Difference between revisions of "Joy-Con Firmware"
Jump to navigation
Jump to search
Sebastiaan (talk | contribs) (Added general file info about the Joy-Con Firmware) |
Sebastiaan (talk | contribs) |
||
| Line 1: | Line 1: | ||
| + | The Joy-Con is internally called Ukyo. (Strings in the firmware) The firmware is written in C++. (Also found in strings in the firmware) | ||
| + | |||
= Joy-Con Firmware File = | = Joy-Con Firmware File = | ||
Revision as of 16:27, 12 December 2017
The Joy-Con is internally called Ukyo. (Strings in the firmware) The firmware is written in C++. (Also found in strings in the firmware)
Joy-Con Firmware File
The length of the firmware must be 524288 bytes.
| Offset | Endianness | Size | Description |
|---|---|---|---|
| 0x00 | B | 0x14 | Magic number?? |
| 0x15 | L | 0x06 | Unique MAC Address of controller |
| 0x3B3 | L | 0x04 | Offset to Factory Firmware |
| 0x1FF4 | B | 0x08 | OTA Magic, if the controller is Over-The-Air updated. |
| 0x1FFC | L | 0x04 | Offset to OTA Firmware, if OTA Magic is valid. |
| 0x6000 | Mixed | 0x1000 | Factory configuration (see Factory Configuration Sector) |
| 0x8000 | Mixed | 0x1000 | User calibration (see User Calibration Sector) |
Factory Configuration Sector
| Offset | Endianness | Size | Description |
|---|---|---|---|
| 0x00 | B | 0x10 | Serial number |
| 0x10 | ? | 0x02 | Unknown |
| 0x12 | B | 0x01 | Type descriptor (see Type Descriptor) |
| 0x13 | ? | 0x3D | Unknown |
| 0x50 | B | 0x03 | Body color of Controller in RGB Hex (see Joy-Con Colors) |
| 0x53 | B | 0x03 | Button color of Controller in RGB Hex (see Joy-Con Colors) |
| 0x56 | ? | 0xFAA | Unknown |
Type Descriptor
| Value | Type Name |
|---|---|
| 0x01 | Joy-Con Left |
| 0x02 | Joy-Con Right |
| 0x03 | Pro Controller |
User Calibration Sector
| Offset | Endianness | Size | Description |
|---|---|---|---|
| 0x00 | ? | 0x11 | Unknown |
| 0x10 | B | 0x0B | Left Stick Calibration (Factory 0xFF?) |
| 0x1B | B | 0x0B | Right Stick Calibration (Factory 0xFF?) |
| 0x26 | B | 0x1A | Sensor Calibration (Factory 0xFF?) |
| 0x40 | ? | 0xFBF | Unknown |
Firmware Chunks
The firmware itself is stored in PatchRAM chunks, located at the Factory Offset or the OTA Offset. Each chunk has a Record Type, Size and Data.
| Offset | Endianness | Size | Description |
|---|---|---|---|
| 0x00 | L | 0x01 | Record type (see Record Types) |
| 0x01 | L | 0x02 | Size of data (size) |
| 0x03 | Mixed | (size) | Data |
Record Types
| Value | Record name | Description |
|---|---|---|
| 0x08 | REC8 | ROM1 Patches (See Record 0x08 and Memory Regions) |
| 0x0A | RECA | RAM (Ram Low and Ram High) Patches (See Record 0x0A and Memory Regions) |
| 0x0B | RECB | Unknown |
| 0xFE | END | End of chunk stream |
Record 0x08
| Offset | Endianness | Size | Description |
|---|---|---|---|
| 0x00 | L | 0x01 | Index |
| 0x01 | L | 0x04 | Address |
| 0x05 | B | 0x04 | Data |
| 0x09 | L | 0x02 | Unk1? |
| 0x0B | L | 0x02 | Unk2? |
| 0x0D | L | 0x02 | Body size??? |
Record 0x0A
| Offset | Endianness | Size | Description | Note |
|---|---|---|---|---|
| 0x00 | L | 0x04 | Address | - |
| 0x04 | B | (Note) | Data | To calculate the size do: chunk_datasize (See Firmware Chunks)-4 |
Record 0x0B
| Offset | Endianness | Size | Description |
|---|---|---|---|
| 0x00 | L | 0x04 | Address |
Memory Regions
| Offsets | Description |
|---|---|
| 0x00-0xC8000 | ROM 1 |
| 0x260000-0x26C000 | ROM 2 |
| 0xD0000-0x0x0DFFFF | RAM Low |
| 0x200000-0x247FFF | RAM High |