Nintendo Switch Brew

Changes

Joy-Con (view source)

Revision as of 20:58, 24 August 2022

1,767 bytes added ,  20:58, 24 August 2022
no edit summary
Line 1: Line 1:  
Joy-Con is the name for the Switch's primary game controllers. The controllers communicate to the console through bluetooth and can be disconnected from the main unit.
 
Joy-Con is the name for the Switch's primary game controllers. The controllers communicate to the console through bluetooth and can be disconnected from the main unit.
   −
== Hardware ==
+
= Hardware =
 
The controllers themselves are simple to disassemble and identify.
 
The controllers themselves are simple to disassemble and identify.
 
[[File:JoyconFront.jpg|400px|thumb|The front of the Joy-Con internal[https://www.ifixit.com/Teardown/Nintendo+Switch+Teardown/78263]]]
 
[[File:JoyconFront.jpg|400px|thumb|The front of the Joy-Con internal[https://www.ifixit.com/Teardown/Nintendo+Switch+Teardown/78263]]]
Line 15: Line 15:  
|}
 
|}
   −
== Firmware ==
+
= Firmware =
 
''See also: [[Joy-Con Firmware]]''
 
''See also: [[Joy-Con Firmware]]''
   Line 26: Line 26:  
| Joy-Con Right (Red) || [[:File:pad.R.bin|flash dump]]
 
| Joy-Con Right (Red) || [[:File:pad.R.bin|flash dump]]
 
|}
 
|}
 +
 
The flash is in a patch-ram format. Tools for dealing with it are available [https://github.com/shuffle2/nxpad].
 
The flash is in a patch-ram format. Tools for dealing with it are available [https://github.com/shuffle2/nxpad].
 
A dump of the ROM region (taken while firmware was running) can be found [[:File:bcm20734_rom.bin|here]]. Note this is the same SoC used on the other controller models, as well.
 
A dump of the ROM region (taken while firmware was running) can be found [[:File:bcm20734_rom.bin|here]]. Note this is the same SoC used on the other controller models, as well.
   −
== Bluetooth HID ==
+
= Protocol =
−
=== Commands ===
+
The Joy-Con can communicate wirelessly over Bluetooth or through the rails over UART. This uses a Nintendo proprietary protocol called "Nwcp".
 +
 
 +
== NwcpPacket ==
 
{| class="wikitable" border="1"
 
{| class="wikitable" border="1"
 
|-
 
|-
−
! Command || Name
+
! Offset
 +
! Size
 +
! Description
 +
|-
 +
| 0x0
 +
| 0x5
 +
| [[#HciHeader|HciHeader]]
 +
|-
 +
| 0x5
 +
| 0x6
 +
| [[#NwcpHeader|NwcpHeader]]
 +
|-
 +
| 0xB
 +
| 0x1
 +
| HeaderCrc (CRC8 over NwcpHeader)
 +
|-
 +
| 0xC
 +
| Variable
 +
| Data
 +
|}
 +
 
 +
=== HciHeader ===
 +
This is a 5-byte packet header used by Broadcom's HCI Control Protocol.
 +
 
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset
 +
! Size
 +
! Description
 +
|-
 +
| 0x0
 +
| 0x1
 +
| PacketType (always 0x19)
 +
|-
 +
| 0x1
 +
| 0x1
 +
| [[#CommandCode|CommandCode]]
 +
|-
 +
| 0x2
 +
| 0x1
 +
| GroupCode (always 0x03)
 +
|-
 +
| 0x3
 +
| 0x2
 +
| PacketLength
 +
|}
 +
 
 +
==== CommandCode ====
 +
{| class="wikitable" border="1"
 +
! Value
 +
! Description
 +
|-
 +
| 0x1 || SendToDevice
 +
|-
 +
| 0x81 || ReceiveFromDevice
 +
|}
 +
 
 +
=== NwcpHeader ===
 +
{| class="wikitable" border="1"
 +
|-
 +
! Offset
 +
! Size
 +
! Description
 +
|-
 +
| 0x0
 +
| 0x1
 +
| [[#CommandType|CommandType]]
 +
|-
 +
| 0x1
 +
| 0x1
 +
| [[#DeviceCommand|DeviceCommand]]
 +
|-
 +
| 0x2
 +
| 0x2
 +
| DataSize
 +
|-
 +
| 0x4
 +
| 0x1
 +
| Reserved
 +
|-
 +
| 0x5
 +
| 0x1
 +
| DataCrc (CRC8 over Data for DataSize bytes)
 +
|}
 +
 
 +
==== CommandType ====
 +
{| class="wikitable" border="1"
 +
! Value
 +
! Description
 +
|-
 +
| 0x91 || DeviceCommandToDevice
 +
|-
 +
| 0x92 || Hid
 +
|-
 +
| 0x94 || DeviceCommandFromDevice
 +
|-
 +
| 0xA5 || Handshake
 +
|}
 +
 
 +
== DeviceCommand ==
 +
{| class="wikitable" border="1"
 +
! Value
 +
! Description
 +
|-
 +
| 0x00 ||
 +
|-
 +
| 0x01 || Inquiry
 +
|-
 +
| 0x02 || WriteChargerSettings
 +
|-
 +
| 0x07 || ReadWakeUpReason
 +
|-
 +
| 0x10 || CreateHidConnection
 +
|-
 +
| 0x11 || DisconnectHid
 +
|-
 +
| 0x12 || SetHidInterval
 +
|-
 +
| 0x13 ||
 +
|-
 +
| 0x14 ||
 +
|-
 +
| 0x15 ||
 +
|-
 +
| 0x16 ||
 +
|-
 +
| 0x17 ||
 +
|-
 +
| 0x18 || Pairing
 +
|-
 +
| 0x20 || UpdateUartBaudRate
 +
|}
 +
 
 +
== HidCommand ==
 +
{| class="wikitable" border="1"
 +
! Value
 +
! Description
 
|-
 
|-
 
| 0x00 ||  
 
| 0x00 ||  
Line 73: Line 212:  
| 0x28 || AttachmentWrite
 
| 0x28 || AttachmentWrite
 
|-
 
|-
−
| 0x29 ||  
+
| 0x29 || AttachmentRead
 
|-
 
|-
 
| 0x2A || AttachmentEnable
 
| 0x2A || AttachmentEnable
Line 99: Line 238:  
| 0x51 || WriteChargeSetting
 
| 0x51 || WriteChargeSetting
 
|-
 
|-
−
| 0x52 ||  
+
| 0x52 || ReadChargeSetting
 
|-
 
|-
 
| 0x58 || ExtDevWrite
 
| 0x58 || ExtDevWrite
Line 113: Line 252:  
| 0x60 || InternalAttachmentWrite
 
| 0x60 || InternalAttachmentWrite
 
|-
 
|-
−
| 0x61 ||  
+
| 0x61 || InternalAttachmentReadOld
 
|-
 
|-
 
| 0x62 || InternalAttachmentEnable
 
| 0x62 || InternalAttachmentEnable
Line 152: Line 291:  
|}
 
|}
   −
=== Left & Right Separate Joy-con ===
+
== Left & Right Separate Joy-con ==
 
When paired directly to a computer over bluetooth, the joy-con both provide identical HID input report descriptor. This does not appear to include motion controls, IR data, or NFC. They both behave as detached single-player controllers.
 
When paired directly to a computer over bluetooth, the joy-con both provide identical HID input report descriptor. This does not appear to include motion controls, IR data, or NFC. They both behave as detached single-player controllers.
   Line 336: Line 475:  
|}
 
|}
   −
== Colors ==
+
= Colors =
 
HEX codes for the colors shown in the "Controllers" menu of the Switch UI can be found in a Joy-con SPI dump starting at offset 0x6050. Body color is first followed by button color and each is 3 bytes long. These values are able to be re-written with any HEX color value to make the Joy-cons show up as different colors in the UI. The following is a list of official HEX colors recovered from SPI dumps.
 
HEX codes for the colors shown in the "Controllers" menu of the Switch UI can be found in a Joy-con SPI dump starting at offset 0x6050. Body color is first followed by button color and each is 3 bytes long. These values are able to be re-written with any HEX color value to make the Joy-cons show up as different colors in the UI. The following is a list of official HEX colors recovered from SPI dumps.
 
{| class="wikitable"
 
{| class="wikitable"
Line 406: Line 545:  
|}
 
|}
   −
== Additional Links ==
+
= Additional Links =
 
[https://github.com/dekuNukem/Nintendo_Switch_Reverse_Engineering Reverse Engineering of the Joy-Con by Github user dekuNukem]
 
[https://github.com/dekuNukem/Nintendo_Switch_Reverse_Engineering Reverse Engineering of the Joy-Con by Github user dekuNukem]
Retrieved from "https://switchbrew.org/wiki/Special:MobileDiff/11846"