m.m | ||
Line 1,102: | Line 477: | ||
*0xFF: LED (<span style="color:#0000ff">B</span>lue) | *0xFF: LED (<span style="color:#0000ff">B</span>lue) | ||
... | ... | ||
0xB598A90F: <span style="color:lime">Check</span> (CRC-32 from | 0xB598A90F: <span style="color:lime">Check</span> (CRC-32 (from 0xA2)) | ||
===== 0x17 ===== | ===== 0x17 ===== | ||
===== 0x18 ===== | ===== 0x18 ===== | ||
===== 0x19 ===== | ===== 0x19 ===== | ||
==== HID features reports ==== | ==== HID features reports ==== | ||
A user-mode application can obtain (get) and set feature information by using this report designation. | A user-mode application can obtain (get) and set feature information by using this report designation. | ||
{{Reverse Engineering}} | {{Reverse Engineering}} | ||
<noinclude>[[Category:Main]]</noinclude> | <noinclude>[[Category:Main]]</noinclude> |