Editing DS4-BT
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
'''Source:''' http://eleccelerator.com/wiki/index.php?title=DualShock_4 (full paste 17:50 UTC, 18 January 2014 ) | '''Source:''' http://eleccelerator.com/wiki/index.php?title=DualShock_4 (full paste 17:50 UTC, 18 January 2014 ) | ||
== Bluetooth == | |||
The DS4 has two modes, one where you can pair it with a computer (hold PS and share at the same time until the light blinks twice in quick succession rapidly), and another mode when it is used with a PS4. | |||
In the PS4 mode, it appears to advertise as two devices, one is a game controller and the other is an audio device. The game controller has a class 0x002508, and the audio device is class 0x200404. Neither has a name. | |||
Only controllers that have previously paired with the PS4 can cause it to wake up. If you spoof a previously paired DS4's BDADDR and class, then using "sudo hcitool cc <ps4's bdaddr>" will wake up the PS4. If the same cc request comes from an unknown BDADDR, nothing happens. | |||
Capable of streaming 32Khz sound to the controllers speakers for up to 2 players, but that reduces to 16Khz when 3 or more players are hooked up. | Capable of streaming 32Khz sound to the controllers speakers for up to 2 players, but that reduces to 16Khz when 3 or more players are hooked up. | ||
===UART HCI=== | ===UART HCI=== | ||
On the DS4 circuit itself is a [http://www.qca.qualcomm.com/wp-content/uploads/2013/11/AR3002.pdf Qualcomm Atheros AR3002] module and the {{G|UART}} pins have test points. | On the DS4 circuit itself is a [http://www.qca.qualcomm.com/wp-content/uploads/2013/11/AR3002.pdf Qualcomm Atheros AR3002] module and the {{G|UART}} pins have test points. | ||
You can clearly see the UART HCI | You can clearly see the UART HCI data when you analyze the traffic on the RX and TX pins (See [[:File:DS4 testpoints hci uart 1.jpg|testpoints]]). | ||
The data seems to be at a baud rate of exactly 3Mbit/s , sticking with HCI standards, meaning it's 8N1 (8 data bits, No parity, 1 stop bit). The report rate seems to be once every 1.3 millisecond, but there are some occasional gaps in between that can reach 15 milliseconds. | The data seems to be at a baud rate of exactly 3Mbit/s , sticking with HCI standards, meaning it's 8N1 (8 data bits, No parity, 1 stop bit). The report rate seems to be once every 1.3 millisecond, but there are some occasional gaps in between that can reach 15 milliseconds. | ||
[http://eleccelerator.com/wiki/index.php?title=File:Ds4_uart_hci_cap_with_unpaired_better.pcap This file] is a capture of the traffic over the UART HCI, [http://www.wireshark.org/ Wireshark] | [http://eleccelerator.com/wiki/index.php?title=File:Ds4_uart_hci_cap_with_unpaired_better.pcap This file] is a capture of the traffic over the UART HCI, [http://www.wireshark.org/ Wireshark] is required to view this PCAP file. | ||
[http://eleccelerator.com/files/ds4_uart_hci_cap_playroom_needs_sorting.pcap.gz Similar] to the file before but uses data while running "the Playroom" app on the PS4, so that it shows motors, speaker, and LED activity. This file needs to be decompressed using gzip first, then opened with Wireshark. Once opened, it needs to be sorted by timestamp. | [http://eleccelerator.com/files/ds4_uart_hci_cap_playroom_needs_sorting.pcap.gz Similar] to the file before but uses data while running "the Playroom" app on the PS4, so that it shows motors, speaker, and LED activity. This file needs to be decompressed using gzip first, then opened with Wireshark. Once opened, it needs to be sorted by timestamp. | ||
=== Service Discovery Protocol (SDP) === | === Service Discovery Protocol (SDP) === | ||
{{G|SDP}} used by the PS4 the first time a device tries to connect, whereas the DS4 does it each time it connects to the PS4 | {{G|SDP}} used by the PS4 the first time a device tries to connect, whereas the DS4 does it each time it connects to the PS4. | ||
==== PS4 ==== | ==== PS4 ==== | ||
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | ||
00000000 | 00000000 07 00 01 01 53 01 50 36 01 4D 36 00 32 09 00 00 ....S.P6.M6.2... | ||
00000010 0A 00 01 00 05 09 | 00000010 0A 00 01 00 05 09 00 01 35 03 19 11 0A 09 00 04 ........5....... | ||
00000020 35 10 35 06 19 | 00000020 35 10 35 06 19 01 00 09 00 19 35 06 19 00 19 09 5.5.......5..... | ||
00000030 01 02 09 | 00000030 01 02 09 00 09 35 08 35 06 19 11 0D 09 01 02 36 .....5.5.......6 | ||
00000040 | 00000040 00 32 09 00 00 0A 00 01 00 06 09 00 01 35 03 19 .2...........5.. | ||
00000050 | 00000050 11 0B 09 00 04 35 10 35 06 19 01 00 09 00 19 35 .....5.5.......5 | ||
00000060 06 19 | 00000060 06 19 00 19 09 01 02 09 00 09 35 08 35 06 19 11 ..........5.5... | ||
00000070 | 00000070 0D 09 01 02 36 00 3B 09 00 00 0A 00 01 00 07 09 ....6.;......... | ||
00000080 | 00000080 00 01 35 06 19 11 0E 19 11 0F 09 00 04 35 10 35 ..5..........5.5 | ||
00000090 06 19 | 00000090 06 19 01 00 09 00 17 35 06 19 00 17 09 01 03 09 .......5........ | ||
000000A0 | 000000A0 00 09 35 08 35 06 19 11 0E 09 01 04 09 03 11 09 ..5.5........... | ||
000000B0 00 02 | 000000B0 00 02 36 00 4D 09 00 00 0A 00 01 00 08 09 00 01 ..6.M........... | ||
000000C0 35 03 19 | 000000C0 35 03 19 11 0C 09 00 04 35 10 35 06 19 01 00 09 5.......5.5..... | ||
000000D0 00 17 35 06 19 | 000000D0 00 17 35 06 19 00 17 09 01 03 09 00 09 35 08 35 ..5..........5.5 | ||
000000E0 06 19 | 000000E0 06 19 11 0E 09 01 04 09 00 0D 35 10 35 06 19 01 ..........5.5... | ||
000000F0 | 000000F0 00 09 00 1B 35 06 19 00 17 09 01 03 09 03 11 09 ....5........... | ||
00000100 00 01 | 00000100 00 01 36 00 52 09 00 00 0A 00 01 00 0A 09 00 01 ..6.R........... | ||
00000110 35 03 19 | 00000110 35 03 19 12 00 09 00 04 35 0D 35 06 19 01 00 09 5.......5.5..... | ||
00000120 00 01 35 03 19 | 00000120 00 01 35 03 19 00 01 09 00 09 35 08 35 06 19 12 ..5.......5.5... | ||
00000130 | 00000130 00 09 01 03 09 02 00 09 01 03 09 02 01 09 05 4C ...............L | ||
00000140 09 | 00000140 09 02 02 09 08 1F 09 02 03 09 01 00 09 02 04 28 ...............( | ||
00000150 01 09 | 00000150 01 09 02 05 09 00 02 00 ........ | ||
==== DS4 ==== | ==== DS4 ==== | ||
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | ||
00000000 | 00000000 09 19 01 29 0E 15 00 25 01 75 01 95 0E 81 02 75 ...)...%.u.•...u | ||
00000010 06 95 01 81 01 05 01 09 33 09 34 15 00 26 FF 00 .•......3.4..&ÿ. | |||
00000020 75 08 95 02 81 02 06 04 FF 85 02 09 24 95 24 B1 u.•.....ÿ…..$•$± | |||
00000030 02 85 A3 09 25 95 30 B1 02 85 05 09 26 95 28 B1 .…£.%•0±.…..&•(± | |||
00000040 02 85 06 09 27 95 34 B1 02 85 07 09 28 95 30 B1 .…..'•4±.…..(•0± | |||
00000050 02 85 08 09 29 95 2F B1 02 06 03 FF 85 03 09 21 .…..)•/±...ÿ…..! | |||
00000060 95 26 B1 02 85 04 09 22 95 2E B1 02 85 F0 09 47 •&±.….."•.±.…ð.G | |||
00000070 95 3F B1 02 85 F1 09 48 95 3F B1 02 85 F2 09 49 •?±.…ñ.H•?±.…ò.I | |||
00000080 95 0F B1 02 06 00 FF 85 11 09 20 15 00 26 FF 00 •.±...ÿ….. ..&ÿ. | |||
00000090 75 08 95 4D 81 02 09 21 91 02 85 12 09 22 95 8D u.•M...!‘.….."•. | |||
000000A0 81 02 09 23 91 02 85 13 09 24 95 CD 81 02 09 25 ...#‘.…..$•Í...% | |||
000000B0 91 02 85 14 09 26 96 0D 01 81 02 09 27 91 02 85 ‘.…..&–.....'‘.… | |||
000000C0 15 09 28 96 4D 01 81 02 09 29 91 02 85 16 09 2A ..(–M....)‘.…..* | |||
000000D0 96 8D 01 81 02 09 2B 91 02 85 17 09 2C 96 CD 01 –.....+‘.…..,–Í. | |||
000000E0 81 02 09 2D 91 02 85 18 09 2E 96 0D 02 81 02 09 ...-‘.…...–..... | |||
000000F0 2F 91 02 85 19 09 30 96 22 02 81 02 09 31 91 02 /‘.…..0–"....1‘. | |||
00000100 06 80 FF 85 82 09 22 95 3F B1 02 85 83 09 23 B1 .€ÿ…‚."•?±.…ƒ.#± | |||
00000110 02 85 84 09 24 B1 02 85 90 09 30 B1 02 85 91 09 .…„.$±.…..0±.…‘. | |||
00000120 31 B1 02 85 92 09 32 B1 02 85 93 09 33 B1 02 85 1±.…’.2±.…“.3±.… | |||
00000130 A0 09 40 B1 02 85 A4 09 44 B1 02 C0 09 02 07 35 .@±.…¤.D±.À...5 | |||
00000140 08 35 06 09 04 09 09 01 00 09 02 08 28 00 09 02 .5..........(... | |||
00000150 09 28 01 09 02 0A 28 01 09 02 0B 09 01 00 09 02 .(....(......... | |||
00000160 0C 09 1F 40 09 02 0D 28 00 09 02 0E 28 00 36 00 ...@...(....(.6. | |||
00000170 52 09 00 00 0A 00 01 00 02 09 00 01 35 03 19 12 R...........5... | |||
00000180 00 09 00 04 35 0D 35 06 19 01 00 09 00 01 35 03 ....5.5.......5. | |||
00000190 19 00 01 09 00 09 35 08 35 06 19 12 00 09 01 03 ......5.5....... | |||
000001A0 09 02 00 09 01 03 09 02 01 09 05 4C 09 02 02 09 ...........L.... | |||
000001B0 05 C4 09 02 03 09 01 00 09 02 04 28 01 09 02 05 .Ä.........(.... | |||
000001C0 09 00 02 00 .... | |||
=== HID Report header & footer === | === HID Report header & footer === | ||
==== Examples ==== | ==== Examples ==== | ||
Here's a sample HCI transaction that represents a report from the DS4 to the PS4: | |||
Here's a sample HCI | |||
Line 501: | Line 100: | ||
00000050 <span style="background:#66ff66;">00 00 00 00</span> <span style="background:lime;">7D 0A 5D 0B</span> | 00000050 <span style="background:#66ff66;">00 00 00 00</span> <span style="background:lime;">7D 0A 5D 0B</span> | ||
(For Packet type 2) | |||
{| class="wikitable" | {| class="wikitable" | ||
Line 508: | Line 108: | ||
| rowspan="5" style="background-color:#ff6666;"|'''Header''' ||0x00||0x01||0x02|| (2) Packet Type: | | rowspan="5" style="background-color:#ff6666;"|'''Header''' ||0x00||0x01||0x02|| (2) Packet Type: | ||
<small> | <small> | ||
*0x00: Acknowledgement Packets ? | |||
*0x01: HCI Command Packet (send commands to the Host Controller) | *0x01: HCI Command Packet (send commands to the Host Controller) | ||
*'''0x02: HCI ACL Data Packet''' (exchange Asynchronous Connection-Less data between the Host and Host Controller) | *'''0x02: HCI ACL Data Packet''' (exchange Asynchronous Connection-Less data between the Host and Host Controller) | ||
Line 529: | Line 130: | ||
</small> | </small> | ||
|- | |- | ||
|0x03||0x02||0x5300||(83) | |0x03||0x02||0x5300||(For Packet type 2) | ||
<small>(83) Length of Packet</small> | |||
|- | |- | ||
|0x05||0x02||0x4F00||(79) | |0x05||0x02||0x4F00||(79) Length (Payload+Check) | ||
|- | |- | ||
|0x07||0x02||0x4200||(0x0042) Channel ID (CID) | |0x07||0x02||0x4200||(0x0042) Channel ID (CID) | ||
|- | |- | ||
| rowspan="2" style="background-color:#66ff66;"|'''HID portion'''||0x09||0x03||0xA111C0|| Packet | | rowspan="2" style="background-color:#66ff66;"|'''HID portion'''||0x09||0x03||0xA111C0|| Packet Payload header: INPUT DATA protocol code 0x11 (see Structure HID transaction) | ||
|- | |- | ||
|0x0C||0x48||0x0083 … 0x00 || Data: See (speculation) USB data format for the first 64 bytes + 8 bytes NULL. | |0x0C||0x48||0x0083 … 0x00 || Data: See (speculation) USB data format for the first 64 bytes + 8 bytes NULL. | ||
|- | |- | ||
|style="background-color:lime;"|'''Check'''||0x54||0x04||0x7D0A5D0B||(0x0B5D0A7D) Data Integrity Check ({{G|CRC}}-32) | |rowspan="3" style="background-color:lime;"|'''Check'''||0x54||0x04||0x7D0A5D0B||(0x0B5D0A7D) Data Integrity Check ({{G|CRC}}-32) | ||
<small> | |||
To ensure that the packet is valid, this field is appended onto the end of the packet. Packet Payload is used to compute the Data Integrity Check (the CRC32's polynomial is 0x4C11DB7) | |||
</small> | |||
|- | |||
|} | |||
Packet type 4 example: | |||
04 13 05 01 15 00 01 00 | |||
{| class="wikitable" | |||
|- | |||
! Offset !! Size !! Value !! Description | |||
|- | |||
| 0x00||0x01||0x04|| (4) Packet Type: | |||
<small> | <small> | ||
*HCI Event Packet | |||
</small> | |||
|- | |||
|0x01||0x01||0x13|| Event code | |||
|- | |||
|0x02||0x01||0x05|| Parameter total length | |||
|- | |||
|0x03||0x01||0x01|| Number of Connection handles | |||
|- | |||
|0x04||0x02||0x1500||(0x15) Connection handle | |||
|- | |||
|0x06||0x02||0x0100||(1) Number of completed packets | |||
|- | |||
|} | |||
==== CRC32 ==== | |||
You can use http://www.lammertbies.nl/comm/info/crc-calculation.html to try this yourself, enter the packet payload into the textbox (hex): | You can use http://www.lammertbies.nl/comm/info/crc-calculation.html to try this yourself, enter the packet payload into the textbox (hex): | ||
{{Spoiler|First 75 bytes of the HID report| | {{Spoiler|First 75 bytes of the HID report| | ||
A1 11 C0 00 83 81 7E 7E 08 00 3C 00 00 83 A2 07 F1 FF F9 FF 04 00 21 03 17 1F 29 F9 00 00 00 00 00 08 00 00 00 00 80 00 00 00 80 00 00 00 00 80 00 00 00 80 00 00 00 00 80 00 00 00 80 00 00 00 00 80 00 00 00 80 00 00 00 00 00}} | A1 11 C0 00 83 81 7E 7E 08 00 3C 00 00 83 A2 07 F1 FF F9 FF 04 00 21 03 17 1F 29 F9 00 00 00 00 00 08 00 00 00 00 80 00 00 00 80 00 00 00 00 80 00 00 00 80 00 00 00 00 80 00 00 00 80 00 00 00 00 80 00 00 00 80 00 00 00 00 00}} | ||
=== Structure HID transaction (portion) === | === Structure HID transaction (portion) === | ||
Line 577: | Line 206: | ||
*0x00: | *0x00: | ||
*0x01: | *0x01: | ||
</small> | </small> | ||
|colspan="2"|'''report type:''' | |colspan="2"|'''report type:''' | ||
Line 599: | Line 227: | ||
Protocol code: | Protocol code: | ||
===== 0x01 ===== | ===== 0x01 ===== | ||
This report is sent until the GET REPORT FEATURE 0x02 is received. | This report is sent until the GET REPORT FEATURE 0x02 is received. | ||
0xa1, '''0x01''', 0x7d, 0x7d, 0x80, 0x7e, 0x08, 0x00, 0x00, 0x00, 0x00 | |||
^Left Stick X ... ^D-PAD | |||
0x00, 0x00, 0x00 | |||
===== 0x11 ===== | ===== 0x11 ===== | ||
This report is sent once the GET REPORT FEATURE 0x02 is received. | This report is sent once the GET REPORT FEATURE 0x02 is received. | ||
See example | |||
==== HID output reports ==== | |||
==== HID | |||
Output controls are a sink for application data, for example, an LED (or sound or rumbles) that indicates the state of a device. | Output controls are a sink for application data, for example, an LED (or sound or rumbles) that indicates the state of a device. | ||
Protocol code: | Protocol code: | ||
===== 0x11 ===== | ===== 0x11 ===== | ||
===== 0x14 ===== | ===== 0x14 ===== | ||
Speculation: contains sound. | |||
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F | ||
0000 <span style="background:#ff6666;">0f 01 42 00</span> a2 '''14''' 40 a0 f4 69 02 9c 75 19 24 00 [email protected].$. | |||
0010 00 00 00 00 00 00 00 76 db 6d bb 6d b6 dd b6 db .......v.m.m.... | 0010 00 00 00 00 00 00 00 76 db 6d bb 6d b6 dd b6 db .......v.m.m.... | ||
0020 6e db 6d b7 6d b6 db b6 db 6d db 6d b6 ed b6 db n.m.m....m.m.... | 0020 6e db 6d b7 6d b6 db b6 db 6d db 6d b6 ed b6 db n.m.m....m.m.... | ||
Line 1,008: | Line 254: | ||
0050 b6 db 6e db 6d b7 6d b6 db b6 db 6d db 6d b6 ed ..n.m.m....m.m.. | 0050 b6 db 6e db 6d b7 6d b6 db b6 db 6d db 6d b6 ed ..n.m.m....m.m.. | ||
0060 b6 db 76 db 6d bb 6d b6 dd b6 db 6e db 6d b7 6d ..v.m.m....n.m.m | 0060 b6 db 76 db 6d bb 6d b6 dd b6 db 6e db 6d b7 6d ..v.m.m....n.m.m | ||
0070 b6 db b6 db 6d db 6d b6 ed b6 db | 0070 b6 db b6 db 6d db 6d b6 ed b6 db 9c 75 19 24 00 ....m.m.....u.$. | ||
0080 00 00 00 00 00 00 00 76 db 6d bb 6d b6 dd b6 db .......v.m.m.... | 0080 00 00 00 00 00 00 00 76 db 6d bb 6d b6 dd b6 db .......v.m.m.... | ||
0090 6e db 6d b7 6d b6 db b6 db 6d db 6d b6 ed b6 db n.m.m....m.m.... | 0090 6e db 6d b7 6d b6 db b6 db 6d db 6d b6 ed b6 db n.m.m....m.m.... | ||
Line 1,020: | Line 266: | ||
0110 <span style="background:lime;">42 86 54</span> B.T | 0110 <span style="background:lime;">42 86 54</span> B.T | ||
===== 0x15 ===== | ===== 0x15 ===== | ||
Line 1,073: | Line 277: | ||
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | 0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | ||
0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | 0040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | ||
0050 00 00 00 | 0050 00 00 00 f6 69 02 9c 75 19 24 00 00 00 00 00 00 ....i..u.$...... | ||
0060 00 00 76 db 6d bb 6d b6 dd b6 db 6e db 6d b7 6d ..v.m.m....n.m.m | 0060 00 00 76 db 6d bb 6d b6 dd b6 db 6e db 6d b7 6d ..v.m.m....n.m.m | ||
0070 b6 db b6 db 6d db 6d b6 ed b6 db 76 db 6d bb 6d ....m.m....v.m.m | 0070 b6 db b6 db 6d db 6d b6 ed b6 db 76 db 6d bb 6d ....m.m....v.m.m | ||
Line 1,080: | Line 284: | ||
00a0 b7 6d b6 db b6 db 6d db 6d b6 ed b6 db 76 db 6d .m....m.m....v.m | 00a0 b7 6d b6 db b6 db 6d db 6d b6 ed b6 db 76 db 6d .m....m.m....v.m | ||
00b0 bb 6d b6 dd b6 db 6e db 6d b7 6d b6 db b6 db 6d .m....n.m.m....m | 00b0 bb 6d b6 dd b6 db 6e db 6d b7 6d b6 db b6 db 6d .m....n.m.m....m | ||
00c0 db 6d b6 ed b6 db | 00c0 db 6d b6 ed b6 db 9c 75 19 24 00 00 00 00 00 00 .m.....u.$...... | ||
00d0 00 00 76 db 6d bb 6d b6 dd b6 db 6e db 6d b7 6d ..v.m.m....n.m.m | 00d0 00 00 76 db 6d bb 6d b6 dd b6 db 6e db 6d b7 6d ..v.m.m....n.m.m | ||
00e0 b6 db b6 db 6d db 6d b6 ed b6 db 76 db 6d bb 6d ....m.m....v.m.m | 00e0 b6 db b6 db 6d db 6d b6 ed b6 db 76 db 6d bb 6d ....m.m....v.m.m | ||
Line 1,102: | Line 306: | ||
*0xFF: LED (<span style="color:#0000ff">B</span>lue) | *0xFF: LED (<span style="color:#0000ff">B</span>lue) | ||
... | ... | ||
0xB598A90F: <span style="color:lime">Check</span> (CRC-32 from | 0xB598A90F: <span style="color:lime">Check</span> (CRC-32 (from 0xA2)) | ||
===== 0x17 ===== | ===== 0x17 ===== | ||
===== 0x18 ===== | ===== 0x18 ===== | ||
===== 0x19 ===== | ===== 0x19 ===== | ||
==== HID features reports ==== | ==== HID features reports ==== | ||
A user-mode application can obtain (get) and set feature information by using this report designation. | A user-mode application can obtain (get) and set feature information by using this report designation. | ||
{{Reverse Engineering}} | {{Reverse Engineering}} | ||
<noinclude>[[Category:Main]]</noinclude> | <noinclude>[[Category:Main]]</noinclude> |