greggersaurus / opensteamcontroller Goto Github PK
View Code? Open in Web Editor NEWSteam Controller reverse engineering and customization project.
Steam Controller reverse engineering and customization project.
Hello.The Steam Controller with the open fimware could be seen as a Switch Pro Controller which could be connected usb.
My question is if the code than Steam use for connect wireless with the usb wireless device/Steam Link could be used with the Switch Pro controller for allow use it wireless.
I know than the usb should be modded with other Pid,vid,.. but with the great sys-con atmosphere module it should no be difficult:
https://github.com/cathery/sys-con
Thanks
Tied notes end up as multiple separate notes (which actually ends up sounding different), rests aren't combined into one (just a waste of space), trailing rests aren't removed (same). Leading rests can also often be trimmed, but not always. Lots of room for easy condensing it down, which is extra important since we only got 1024 bytes to work with.
I tried hand-condensing my own collection of jingles. If you're hard pressed for space it's enough space to squeeze another jingle in. Savings are pretty decent. Over 12 songs I saved 120 bytes if I did my math right. Down to 972 from 1092, enough to get the existing songs under 1024 and enough to even add another on top of that.
Gonna try poking around with this over the next few days but I've never messed with C++ specifically so we'll see how far I get with that.
This is an issue to gather information about the HID Controller Interface protocol, as described here.
Look at #25 for my current progress.
Host->Controller:
Packet ID | Name | Controller Bootloader | Controller Firmware | Dongle | Description |
---|---|---|---|---|---|
0x80 | ⛔️ | ✅ | |||
0x81 | ExitLizardMode | ⛔️ | ✅ | ❓ | Exits the "lizard mode" - Tells the steam controller to acting like a dumb keyboard/mouse combo. Might need to be sent periodically? |
0x82 | ⛔️ | ✅ | |||
0x83 | ControllerInfoRequest | ✅ | ✅ | Asks the controller to send its ControllerInfo. | |
0x85 | ⛔️ | ✅ | |||
0x87 | SetSettings | ⛔️ | ✅ | ❓ | Sets the controller settings |
0x89 | ⛔️ | ✅ | |||
0x8d | ⛔️ | ✅ | |||
0x8e | ⛔️ | ✅ | |||
0x8f | TriggerHapticPulse | ⛔️ | ✅ | ||
0x90 | ReinvokeISP | ✅ | ✅ | ❓ | Reinvokes the LPC ISP Firmware (ISP being what happens when you boot while holding the right trigger). Seems to also work on the dongle? |
0x91 | EraseLPCFirmware | ✅ | ⛔️ | Erases the LPC firmware. | |
0x92 | FlashLPCFirmware | ✅ | ⛔️ | Flashes a chunk of LPC firmware. | |
0x93 | VerifyLPCFirmware | ✅ | ⛔️ | Finishes flashing the LPC firmware, and validates it against a checksum. | |
0x95 | ResetSOC | ✅ | ✅ | Restarts both LPC and NRF CPUs. | |
0x96 | SetPrngEntropy | ⛔️ | ⛔️ | ✅ | Sends a block of 0x10 random bytes to the device. |
0x97 | EraseNRFFirmware | ✅ | ✅ | (Supposedly, no RE) Erases the NRF Firmware | |
0x98 | FlashNRFFirmware | ✅ | ✅ | (Supposedly, no RE) Flashes a chunk of NRF Firmware | |
0x99 | VerifyNRFFirmware | ✅ | ✅ | (Supposedly, no RE) Finishes flashing the NRF firmware, and validates it against a checksum. | |
0x9a | ⛔️ | ✅ | Sends data to the nRF chip, wrapped in a packet ']'. | ||
0x9f | TurnOffController | ⛔️ | ✅ | ✅ | |
0xa7 | CalibrateTrackpads | ⛔️ | ✅ | ||
0xa9 | ⛔️ | ✅ | |||
0xa0 | SetHardwareVersion | ✅ | ⛔️ | THIS COMMAND IS EXTREMELY DANGEROUS | |
0xaa | ⛔️ | ✅ | |||
0xab | ⛔️ | ✅ | |||
0xac | ⛔️ | ✅ | |||
0xad | SetDonglePairingMode | ⛔️ | ⛔️ | ✅ | 2 byte args |
0xae | ControllerInfoRequest | ⛔️ | ✅ | ||
0xb1 | SetControllerKeyboardMouseInputState | ⛔️ | ⛔️ | ✅ | |
0xb2 | PairingFailed | ⛔️ | ⛔️ | ✅ | |
0xb3 | PairingSuccess | ⛔️ | ⛔️ | ✅ | |
0xb4 | GetControllerInfo | ⛔️ | ⛔️ | ✅ | |
0xb5 | CalibrateIMU | ⛔️ | ✅ | ||
0xb6 | PlayAudio | ⛔️ | ✅ | Plays the selected jingle | |
0xb7 | StartFlashJingle | ⛔️ | ✅ | Does something weird with the jingle_data_ptr 👀 | |
0xb8 | FlashJingle | ⛔️ | ✅ | Writes data to the jingle flash buffer | |
0xb9 | EndFlashJingle | ⛔️ | ✅ | Finishes flashing a jingle, writing it to eeprom after making sure it looks somewhat valid. | |
0xba | GetChipID | ⛔️ | ✅ | ||
0xbb | ReadUID | ⛔️ | ✅ | Returns the result of ISP ReadUID. | |
0xbf | CalibrateJoystick | ⛔️ | ✅ | Sets eeprom field 0x34 with some computed data | |
0xc1 | SetAudioMapping | ⛔️ | ✅ | Sets the jingle to play for various events | |
0xc5 | SetUserLedColor | ⛔️ | ⛔️ | ||
0xc6 | SendIRCode | ⛔️ | ⛔️ | ||
0xc7 | StopIR | ⛔️ | ⛔️ |
When sent from Host to Controller, takes no data and asks the controller to send its ControllerInfo.
When sent from Controller to Host: The additional data is an array of HardwareInfo, where HardwareInfo is a structure of one byte (Type) and 4 byte (Data). Here are the different types byte observed:
Type ID | Name | Bootloader | Description |
---|---|---|---|
1 | USB PID | ✅ | The same as the USB PID. Likely more useful for wireless transmission. |
2 | Unknown | ⛔️ | Firmware always returns 3 |
4 | Firmware Version | ✅ | Version/timestamp of the firmware running on the LPC side (e.g. 57bf5c10). |
5 | NRF Firmware Version | ⛔️ | Version/timestamp of the firmware running on the NRF side |
9 | Hardware Version | ✅ | Version of the controller hardware (as stored in EEPROM) |
10 | Unknown | ⛔️ | Firmware returns the data stored at DAT_10000078 |
When sent from Host to Controller: Sets the controller settings. The additional data is an array of ControllerSetting, where ControllerSetting is a structure of one byte (type) and 2 bytes (value). Here are some observed type bytes:
Type ID | Name | Description |
---|---|---|
0x3 | ? | |
0x8 | ? | Lizard mode related? Data is 7 when sent to dongle. |
0x2d | ? | Sent periodically |
Arguments:
Hello, I'm new to GitHub so please forgive me if this isn't the right way to communicate this. I'm trying to figure out how to get into the firmware code because I would like to make an edit to the trackpad sensitivity on the right. I'm not quite sure how to describe what I mean, but basically the trackpad is far to sensitive and reacts without me touching the trackpad.
Sorry if this is already answered somewhere, but I couldn't find it.
How much of original firmware binary is in Firmware/OpenSteamController? Is it a good starting point for fixing bugs/adding new features?
OS: Ubuntu 19.04
CPU: AMD Athlon X4 860k
QT Creator: 4.9.1
QT: 5.12.3
The program launches from QT creator without any issues, but attempting to convert a jingle results in one of my CPU cores staying at 100% from the program and the program hanging. The process never finishes.
MusicXML I'm trying to use: https://musescore.com/user/124018/scores/133609
I've tried other ones and the same result occurs.
EDIT: Fixed, I was using compressed musicxml files, not uncompressed.
Is there any support for relative controls? Like take the value of trackpadGetLastXY() on first touch = trackpadFirstXY, then replace the output to the result of percentage of [Square Root of {trackpadFirstXY - trackpadGetLastXY() } ]until the finger is released?
So that the output = the distance dragged.
If this isn't in the code already, what current fields output the XY coordinates? Can I make them a function like the one I referenced?
Of my three Steam controllers, only one has a left stick that works properly with the Switch firmware. One stick is miscalibrated to point slightly downwards when in resting position, and the other momentarily jitters upwards when held downwards. I have not noticed these issues while playing Steam games. The calibration menu in the Switch settings could solve my problems, but it opens a dialogue:
Stick calibration is not currently supported for this device.
Calibration may be possible after a system update.
While attempting to compile, the following issues occur;
Fatal error: chip.h: No such file or directory
make: ***[src/subdir.mk:38:src/board.o] Error 1
Not sure if there are plans for this already, but support for bluetooth would be awesome to see, especially for other with the switch lite. I know there is support for the BLE mode on the sc-controller project, that was rolled out after Valve rolled out the BLE mode.
Is it possible?
EDIT: actually, would it be plausible to merge parts of the OSC firmware into this to adjust settings while plugged into a pc?
Hello,the SteamController has the same technology for rumble as Nintendo Joycon and Nintendo Switch Pro Controller : linear resonant actuators.
It could be seen of several ways,but maybe the most interesting is a kind of "speaker" which could emulate textures,sensations..
One the best uses could be seen on the minigames from 1 2 Switch,in concrete the Kazuate game (ball counting)
It would amazing could port the files between the diferent formats. (They are more devices which use the tech and others which would be released as the dualshock 5 for playstation 5 next year).
The Steam Controller has them on their rom according this web
The Nintendo format is called "bnvib" and it has been reverse enginering.
it is created with a program than Nintendo included on their SDK using a wav file .Also,son same cases, they use an extra file on a format called "nvibcp" which give some description of how the sound must be converted.
I only has been seen this file once time while reverse enginering the minigame kazuake ,in concrete it seems was used to create the file "Kazuate_VIB_Rolling2_SlowReverse.bnvib".
Ctcaer also create the format "jcvib" which is the bnvib expanded ,as the controller is able to understand it directly.
According to Ctcaer :
"
The vibration data is encoded so every frequency and amplitude fit into a byte that joy-cons understand.these files are not sent to the joy-cons.They are parsed in the console,
Anyway, these files are not sent to the joy-cons .They are parsed in the console,decoded and sent to Joy-Cons re-encoded in a format they understand.
So this is real-time, not preloaded. .
Each packet sent to joycon can have maximum 8 bytes of vibration data. 4 for each one (left/right).
.bnvib is the official format and keeps the vibration into 4 uint8.
.jcvib is my coined format and it's raw. 4 uint8 that the controller can understand right away.
Ctcaer also checked the SteamControllerSinger and it's similar on what to do.
The only difference is what raw commands each controller understand and the frequency bandwidth of these.
Joy-con bandwidth is small:
Low freq band:
40.875 - 626.286Hz
High freq band:
81.751 - 1252.572Hz
So that's why you need to transport the notes to lower octaves until you are inside the range and then separate bass-mid and mid-high notes.
I can easily convert the frequencies but the amplitudes need a look up table,
because I haven't reverse engineered the algorithm behind it.
The encoding algorithm for frequency is -32*(log(2)-log(freq/5))/log(2)
The algorithm for amplitude is splitted in 3 range indexes (idx < 16, 16 <= idx < 32, idx < 128) and it's currently undecoded.
The amplitudes below are not safe for the integrity of the linear resonant actuators.
"
Here i post the links where i found the info (Also give thankd to CTCaer for give some explanations directly)
https://gbatemp.net/threads/tool-joy-con-toolkit.478560/
https://github.com/dekuNukem/Nintendo_Switch_Reverse_Engineering
expected response = "version\n\rOpenSteamController Ver 1.0.\n\r"
rcvd_response = "version\n\rOpenSteamController Ver 1.1.\n\r"
Can I just edit the local code to ask for 1.1?
If i use OpenSteamControllerNinSwitch.bin steam should detect controller?
If you will use "cat new_firmware.bin > /mount/CRP\ DISABLD/firmware.bin" on ubuntu(or similar linux) firmware will be corrupted and controller will not start.
To prevent it, use command:
dd conv=nocreat,notrunc oflag=direct bs=512 if=<path to your firmware> of=<path to sc flash>/firmware.bin
I'm completely new to this, so forgive me if I sound stupid, but is it possible to create a faux Xbox Controller so the SC could work as a system-wide XInput controller? If it is, how could I do this? Has anyone created one yet?
While using Nintendo Switch firmware my left control stick is slightly uncalibrated. It does not cause issue in most games but fortnite is another story. I recorded video that's presenting the problem. I can't calibrate it using switch, calibrated it using steam but nothing changed.
Here's the video: https://youtu.be/5J1X69yZNNo
Hey all,
I've been working on my own custom firmware for the Steam Controller, heavily helped by the documentation found here, but also by my own reverse engineering. In doing so, I have done a complete RE of the "bootloader" portion of the firmware (the first 0x2000 bytes of the official firmware) in Ghidra, and an (almsot) complete reimplementation in https://github.com/h1k421/steam_controller_custom_firmware/blob/master/bootloader (There are a couple small functions missing/commented out, but it's complete enough to boot a working firmware, and allow Steam to interact with it, do firmware updates, etc...).
I was wondering if you were interested in the RE database, and if so, where it should be PR'd to? Ghidra databases can be exported as a zip file (ideally) or as an XML (not as good, loses some information, but still relatively functional).
Furthermore, if anyone else is interested, I'm working on a similar complete RE of the rest of the firmware (with the similar goal of doing a complete, faithful reimplementation). The RE is done on a ghidra server, if anyone's interested in helping out, feel free to reach out by email at [email protected] or on the megaton-hammer discord.
(I really hope this doesn't come across as rude or intruding ^^').
Hi! I'm having trouble using the SCJingleConverter I tried downloading the Mingw-64 But it didn't work/may have downloaded the wrong one. After installing QT all I got was No suitable kits found.
Sorry to bug you on an old project, I hope you're still willing to help!
Let me know what to take pictures of!
Anyway to make a custom usb dongle that runs something similar to steams controller support hardware, so that it may be used and have all the utility it does on steam on separate devices (I.E. Xbox, Ps4, Switch, linux) I know there is a lot of custom software for linux support on non steam games, so maybe something like that to run between a system and the controller.
Hello!
I'm trying to restore the original firmware which I backed up before adding the Nintendo Switch firmware.
But my device does not show up anymore in Windows 10 when starting as instructed (Holding down Right trigger and plugging it in).
Help?
Any chance there is way to do this? I find myself constantly taking screenshots in Rocket League from muscle memory with the paddles on PC.
I also need support for Android TV OS and Android OS.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.