Talk:Wiimote/Extension Controllers/Drawsome Tablet
Tablet Notes
Tablet needs to be activated before use. When not activated it returns 00 00 00 00 00 C0 for registers 0 to 5.
Activation sequence currently unknown. I let the game start and then re-paired my wiimote with WMGUI and started dumping regs.
Register dump from an activated Drawesome tablet 0x00A40000: 54 5A 39 14 46 A5 34 3E 89 6D D7 1A 46 65 34 3E 0x00A40010: 89 6D D7 1A 46 64 3B 3F 88 6E C8 1B 47 64 3B 3F 0x00A40020: 88 6E C8 1B 47 64 3B 3F 88 6E C8 1B 47 64 3B 3F 0x00A40030: 88 6E C8 1B 47 64 3B 3F 88 6E C8 1B 47 64 3B 3F 0x00A40040: 88 6E C8 1B 47 64 3B 3F 88 6E C8 1B 47 64 3B 3F 0x00A40050: 88 6E C8 1B 47 64 3B 3F 88 6E C8 1B 47 64 3B 3F 0x00A40060: 88 6E C8 1B 47 64 3B 3F 88 6E C8 1B 47 64 3B 3F 0x00A40070: 88 6E C8 1B 47 64 3B 3F 88 6E C8 1B 47 64 3B 3F 0x00A40080: 88 6E C8 1B 47 64 3B 3F 88 6E C8 1B 47 64 3B 3F 0x00A40090: 88 6E C8 1B 47 64 3B 3F 88 6E C8 1B 47 64 3B 3F 0x00A400A0: 88 6E C8 1B 47 64 3B 3F 88 6E C8 1B 47 64 3B 3F 0x00A400B0: 88 6E C8 1B 47 64 3B 3F 88 6E C8 1B 47 64 3B 3F 0x00A400C0: 88 6E C8 1B 47 64 3B 3F 88 6E C8 1B 47 64 3B 3F 0x00A400D0: 88 6E C8 1B 47 64 3B 3F 88 6E C8 1B 47 64 3B 3F 0x00A400E0: 88 6E C8 1B 47 64 3B 3F 88 6E C8 1B 47 64 3B 3F 0x00A400F0: 88 6E C8 1B 47 64 3B 3F 88 6E C8 19 E2 45 34 CB
Using a guide to move horizontally from left to right while pressing down with stylus.
0x00A40000: 10 48 D7 EA 47 2C 34 3E 0x00A40000: 48 6C A9 E5 47 2C 34 3E 0x00A40000: 48 6C A9 E5 47 2C 34 3E 0x00A40000: 48 6C A9 E5 47 2C 34 3E 0x00A40000: 48 6C A9 E5 47 2C 34 3E 0x00A40000: 58 67 F6 E5 47 2C 34 3E 0x00A40000: 62 67 F6 E5 47 2C 34 3E 0x00A40000: 2B 63 DC E5 47 2C 34 3E 0x00A40000: 29 63 DC E5 47 2C 34 3E 0x00A40000: 8A 61 D1 E5 47 2C 34 3E 0x00A40000: 8A 61 D1 E5 47 2C 34 3E 0x00A40000: 58 5D D0 E5 47 2C 34 3E 0x00A40000: 58 5D D0 E5 47 2C 34 3E 0x00A40000: 64 5A 20 E6 47 2C 34 3E 0x00A40000: 64 5A 20 E6 47 2C 34 3E 0x00A40000: 36 58 3B E6 47 2C 34 3E 0x00A40000: 36 58 38 E6 47 2C 34 3E 0x00A40000: FA 56 14 E6 47 2C 34 3E 0x00A40000: FB 56 14 E6 47 2C 34 3E 0x00A40000: 39 52 1F E6 47 2C 34 3E 0x00A40000: C6 52 1F E6 47 2C 34 3E 0x00A40000: C0 4F 3D E6 47 2C 34 3E 0x00A40000: CF 4F 3D E6 47 2C 34 3E 0x00A40000: 93 4B 19 E6 47 2C 34 3E 0x00A40000: 9B 4B 1B E6 47 2C 34 3E
I suspect pressure is stored in bytes 4 and 5 and Y and X data in bytes 0 1 2 3 based on what changes when I move around the tablet.
Oh, it might be encrypted. the repeating pattern of 8 aligned that way would be a constant encrypted by some key. and the bytes change at the last 6.
Acamilo (talk) 23:43, 16 February 2017 (CET)
Good news. I'm getting data from the tablet.
I started it up the way the wii did after using a analyzer on the i2c bus to see what the wii did.
A log of i2c comms between a wiimote and the wii running the included sw CD.
// unenc init a4 w f0 55 a4 w fb 00 Read ID Bytes a4 w fa a5 r ff 00 a4 20 00 13 // Enter enc mode a4 w f0 aa // write 16 byte key a4 w 40 e0 7d e0 7d e0 7d a4 w 46 e0 7d e0 7d 38 54 a4 w 4c bb 79 01 43 // Read Cal Data a4 w 20 a5 r a2 b2 89 40 0f 1f 39 f0 a5 r a2 b2 89 40 0f 1f 39 f0 a4 w 30 a5 r a2 b2 89 40 0f 1f 39 f0 a5 r a2 b2 89 40 0f 1f 39 f0 // Read inputs a4 w 00 a5 r a3 b1 8a 41 0e 5e 38 f3 a5 r a3 b1 8a 41 0e 1e 38 f3 many more 00 reads ???? a4 w fb 01 many more 00 reads
Looks like 3 things need to happen to make this tablet work.
You need to explicitly enable encrypted mode and send a full 16 bytes of key or it will return FFs. Additionally, You need to write 01 to FB.
I wrote 16 zeros for the key and decrypted the data with (e ^ 0x97)+0x97 and I'm getting bytes that make sense.
So far I've figured out that bit7 (index zero) of byte 5 (index zero) is a flag for detecting a pen in range. bits 2 to 0 of byte 5 are the MSbits of a pressure value. Additionally, bits 5 to 0 of bytes 1 and 3 are the upper 6 bits of X and Y pen positions respectively.
I'm gonna keep poking at this. Acamilo (talk) 20:16, 18 February 2017 (CET)