Nintendo Switch Brew

Joy-Con: Difference between revisions

← Older editNewer edit →
No edit summary
Line 1: Line 1:
Joy-Con is the name for the Switch's primary game controllers. The controllers communicate to the console through bluetooth and can be disconnected from the main unit.
Joy-Con is the name for the Switch's primary game controllers. The controllers communicate to the console through bluetooth and can be disconnected from the main unit.


== Hardware ==
= Hardware =
The controllers themselves are simple to disassemble and identify.
The controllers themselves are simple to disassemble and identify.
[[File:JoyconFront.jpg|400px|thumb|The front of the Joy-Con internal[https://www.ifixit.com/Teardown/Nintendo+Switch+Teardown/78263]]]
[[File:JoyconFront.jpg|400px|thumb|The front of the Joy-Con internal[https://www.ifixit.com/Teardown/Nintendo+Switch+Teardown/78263]]]
Line 15: Line 15:
|}
|}


== Firmware ==
= Firmware =
''See also: [[Joy-Con Firmware]]''
''See also: [[Joy-Con Firmware]]''


Line 26: Line 26:
| Joy-Con Right (Red) || [[:File:pad.R.bin|flash dump]]
| Joy-Con Right (Red) || [[:File:pad.R.bin|flash dump]]
|}
|}
The flash is in a patch-ram format. Tools for dealing with it are available [https://github.com/shuffle2/nxpad].
The flash is in a patch-ram format. Tools for dealing with it are available [https://github.com/shuffle2/nxpad].
A dump of the ROM region (taken while firmware was running) can be found [[:File:bcm20734_rom.bin|here]]. Note this is the same SoC used on the other controller models, as well.
A dump of the ROM region (taken while firmware was running) can be found [[:File:bcm20734_rom.bin|here]]. Note this is the same SoC used on the other controller models, as well.


== Bluetooth HID ==
= Protocol =
=== Commands ===
The Joy-Con can communicate wirelessly over Bluetooth or through the rails over UART. This uses a Nintendo proprietary protocol called "Nwcp".
 
== NwcpPacket ==
{| class="wikitable" border="1"
{| class="wikitable" border="1"
|-
|-
! Command || Name
! Offset
! Size
! Description
|-
| 0x0
| 0x5
| [[#HciHeader|HciHeader]]
|-
| 0x5
| 0x6
| [[#NwcpHeader|NwcpHeader]]
|-
| 0xB
| 0x1
| HeaderCrc (CRC8 over NwcpHeader)
|-
| 0xC
| Variable
| Data
|}
 
=== HciHeader ===
This is a 5-byte packet header used by Broadcom's HCI Control Protocol.
 
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| PacketType (always 0x19)
|-
| 0x1
| 0x1
| [[#CommandCode|CommandCode]]
|-
| 0x2
| 0x1
| GroupCode (always 0x03)
|-
| 0x3
| 0x2
| PacketLength
|}
 
==== CommandCode ====
{| class="wikitable" border="1"
! Value
! Description
|-
| 0x1 || SendToDevice
|-
| 0x81 || ReceiveFromDevice
|}
 
=== NwcpHeader ===
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x1
| [[#CommandType|CommandType]]
|-
| 0x1
| 0x1
| [[#DeviceCommand|DeviceCommand]]
|-
| 0x2
| 0x2
| DataSize
|-
| 0x4
| 0x1
| Reserved
|-
| 0x5
| 0x1
| DataCrc (CRC8 over Data for DataSize bytes)
|}
 
==== CommandType ====
{| class="wikitable" border="1"
! Value
! Description
|-
| 0x91 || DeviceCommandToDevice
|-
| 0x92 || Hid
|-
| 0x94 || DeviceCommandFromDevice
|-
| 0xA5 || Handshake
|}
 
== DeviceCommand ==
{| class="wikitable" border="1"
! Value
! Description
|-
| 0x00 ||
|-
| 0x01 || Inquiry
|-
| 0x02 || WriteChargerSettings
|-
| 0x07 || ReadWakeUpReason
|-
| 0x10 || CreateHidConnection
|-
| 0x11 || DisconnectHid
|-
| 0x12 || SetHidInterval
|-
| 0x13 ||
|-
| 0x14 ||
|-
| 0x15 ||
|-
| 0x16 ||
|-
| 0x17 ||
|-
| 0x18 || Pairing
|-
| 0x20 || UpdateUartBaudRate
|}
 
== HidCommand ==
{| class="wikitable" border="1"
! Value
! Description
|-
|-
| 0x00 ||  
| 0x00 ||  
Line 73: Line 212:
| 0x28 || AttachmentWrite
| 0x28 || AttachmentWrite
|-
|-
| 0x29 ||  
| 0x29 || AttachmentRead
|-
|-
| 0x2A || AttachmentEnable
| 0x2A || AttachmentEnable
Line 99: Line 238:
| 0x51 || WriteChargeSetting
| 0x51 || WriteChargeSetting
|-
|-
| 0x52 ||  
| 0x52 || ReadChargeSetting
|-
|-
| 0x58 || ExtDevWrite
| 0x58 || ExtDevWrite
Line 113: Line 252:
| 0x60 || InternalAttachmentWrite
| 0x60 || InternalAttachmentWrite
|-
|-
| 0x61 ||  
| 0x61 || InternalAttachmentReadOld
|-
|-
| 0x62 || InternalAttachmentEnable
| 0x62 || InternalAttachmentEnable
Line 152: Line 291:
|}
|}


=== Left & Right Separate Joy-con ===
== Left & Right Separate Joy-con ==
When paired directly to a computer over bluetooth, the joy-con both provide identical HID input report descriptor. This does not appear to include motion controls, IR data, or NFC. They both behave as detached single-player controllers.
When paired directly to a computer over bluetooth, the joy-con both provide identical HID input report descriptor. This does not appear to include motion controls, IR data, or NFC. They both behave as detached single-player controllers.


Line 336: Line 475:
|}
|}


== Colors ==
= Colors =
HEX codes for the colors shown in the "Controllers" menu of the Switch UI can be found in a Joy-con SPI dump starting at offset 0x6050. Body color is first followed by button color and each is 3 bytes long. These values are able to be re-written with any HEX color value to make the Joy-cons show up as different colors in the UI. The following is a list of official HEX colors recovered from SPI dumps.
HEX codes for the colors shown in the "Controllers" menu of the Switch UI can be found in a Joy-con SPI dump starting at offset 0x6050. Body color is first followed by button color and each is 3 bytes long. These values are able to be re-written with any HEX color value to make the Joy-cons show up as different colors in the UI. The following is a list of official HEX colors recovered from SPI dumps.
{| class="wikitable"
{| class="wikitable"
Line 406: Line 545:
|}
|}


== Additional Links ==
= Additional Links =
[https://github.com/dekuNukem/Nintendo_Switch_Reverse_Engineering Reverse Engineering of the Joy-Con by Github user dekuNukem]
[https://github.com/dekuNukem/Nintendo_Switch_Reverse_Engineering Reverse Engineering of the Joy-Con by Github user dekuNukem]
Retrieved from "https://switchbrew.org/wiki/Joy-Con"