Editing Talk:DualShock 4

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
== Talk ==
== Eleccelerator ==
infos merged from:
===  Frank's Eleccelerator ===


Hi, this is Frank, Eleccelerator is my website. I noticed the little message you've sent me (please use email next time, I don't check my own wiki edits, but I can't find your email either lol so I'm a hypocrite right now). Feel free to copy whatever information you want, I want the information to be public. Including a link to my website would be nice though.
Hi, this is Frank, Eleccelerator is my website. I noticed the little message you've sent me (please use email next time, I don't check my own wiki edits, but I can't find your email either lol so I'm a hypocrite right now). Feel free to copy whatever information you want, I want the information to be public. Including a link to my website would be nice though.


'''Source:''' http://eleccelerator.com/wiki/index.php?title=DualShock_4 (full paste 17:50 UTC, 18 January 2014 )
'''Source:''' http://eleccelerator.com/wiki/index.php?title=DualShock_4 (full paste 14:37, 24 November 2013‎ )
 
=== Johndrinkwater's git ===


: I’ve been decoding the USB reports independently and appear to have got further along, when I’m happy that most of the packet is described, I’ll integrate my findings, still a few nibbles unaccounted for though… https://gist.github.com/johndrinkwater/7708901 -- [[User:Johndrinkwater|Johndrinkwater]] ([[User talk:Johndrinkwater|talk]]) 05:22, 3 December 2013 (EST)
: I’ve been decoding the USB reports independently and appear to have got further along, when I’m happy that most of the packet is described, I’ll integrate my findings, still a few nibbles unaccounted for though… https://gist.github.com/johndrinkwater/7708901 -- [[User:Johndrinkwater|Johndrinkwater]] ([[User talk:Johndrinkwater|talk]]) 05:22, 3 December 2013 (EST)


----
----
See also http://blog.binaryninjas.org/?p=149


= Review: =
Review:


It feels really good to hold.
It feels really good to hold.


== Hardware ==
=Hardware=


Teardown photo album:  
Teardown photo album: http://imgur.com/a/ytRW5


<gallery>
The USB port and LED are on one separate board, connected using a flat flexible cable, this cable is connected to a vertical FFC connector that does not have a locking mechanism.
File:08XyXC8.jpeg
File:0xxrydw.jpeg
File:1QbQhNT.jpeg
File:2tP1Fkr.jpeg
File:3pYanfF.jpeg
File:3roUnDR.jpeg
File:518jy4N.jpeg
File:5Im3Fgp.jpeg
File:65Ad9It.jpeg
File:7863lo3.jpeg
File:7j2y3oo.jpeg
File:7KmRxHA.jpeg
File:7P44HZO.jpeg
File:7WKfCC3.jpeg
File:8F49ttw.jpeg
File:8FERmHB.jpeg
File:9959nAv.jpeg
File:A5iH1fU.jpeg
File:AgSNuAc.jpeg
File:AI7Rdbl.jpeg
File:aTfnx2h.jpeg
File:BSpanfM.jpeg
File:bZ5cSTr.jpeg
File:cQb6Hr1.jpeg
File:cUnyoKl.jpeg
File:cUYA7j0.jpeg
File:dBsL3Kn.jpeg
File:DJ72B6E.jpeg
File:dlwiEcB.jpeg
File:DsLZ3Xf.jpeg
File:EK9DQlr.jpeg
File:eWCknuC.jpeg
File:FEZpxph.jpeg
File:fpM5snu.jpeg
File:Fu0xNxB.jpeg
File:gF2Desn.jpeg
File:GhxB4iO.jpeg
File:GJAQ2eD.jpeg
File:gRrEwoj.jpeg
File:GT2AykA.jpeg
File:h9Z3yTj.jpeg
File:hJfdN6Y.jpeg
File:HrtfxmV.jpeg
File:i06VyHB.jpeg
File:I0jeij5.jpeg
File:I0joI3o.jpeg
File:jeonlvc.jpeg
File:jlWd7SD.jpeg
File:JqFkPNl.jpeg
File:KLiMprB.jpeg
File:KlNxTRs.jpeg
File:knOHMwu.jpeg
File:Lz2nlfj.jpeg
File:M4JZU4G.jpeg
File:MhiDvQp.jpeg
File:MnrEU9I.jpeg
File:mqWy7Ba.jpeg
File:obKO0F6.jpeg
File:OfRdANo.jpeg
File:oxeoZgI.jpeg
File:pgYz4Xv.jpeg
File:pNWE6LA.jpeg
File:PQ8LAWP.jpeg
File:PSvKqTz.jpeg
File:pwxHJ40.jpeg
File:q7gco24.jpeg
File:qI4xNec.jpeg
File:qyq5smd.jpeg
File:qZZmJKF.jpeg
File:rpzexY0.jpeg
File:rURuqlE.jpeg
File:rvMaQwI.jpeg
File:s4jqagj.jpeg
File:SihQjR8.jpeg
File:TetUWkG.jpeg
File:TFIhArd.jpeg
File:TXHghgH.jpeg
File:TYO2asR.jpeg
File:U3rNHQz.jpeg
File:UBLV6U4.jpeg
File:Vyxc25e.jpeg
File:Vyxr0fy.jpeg
File:w3JMMiF.jpeg
File:WeuZtOU.jpeg
File:WK3b3Dr.jpeg
File:WuRl1Ft.jpeg
File:XChVTGI.jpeg
File:XEmYZxP.jpeg
File:Y2CjPuI.jpeg
File:yeSWiWW.jpeg
File:YgBOdWe.jpeg
File:YJzxLnN.jpeg
File:Z1H6a1K.jpeg
File:zJw7iXa.jpeg
File:ztfuGtq.jpeg
</gallery>


Source: http://imgur.com/a/ytRW5
The touchpad sensor is also detachable, connected using a flat flexible cable, this cable is connected to the main PCB using a connector that has a flip-up locking mechanism.


The USB port and LED are on one separate board, connected using a [http://en.wikipedia.org/wiki/Flexible_flat_cable flat flexible cable], this cable is connected to a vertical FFC connector that does not have a locking mechanism.
The speaker is not removable and it connects to the main PCB using some raised contacts.


'''Main microcontroller:''' is a Spansion MB9BF002, a ARM Cortex M3 core, Ball Grid Array (BGA) package. The reset and SWD signals might be exposed to test points, I am not sure.
The battery is 3.65V 1000mAH Li-ion.


'''Power Management IC (PMIC):''' There's a ROHM chip marked with "BD9200" (in QFN 32 pin footprint), it has some thick traces around it, plus a big inductor. One of the pins near it read 6V, might be for the motor.
Main microcontroller is a Spansion MB9BF002, a ARM Cortex M3 core, BGA package. The reset and SWD signals might be exposed to test points, I am not sure.


'''Bluetooth module:''' shows "8LA18366" and "GS-WCM-01" and "VR2.0". There is also a [http://en.wikipedia.org/wiki/QR_code QR code] that I can't decipher yet. There are a lot of test points near it. Underneath the EMI shields, it is confirmed to be a [http://www.qca.qualcomm.com/wp-content/uploads/2013/11/AR3002.pdf Qualcomm Atheros AR3002-BL3D].
The Bluetooth module shows "8LA18366" and "GS-WCM-01" (or maybe it's "GS-WCN-01") and "VR2.0". There is also a QR code that I can't decipher yet. There are a lot of test points near it.


'''Six-axis sensor:''' There's a rectangular, maybe Land grid array (LGA) chip on the bottom side on the left, marked with "134" "A1322" "333": [http://www.bosch-sensortec.com/en/homepage/products_3/6_axis_sensors_2/inertial_measurement_unit_1/bmi055_1/bmi055 Bosch-sensortec GMBH BMI055] inertial sensor used for the three-axis gyroscope and three-axis accelerometer. It's got some sort of latch signal around it, or maybe it's a weird clock. It's slow and doesn't seem like a bus. Or it could be a shift register and it's reading blank because I'm not pressing buttons.
There's a chip marked with "BD9200" (in QFN 32 pin footprint) that might be a PMIC because it has some thick traces around it, plus a big inductor. One of the pins near it read 6V, might be for the motor.


'''Touchpad sensor:''' (with Atmel 8-bit AVR Microcontroller ATiny2313) is also detachable, connected using a flat flexible cable, this cable is connected to the main PCB using a connector that has a flip-up locking mechanism.
There's a shiny small square chip left of the left analog stick, it is marked with "7710" "325A1", I have no idea what this is, but there's some differential signals coming out of it, it might be USB, the activity stops when I disconnect the USB cable. I think this is connected to the USB port. I suspect this is a OTG chip.
 
'''Speaker:''' (EAS1S181F) is a built-in [http://en.wikipedia.org/wiki/Loudspeaker#Piezoelectric_speakers Piezoelectric speaker] connected to the main PCB using some raised contacts.


'''Audio codecs:''' There's a {{G|QFN}} 32 pin chip marked with "WM1801G" (Wolfson Microelectronics) "36A0LM6" dead center on the bottom side of the PCB. It is near the audio stuff but it is also near where all the buttons connect. There are 5 test points near it. It appears to be communicating with {{G|SPI BUS}} with constant activity. There's also two resistors that look like {{G|I²C}} pull-up resistors, and there appears to be constant I2C traffic.
There's a rectangular (maybe LGA) chip on the bottom side on the left, marked with "134" "A1322" "333", possibly a sensor. It's got some sort of latch signal around it, or maybe it's a weird clock. It's slow and doesn't seem like a bus. Or it could be a shift register and it's reading blank because I'm not pressing buttons.


There's a shiny small square chip left of the left analog stick, it is marked with "7710" "325A1", I have no idea what this is, but there's some differential signals coming out of it, it might be USB, the activity stops when I disconnect the USB cable. I think this is connected to the USB port. I suspect this is a OTG chip.
There's a QFN 32 pin chip marked with "WM18016" (the M could be a N, the 6 could be a G) "36A0LM6" dead center on the bottom side of the PCB. It has a sine wave logo on it (possibly Wolfson Microelectronics). It is near the audio stuff but it is also near where all the buttons connect. There are 5 test points near it. It appears to be communicating with SPI with constant activity. There's also two resistors that look like I2C pull-up resistors, and there appears to be constant I2C traffic.


Some buttons are active low, some are active high (maybe only the thumbstick push buttons). The sheet of flexible circuit for the buttons are active low.
Some buttons are active low, some are active high (maybe only the thumbstick push buttons). The sheet of flexible circuit for the buttons are active low.


<gallery mode="nolines" widths="120px" heights="120px">
I'll keep adding to this section
File:ARM_Cortex-M3-MB9BF002.jpg|Main Micro-controller
File:PMIC_BD9200.jpg|Power Management
File:Atheros_AR3002.jpg|Bluetooth Module and on the left, the numbering for the flexible film.
File:6-axis_bosch-bmi055.jpg|6-axis
File:TouchPad-002-DS4.jpg|TouchPad
File:TouchPad_AT2313.jpg|TouchPad
File:Speaker-DS4-002.jpg|LoudSpeaker
File:WM1801G.jpg|Audio Codecs
</gallery>


=== Flexible Film Pin Mapping ===
==Flexible Film Pin Mapping==


The buttons are all on a single sheet of flexible film. The contacts for the flexible film are numbered from 1 to 18, and the numbers are written on the PCB.
The buttons are all on a single sheet of flexible film. The contacts for the flexible film are numbered from 1 to 18, and the numbers are written on the PCB.


The triggers have a resistor printed directly on the film, this appears to form a [http://en.wikipedia.org/wiki/Voltage_divider Voltage divider] voltage divider, so that the trigger can have an analog value. The ground side of the voltage divider appears to be oscillating, the frequency and duty cycle are not fixed or predictable.  
The triggers have a resistor printed directly on the film, this appears to form a voltage divider, so that the trigger can have an analog value. The ground side of the voltage divider appears to be oscillating, the frequency and duty cycle are not fixed or predictable.
 
{| class="wikitable"
| Pin # || Purpose  || Notes
|-
| 1    || L2 Common || oscillating between 0 and 3.3V
|-
| 2    || L1 Sig    || active High
|-
| 3    || L1 Common || fixed at 3.3V
|-
| 4    || L2 Sig    || voltage divider output, active low
|-
| 5    || DPAD Right || active low
|-
| 6    || DPAD Up    || active low
|-
| 7    || DPAD Left  || active low
|-
| 8    || DPAD Down  || active low
|-
| 9    || Common    || ground
|-
| 18    || PS Button || active low
|-
| 11    || X || active low
|-
| 12    || Circle    || active low
|-
| 13    || Triangle  || active low
|-
| 14    || Square    || active low
|-
| 15    || R2 Common || oscillating between 0 and 3.3V
|-
| 16    || R1 Sig    || active high
|-
| 17    || R1 Common || fixed at 3.3V
|-
| 18    || R2 Sig    || voltage divider output, active low
|}
 
=USB=
 
Audio definitely does not carry through USB.
 
The reports arrive once every 4ms.
 
===Device Descriptor===
 
{| class="wikitable"
|-
! colspan="5" style="background-color:#C0C0C0; color:#000000;" |[http://linuxcommand.org/man_pages/lsusb8.html Device Descriptor]
|-
! Offset
! Field
! Size
! Value
! Description
|-
| 0 || bLength || 1 || Number: 0x12 || Size of this descriptor in bytes (18)
|-
| 1 || bDescriptorType || 1 || Constant: 0x01 || DEVICE descriptor type (= 1)
|-
| 2 || bcdUSB || 2 || BCD: 0x0200 || USB Spec release number ([http://en.wikipedia.org/wiki/USB#USB_2.0 2.00]):
<small>valid version numbers are 0x0100 (USB1.0), 0x0110 (USB1.1), 0x0200 (USB2.0), 0x0300 ([[USB_3.0|USB3.0]]) and 0x0310 (USB3.1).</small>
|-
| 4 || bDeviceClass || 1 || Class: 0x00 || Class code assigned by [http://en.wikipedia.org/wiki/USB_Implementers_Forum USB-IF:]
<small>
*00h means each interface defines its own class
*FFh means vendor-defined class
*Any other value must be a class code
</small>
|-
| 5 || bDeviceSubClass || 1 || SubClass: 0x00 || SubClass Code assigned by USB-IF
|-
| 6 || bDeviceProtocol || 1 || Protocol: 0x00 || Protocol Code assigned by USB-IF
|-
| 7 || bMaxPacketSize0 || 1 || Number: 0x40  || Max packet size for endpoint 0. (64)
<small>Must be 8, 16, 32 or 64</small>
|-
| 8 || idVendor || 2 || ID: 0x054C || [http://www.linux-usb.org/usb.ids Vendor ID (VID)] (Sony Corp.) - must be obtained from USB-IF
|-
| 10 || idProduct || 2 || ID: 0x05C4 || Product ID (PID) - assigned by the manufacturer
|-
| 12 || bcdDevice || 2 || BCD: 0x0100 || Device release number in binary coded decimal (1.00)
|-
| 14 || iManufacturer || 1 || Index: 0x01 || Index of string descriptor describing manufacturer - set to 0 if no string
|-
| 15 || iProduct || 1 || Index: 0x02  || Index of string descriptor describing product - set to 0 if no string
|-
| 16 || iSerialNumber || 1 || Index: 0x00 || Index of string descriptor describing device serial number - set to 0 if no string
|-
| 17 || bNumConfigurations || 1 || Number: 0x01 || Number of possible configurations
|-
|}
 
===Configuration Descriptor===
 
{| class="wikitable"
|-
! colspan="5" style="background-color:#C0C0C0; color:#000000;" |[http://linuxcommand.org/man_pages/lsusb8.html Configuration Descriptor]
|-
! Offset
! Field
! Size
! Value
! Description
|-
| 0 || bLength || 1 || Number: 0x09 || Size of this descriptor in bytes (9)
|-
| 1 || bDescriptorType || 1 || Constant: 0x02 || CONFIGURATION descriptor type (= 2)
|-
| 2 || wTotalLength || 2 || Number: 0x0029 || Total number of bytes (41) in this descriptor and all the following descriptors
|-
| 4 || bNumInterfaces || 1 || Number: 0x01 || Number of interfaces supported by this configuration
|-
| 5 || bConfigurationValue || 1 || Number: 0x01 || Value used by Set Configuration to select this configuration
|-
| 6 || iConfiguration || 1 || Index: 0x00 || Index of string descriptor describing configuration - set to 0 if no string
|-
| 7 || bmAttributes || 1 || Bitmap: 0xC0 || (11000000) Self Powered & powered by the bus
<small>
*0 - 4 Reserved.
*5 The configuration supports remote wakeup.
*6 The configuration is self-powered and does not use power from the bus.
*7 The configuration is powered by the bus.
</small>
|-
| 8 || bMaxPower || 1 || 0xFA mA || Maximum current: 500mA drawn by device in this configuration.<BR /><small>In units of 2mA. So 0x32 (50) means 100 mA</small>
|-
|}
 
<pre>
0x09,        // bLength
0x02,        // bDescriptorType (Configuration)
0x29, 0x00,  // wTotalLength 41
0x01,        // bNumInterfaces 1
0x01,        // bConfigurationValue
0x00,        // iConfiguration (String Index)
0xC0,        // bmAttributes Self Powered
0xFA,        // bMaxPower 500mA
 
0x09,        // bLength
0x04,        // bDescriptorType (Interface)
0x00,        // bInterfaceNumber 0
0x00,        // bAlternateSetting
0x02,        // bNumEndpoints 2
0x03,        // bInterfaceClass
0x00,        // bInterfaceSubClass
0x00,        // bInterfaceProtocol
0x00,        // iInterface (String Index)
 
0x09,        // bLength
0x21,        // bDescriptorType (HID)
0x11, 0x01,  // bcdHID 1.17
0x00,        // bCountryCode
0x01,        // bNumDescriptors
0x22,        // bDescriptorType[0] (HID)
0xD3, 0x01,  // wDescriptorLength[0] 467
 
0x07,        // bLength
0x05,        // bDescriptorType (Endpoint)
0x84,        // bEndpointAddress (IN/D2H)
0x03,        // bmAttributes (Interrupt)
0x40, 0x00,  // wMaxPacketSize 64
0x05,        // bInterval 5 (unit depends on device speed)
 
0x07,        // bLength
0x05,        // bDescriptorType (Endpoint)
0x03,        // bEndpointAddress (OUT/H2D)
0x03,        // bmAttributes (Interrupt)
0x40, 0x00,  // wMaxPacketSize 64
0x05,        // bInterval 5 (unit depends on device speed)
 
// 41 bytes
</pre>
===HID Report Descriptor===
<pre>
0x05, 0x01,        // Usage Page (Generic Desktop Ctrls)
0x09, 0x05,        // Usage (Game Pad)
0xA1, 0x01,        // Collection (Physical)
0x85, 0x01,        //  Report ID (1)
0x09, 0x30,        //  Usage (X)
0x09, 0x31,        //  Usage (Y)
0x09, 0x32,        //  Usage (Z)
0x09, 0x35,        //  Usage (Rz)
0x15, 0x00,        //  Logical Minimum (0)
0x26, 0xFF, 0x00,  //  Logical Maximum (255)
0x75, 0x08,        //  Report Size (8)
0x95, 0x04,        //  Report Count (4)
0x81, 0x02,        //  Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
0x09, 0x39,        //  Usage (Hat switch)
0x15, 0x00,        //  Logical Minimum (0)
0x25, 0x07,        //  Logical Maximum (7)
0x35, 0x00,        //  Physical Minimum (0)
0x46, 0x3B, 0x01,  //  Physical Maximum (315)
0x65, 0x14,        //  Unit (System: English Rotation, Length: Centimeter)
0x75, 0x04,        //  Report Size (4)
0x95, 0x01,        //  Report Count (1)
0x81, 0x42,        //  Input (Data,Var,Abs,No Wrap,Linear,Preferred State,Null State)
0x65, 0x00,        //  Unit (None)
0x05, 0x09,        //  Usage Page (Button)
0x19, 0x01,        //  Usage Minimum (0x01)
0x29, 0x0E,        //  Usage Maximum (0x0E)
0x15, 0x00,        //  Logical Minimum (0)
0x25, 0x01,        //  Logical Maximum (1)
0x75, 0x01,        //  Report Size (1)
0x95, 0x0E,        //  Report Count (14)
0x81, 0x02,        //  Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
0x06, 0x00, 0xFF,  //  Usage Page (Vendor Defined 0xFF00)
0x09, 0x20,        //  Usage (0x20)
0x75, 0x06,        //  Report Size (6)
0x95, 0x01,        //  Report Count (1)
0x15, 0x00,        //  Logical Minimum (0)
0x25, 0x7F,        //  Logical Maximum (127)
0x81, 0x02,        //  Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
0x05, 0x01,        //  Usage Page (Generic Desktop Ctrls)
0x09, 0x33,        //  Usage (Rx)
0x09, 0x34,        //  Usage (Ry)
0x15, 0x00,        //  Logical Minimum (0)
0x26, 0xFF, 0x00,  //  Logical Maximum (255)
0x75, 0x08,        //  Report Size (8)
0x95, 0x02,        //  Report Count (2)
0x81, 0x02,        //  Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
0x06, 0x00, 0xFF,  //  Usage Page (Vendor Defined 0xFF00)
0x09, 0x21,        //  Usage (0x21)
0x95, 0x36,        //  Report Count (54)
0x81, 0x02,        //  Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
0x85, 0x05,        //  Report ID (5)
0x09, 0x22,        //  Usage (0x22)
0x95, 0x1F,        //  Report Count (31)
0x91, 0x02,        //  Output (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x04,        //  Report ID (4)
0x09, 0x23,        //  Usage (0x23)
0x95, 0x24,        //  Report Count (36)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x02,        //  Report ID (2)
0x09, 0x24,        //  Usage (0x24)
0x95, 0x24,        //  Report Count (36)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x08,        //  Report ID (8)
0x09, 0x25,        //  Usage (0x25)
0x95, 0x03,        //  Report Count (3)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x10,        //  Report ID (16)
0x09, 0x26,        //  Usage (0x26)
0x95, 0x04,        //  Report Count (4)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x11,        //  Report ID (17)
0x09, 0x27,        //  Usage (0x27)
0x95, 0x02,        //  Report Count (2)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x12,        //  Report ID (18)
0x06, 0x02, 0xFF,  //  Usage Page (Vendor Defined 0xFF02)
0x09, 0x21,        //  Usage (0x21)
0x95, 0x0F,        //  Report Count (15)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x13,        //  Report ID (19)
0x09, 0x22,        //  Usage (0x22)
0x95, 0x16,        //  Report Count (22)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x14,        //  Report ID (20)
0x06, 0x05, 0xFF,  //  Usage Page (Vendor Defined 0xFF05)
0x09, 0x20,        //  Usage (0x20)
0x95, 0x10,        //  Report Count (16)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x15,        //  Report ID (21)
0x09, 0x21,        //  Usage (0x21)
0x95, 0x2C,        //  Report Count (44)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x06, 0x80, 0xFF,  //  Usage Page (Vendor Defined 0xFF80)
0x85, 0x80,        //  Report ID (128)
0x09, 0x20,        //  Usage (0x20)
0x95, 0x06,        //  Report Count (6)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x81,        //  Report ID (129)
0x09, 0x21,        //  Usage (0x21)
0x95, 0x06,        //  Report Count (6)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x82,        //  Report ID (130)
0x09, 0x22,        //  Usage (0x22)
0x95, 0x05,        //  Report Count (5)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x83,        //  Report ID (131)
0x09, 0x23,        //  Usage (0x23)
0x95, 0x01,        //  Report Count (1)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x84,        //  Report ID (132)
0x09, 0x24,        //  Usage (0x24)
0x95, 0x04,        //  Report Count (4)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x85,        //  Report ID (133)
0x09, 0x25,        //  Usage (0x25)
0x95, 0x06,        //  Report Count (6)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x86,        //  Report ID (134)
0x09, 0x26,        //  Usage (0x26)
0x95, 0x06,        //  Report Count (6)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x87,        //  Report ID (135)
0x09, 0x27,        //  Usage (0x27)
0x95, 0x23,        //  Report Count (35)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x88,        //  Report ID (136)
0x09, 0x28,        //  Usage (0x28)
0x95, 0x22,        //  Report Count (34)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x89,        //  Report ID (137)
0x09, 0x29,        //  Usage (0x29)
0x95, 0x02,        //  Report Count (2)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x90,        //  Report ID (144)
0x09, 0x30,        //  Usage (0x30)
0x95, 0x05,        //  Report Count (5)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x91,        //  Report ID (145)
0x09, 0x31,        //  Usage (0x31)
0x95, 0x03,        //  Report Count (3)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x92,        //  Report ID (146)
0x09, 0x32,        //  Usage (0x32)
0x95, 0x03,        //  Report Count (3)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x93,        //  Report ID (147)
0x09, 0x33,        //  Usage (0x33)
0x95, 0x0C,        //  Report Count (12)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0xA0,        //  Report ID (160)
0x09, 0x40,        //  Usage (0x40)
0x95, 0x06,        //  Report Count (6)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0xA1,        //  Report ID (161)
0x09, 0x41,        //  Usage (0x41)
0x95, 0x01,        //  Report Count (1)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0xA2,        //  Report ID (162)
0x09, 0x42,        //  Usage (0x42)
0x95, 0x01,        //  Report Count (1)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0xA3,        //  Report ID (163)
0x09, 0x43,        //  Usage (0x43)
0x95, 0x30,        //  Report Count (48)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0xA4,        //  Report ID (164)
0x09, 0x44,        //  Usage (0x44)
0x95, 0x0D,        //  Report Count (13)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0xA5,        //  Report ID (165)
0x09, 0x45,        //  Usage (0x45)
0x95, 0x15,        //  Report Count (21)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0xA6,        //  Report ID (166)
0x09, 0x46,        //  Usage (0x46)
0x95, 0x15,        //  Report Count (21)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0xF0,        //  Report ID (240)
0x09, 0x47,        //  Usage (0x47)
0x95, 0x3F,        //  Report Count (63)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0xF1,        //  Report ID (241)
0x09, 0x48,        //  Usage (0x48)
0x95, 0x3F,        //  Report Count (63)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0xF2,        //  Report ID (242)
0x09, 0x49,        //  Usage (0x49)
0x95, 0x0F,        //  Report Count (15)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0xA7,        //  Report ID (167)
0x09, 0x4A,        //  Usage (0x4A)
0x95, 0x01,        //  Report Count (1)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0xA8,        //  Report ID (168)
0x09, 0x4B,        //  Usage (0x4B)
0x95, 0x01,        //  Report Count (1)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0xA9,        //  Report ID (169)
0x09, 0x4C,        //  Usage (0x4C)
0x95, 0x08,        //  Report Count (8)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0xAA,        //  Report ID (170)
0x09, 0x4E,        //  Usage (0x4E)
0x95, 0x01,        //  Report Count (1)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0xAB,        //  Report ID (171)
0x09, 0x4F,        //  Usage (0x4F)
0x95, 0x39,        //  Report Count (57)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0xAC,        //  Report ID (172)
0x09, 0x50,        //  Usage (0x50)
0x95, 0x39,        //  Report Count (57)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0xAD,        //  Report ID (173)
0x09, 0x51,        //  Usage (0x51)
0x95, 0x0B,        //  Report Count (11)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0xAE,        //  Report ID (174)
0x09, 0x52,        //  Usage (0x52)
0x95, 0x01,        //  Report Count (1)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0xAF,        //  Report ID (175)
0x09, 0x53,        //  Usage (0x53)
0x95, 0x02,        //  Report Count (2)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0xB0,        //  Report ID (176)
0x09, 0x54,        //  Usage (0x54)
0x95, 0x3F,        //  Report Count (63)
0xB1, 0x02,        //  Feature (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0xC0,              // End Collection
 
// 467 bytes
</pre>
===Sample Report===
<pre>
01 81 80 83 7A 08 00 00 00 00 93 5F FB D2 FF DA
FF D8 FF 4F EE 14 1B 99 FE 00 00 00 00 00 05 00
00 00 00 80 00 00 00 80 00 00 00 00 80 00 00 00
80 00 00 00 00 80 00 00 00 80 00 00 00 00 80 00
</pre>
===Report Structure===
 
{| class="wikitable"
|+Data Format
|-
|width="100"|byte index
|width="60"|bit 7
|width="60"|bit 6
|width="60"|bit 5
|width="60"|bit 4
|width="60"|bit 3
|width="60"|bit 2
|width="60"|bit 1
|width="60"|bit 0
|-
|[0]
|colspan="8"|Report ID (always 0x01)
|-
|[1]
|colspan="8"|Left Stick X (0 = left)
|-
|[2]
|colspan="8"|Left Stick Y (0 = up)
|-
|[3]
|colspan="8"|Right Stick X
|-
|[4]
|colspan="8"|Right Stick Y
|-
|[5]
|TRI
|CIR
|X
|SQR
|colspan="4"|D-PAD (hat format, 0x08 is released, 0=N, 1=NE, 2=E, 3=SE, 4=S, 5=SW, 6=W, 7=NW)
|-
|[6]
|R3
|L3
|OPT
|SHARE
|R2
|L2
|R1
|L1
|-
|[7]
|colspan="6"|Counter (counts up by 1 per report)
|T-PAD
|PS
|-
|[8]
|colspan="8"|Left Trigger (0 = released, 0xFF = fully pressed)
|-
|[9]
|colspan="8"|Right Trigger
|-
|[10]
|colspan="8"|Unknown, seems to count downwards, non-random pattern
|-
|[11]
|colspan="8"|Unknown, seems to count upwards by 3, but by 2 when [10] underflows
|-
|[12]
|colspan="8"|Unknown yet, 0x03 or 0x04
|-
|[13 - 14]
|colspan="8"|Possibly Gyro X (seems to be signed)
|-
|[15 - 16]
|colspan="8"|Possibly Gyro Y
|-
|[17 - 18]
|colspan="8"|Possibly Gyro Z
|-
|[19 - 20]
|colspan="8"|Possibly Accel X
|-
|[21 - 22]
|colspan="8"|Possibly Accel Y
|-
|[23 - 24]
|colspan="8"|Possibly Accel Z
|-
|[25 - 63]
|colspan="8"|TODO, work in progress
|}
 
===Class Requests===
 
This is what happened with a controller that was not previously synced to the PS4
<pre>
Set Address
Get Device Descriptor:    (Short Device Descriptor)
Get Device Descriptor:    (Full Device Descriptor)
Get String Descriptor[idx=0, langID=0]:      04 03
Get String Descriptor[idx=0, langID=0]:      04 03 09 04
Get String Descriptor[idx=1, langID=0x0409]: 38 03
Get String Descriptor[idx=1, langID=0x0409]: "Sony Computer Entertainment"
Get String Descriptor[idx=2, langID=0x0409]:
Get String Descriptor[idx=3, langID=0x0409]: "Wireless Controller"
Get Configuration Descriptor: (Short Configuration Descriptor)
Get Configuration Descriptor: (Full Configuration Descriptor)
Get Device Status: 00 00
Set Configuration to 0x01
Get Descriptor:  (HID Report Descriptor)
Set Idle to 0
Get Report 0xA3: A3 41 75 67 20 20 33 20 32 30 31 33 00 00 00 00 00 30 37 3A 30 31 3A 31 32 00 00 00 00 00 00 00 00 00 01 00 31 03 00 00 00 49 00 05 00 00 80 03 00
Get Report 0x02: 02 01 00 00 00 00 00 87 22 7B DD B2 22 47 DD BD 22 43 DD 1C 02 1C 02 7F 1E 2E DF 60 1F 4C E0 3A 1D C6 DE 08 00
Get Report 0xA3: A3 41 75 67 20 20 33 20 32 30 31 33 00 00 00 00 00 30 37 3A 30 31 3A 31 32 00 00 00 00 00 00 00 00 00 01 00 31 03 00 00 00 49 00 05 00 00 80 03 00
Get Report 0x12: 12 8B 09 07 6D 66 1C 08 25 00 00 00 00 00 00 00
Set Report 0x13: 13 AC 9E 17 94 05 B0 56 E8 81 38 08 06 51 41 C0 7F 12 AA D9 66 3C CE
Set Report 0x12: 14 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
</pre>


See main page (skewed button connector) for pins purpose.
The same controller is then disconnected, and this is what happened when it reconnected
<pre>
... enumeration steps same as before
Get Report 0xA3: A3 41 75 67 20 20 33 20 32 30 31 33 00 00 00 00 00 30 37 3A 30 31 3A 31 32 00 00 00 00 00 00 00 00 00 01 00 31 03 00 00 00 49 00 05 00 00 80 03 00
Get Report 0x02: 02 01 00 00 00 00 00 87 22 7B DD B2 22 47 DD BD 22 43 DD 1C 02 1C 02 7F 1E 2E DF 60 1F 4C E0 3A 1D C6 DE 08 00
Get Report 0xA3: A3 41 75 67 20 20 33 20 32 30 31 33 00 00 00 00 00 30 37 3A 30 31 3A 31 32 00 00 00 00 00 00 00 00 00 01 00 31 03 00 00 00 49 00 05 00 00 80 03 00
Get Report 0x12: 12 8B 09 07 6D 66 1C 08 25 00 AC 9E 17 94 05 B0
</pre>


=== Replacing Parts / Mod ===
report ID 0xA3 seems to be some sort of time-of-manufacture identifier, it contains a date and time as a string in the beginning, ".Aug  3 2013.....07:01:12...........1....I....."
* http://www.neogaf.com/forum/showthread.php?t=867944 Dualshock 4 with Xbox One analog sticks
* http://www.eurogamer.net/articles/digitalfoundry-2016-how-to-upgrade-your-dual-shock-4-with-xbox-one-parts
* https://www.reddit.com/r/PS4/comments/2rtimv/diy_double_dualshock_4_battery_capacity_internal/


== Why no CUH-ZCT2 section? ==
AC 9E 17 94 05 B0 is PS4 (Host) Bluetooth MAC Address (in proper MAC format, it is B0:05:94:17:9E:AC), AC 9E 17 is the LAP and 0x94 is the UAP, 05 B0 is the NAP, this was verified using a Bluetooth sniffer.


Seems strange that there's nothing at all about the CUH-ZCT2 controllers
I am guessing that 8B 09 07 6D 66 1C (in proper MAC format, 1C:66:6D:07:09:8B) is controller's MAC address, it's different on a different controller
Please note that all contributions to PS4 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS4 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page: