Wiimote/Extension Controllers

The Wii Remote includes a 6-pin expansion port that allows external peripherals to be connected to it. Communications are bidirectional synchronous serial (the protocol is unknown), and the devices provide a virtual register block of length 0x100 that is mapped at 0xa40000 in the Wii Remote's address space. Communications are encrypted, as detailed in Wiimote#Extension Controllers. Nintendo has currently released two extensions, the Nunchuk and the Classic Controller. In addition, Guitar Hero guitars and drums also act as extension controllers, although the RockBand guitars and drums don't. The Balance board acts like a dummy Wiimote with its own type of extension controller. There are also many third party versions of classic controllers and nunchuks.

The Wii Motion Plus is a small expansion which itself has an expansion port, allowing people to plug the Nunchuk into the Wii Motion Plus and the Wii Motion Plus into the Wii Remote.

Peripheral Protocol is 400kHz "fast" I2C, with slave address 0x52. It is easy to make homebrew peripherals; see the Tenkey project (japanese), the Twiidler project, the DIY Wii drum controller, or the DIY Wii guitar proof of concept demo video.

Nunchuk

Wii nunchuk

The Nunchuk is identified by the 16-bit constant 0x0000 (0xFEFE encrypted) at register address 0xa400fe. It provides three-axis acceleration data, two digital buttons, and an X-Y analog stick.

Data Format

The Nunchuk reports its information as 6 bytes of data, readable at 0xa40008 and streamable using Data Reporting Modes that include Extension bytes (unused bytes are filled with 0x00). The data is packed into the six bytes as follows (after decryption):

	Bit
Byte	7	6	5	4	3	2	1	0
0	SX<7:0>
1	SY<7:0>
2	AX<9:2>
3	AY<9:2>
4	AZ<9:2>
5	AZ<1:0>		AY<1:0>		AX<1:0>		BC	BZ

SX,SY are the Analog Stick X and Y positions, while AX, AY, and AZ are the 10-bit accelerometer data (in the same format as described in Wiimote#Accelerometer). BC and BZ are the state of the C and Z buttons (0=pressed).

Nintendo games calibrate the center position of the Analog Stick upon power-up or insertion of the Nunchuk. The mechanism for that is unknown.

Hardware

Wii nunchuk circuit board, top surface

Wii nunchuk circuit board, bottom surface

The official Nintendo wired nunchuk appears to be electrically much simpler than the other controller extensions. It has a single joystick comprised of a 30KΩ potentiometer per axis, two switches, an accelerometer chip, and a microcontroller.

Function	Hardware	Circuit board surface and mounting
C	membrane switch	daughterboard, through-hole
Z	membrane switch	daughterboard, through-hole
Joystick X	axial potentiometer, 30KΩ	through-hole
Joystick Y	axial potentiometer, 30KΩ	through-hole
Accelerometer	ST 8XRJ 3L02AE 820 MLT	surface mount, top
Microcontroller?	FNURVL 405 849KM (36-pin QFP)	surface mount, bottom

Like the classic controller, the joystick potentiometers appear to be wired in parallel. The accelerometer chip is in the LIS3L02 series from STMicroelectronics. The AE variant is not on their web site; their closest public product is their LIS3L02AT, in the same LGA-8 package, but possibly with a different pinout.

Wireless Nunchuk

It looks like Wireless Nunchuks operate differently than the original Nunchuk-Extension. Anyone have a clue?

Nyko Kama

The Nyko Kama is just a simple wireless Nunchuk, with a Sync and Power button. It uses two AAA batteries.

The Nyko Kama does not work with current homebrew or PC Wiimote software. It is unknown how to make it work.

I was able to initialize the Kama and get data from it. My procedure is as follows: Write 0x55 to a400f0, write 0x00 to a400fb; then set up the encryption key (without it, the Nunchuk doesn't work) at a40040 (16 bytes). As a last step, set Data Reporting Mode to 0x37 (my Kama does not work when I set Data Reporting Mode prior to setting up the registers).

This way, buttons are reported correctly, but the joystick values seem to be wrong. Do I need to decrypt the values? The original Nunchuk still works with this altered initialization sequence (unencrypted!).--Andyboeh 23:45, 19 April 2009 (UTC)

Snakebyte Wireless Motion XS

Snakebyte is a German company that makes 3rd party Wii Remotes, Nunchuks, Classic Controllers, and Sensor Bars.

On the Discussion page, the user "Grid" supplied the following information: (Abridged. Spelling and grammar have been corrected.)

"I am using a wireless Nunchuk controller by some third party company (Snakebyte), and I was trying many, many times to get the wireless Nunchuk running on any lib out there. But anytime I plug it into my WiiMote my application slows down and I don't get any response from the Nunchuk. I've got no idea, my Wii accepts the wireless Nunchuk without any problem.

I don't see any problem with any Wii game. Some WiiMote libs, which support the original Nunchuk perfectly, toggle between "nothing inserted" and "partially inserted" when the wireless Nunchuk is plugged in. Also no Data is streamed from the Nunchuk. It's extremely strange!!!! I've got no clue!

I'm still trying to run a Wireless Nunchuk. One problem is that the address areas where the calibration data is normally stored is write-only on the wireless Nunchuks. But the weird thing about this wireless Nunchuk from Snakebyte [1] is that I got no response at all until I played Metroid Prime 3 or Zelda with it. I am not kidding!!! After playing one of these games, I get all the data, only without the calibration, so I can't really use the data because I don't know how to calibrate the accelerometers and the joystick."

That appears to be similar behaviour to what I observed with the Datel Blade-FX as documented below. It returns 0xFF 0xFF as the extension type, but then when you try to read the calibration data it disconnects and then reconnects later, thus producing the observed "toggle between "nothing inserted" and "partially inserted" when the wireless Nunchuk is plugged in". CarlKenner 04:20, 28 November 2008 (UTC)

Datel Blade-FX

This wireless Nunchuk can emulate either a Nunchuk or a Classic Controller. At startup it behaves like a Nunchuk, but pressing the "Classic" button puts it into Classic Controller mode. While in Classic Controller mode, the FUNCTION LED will be solidly lit (red). Classic controller emulation allows it to be used in the Wii system menu, with the joystick controlling the cursor, and the Z button selecting, and the C button having no visible effect. It also allows it to work (according to the instructions) with some Virtual Console games.

This wireless Nunchuk also has a cheat feature that remembers a motion that you do and repeats it continuously without you having to keep doing the motion. That is done with the "FX" button.

There is also a "SYNC" button where the cord would be. Pressing it once connects the wireless nunchuk. While connected, the STATUS LED will slowly flash.

When the wireless adapter is plugged in, but the wireless nunchuk has not been synced or turned on, then it behaves as though nothing was plugged in. No status report is generated when the wireless adapter is plugged in or unplugged, unless the nunchuk is synced. Querying the status report returns 0 for the extension flag (instead of 2).

But when the wireless nunchuk is synced, then it sends a status report indicating that an extension is connected. Trying to read the 16 bytes from 0xF0 of the expansion (to identify the expansion) successfully returns "FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF", which isn't particularly helpful. Trying to read any 16 byte block has the same effect, it returns success, but it is all FFs.

BUT... trying to read the calibration data from 0x20 or 0x30 (although it still returns success as above) causes the Nunchuk to disconnect, sending a status report to indicate no extension is plugged in. It will automatically reconnect 0.5 seconds later. While disconnected, attempting to read from the Nunchuk returns error 7.

Expansion data (in the input reports that include expansion data) is all 0xFF, just like trying to read the Nunchuk memory.

As soon as the "Classic" button is pressed, a status message is sent saying that the extension has been unplugged. It will stay "unplugged" until the status button is released again, however long they hold down the button for. Once the "Classic" button has been released, it will wait about half a second and then send a status message saying the extension has been plugged in again. If the Classic button is pressed twice before it sent the released message, then it may send another disconnect and connect message after the connect message. It is not currently possible to tell whether it is in Classic Controller or Nunchuk mode. But we can use this method to read when the "Classic" button is held down (although it will always look like it was held down longer than it really was).

Actually unplugging the adapter will give the same disconnect message, so after a few seconds one should assume that they did a real disconnect instead of holding down the "Classic" button. In one case, after unplugging and replugging the adapter, the BladeFX started returning all 00 instead of FF when reading the expansion type from 0xF0. The data returned from report 0x34 also had 00 00 00 as the last 3 extension bytes, even though the first 16 (starting from 0x08 in extension memory) were all FF. Trying to read the calibration from 0x20 still returned all 0xFF and then disconnected as usual. Pressing buttons on the BladeFX had no effect on the data returned in report 0x34. I have not done any additional experiments with this state yet.

Clearly the current method of turning on an expansion doesn't work for the Datel Blade-FX, and we need some way to turn it on. Perhaps then the calibration can be read without an error, and we can get real data.

It is not yet known how to make the Datel Blade-FX work, although it can be detected when it is synced, due to its strange behaviour, and the "Classic" button can be read. Nothing else is readable yet.

CarlKenner 03:50, 28 November 2008 (UTC)

Datel Wireless Duo-FX

Using the standard initalization sequence, it does not work. However, it works perfectly well with the sequence I posted above for the Nyko Kama. The data is streamed unencrypted and the Datel can be fully read. However, the Nunchuk must be synced before initalizing the Extension Controller, otherwise, strange errors occur. For now, I simply repeat the initialization sequence, after some tries the Nunchuk works correctly (can be up to 10).--Andyboeh 17:01, 20 April 2009 (UTC)

Classic Controller

The Classic Controller is identified by the 16-bit constant 0x0101 (0xFDFD encrypted) at register address 0xa400fe. It provides 15 buttons, two of which are analog triggers and provide both "clicked" status and a distance pressed measurement, and two X-Y analog sticks.

Data Format

The Classic Controller reports its information as 6 bytes of data, readable at 0xa40008 and streamable using Data Reporting Modes that include Extension bytes (unused bytes are filled with 0x00). The data is packed into the six bytes as follows (after decryption):

	Bit
Byte	7	6	5	4	3	2	1	0
0	RX<4:3>		LX<5:0>
1	RX<2:1>		LY<5:0>
2	RX<0>	LT<4:3>		RY<4:0>
3	LT<2:0>			RT<4:0>
4	BDR	BDD	BLT	B-	BH	B+	BRT	1
5	BZL	BB	BY	BA	BX	BZR	BDL	BDU

LX,LY are the left Analog Stick X and Y (0-61), RX and RY are the right Analog Stick X and Y (0-31), and LT and RT are the Left and Right Triggers (0-31). The left Analog Stick has twice the precision of the other analog values.

BD{L,R,U,D} are the D-Pad direction buttons. B{ZR,ZL,A,B,X,Y,+,H,-} are the discrete buttons. B{LT,RT} are the digital button click of LT and RT. All buttons are 0 when pressed.

Nintendo games calibrate the center position of the Analog Sticks upon power-up or insertion of the Classic Controller.

Hardware

Wii Classic Controller circuit board, top surface

Wii Classic Controller circuit board, bottom surface

The classic controller uses several different hardware parts for its various inputs.

Input	Hardware	Circuit board surface and mounting
A	membrane switch	top
B	membrane switch	top
-	microswitch	top
Home	microswitch	top
+	microswitch	top
X	membrane switch	top
Y	membrane switch	top
Up	membrane switch	top
Down	membrane switch	top
Left	membrane switch	top
Right	membrane switch	top
Left joystick X	axial potentiometer, 30KΩ	daughterboard, through-hole
Left joystick Y	axial potentiometer, 30KΩ	daughterboard, through-hole
Right joystick X	axial potentiometer, 30KΩ linear	daughterboard, through-hole
Right joystick Y	axial potentiometer, 30KΩ linear	daughterboard, through-hole
L trigger range	slider potentiometer, 30KΩ linear	bottom, through-hole
R trigger range	slider potentiometer, 30KΩ linear	bottom, through-hole
L trigger bottom-out switch	membrane switch	daughterboard, through-hole
R trigger bottom-out switch	membrane switch	daughterboard, through-hole
ZL	SPST switch	bottom, through-hole
ZR	SPST switch	bottom, through-hole

The left and right trigger buttons are force-sensitive. As the trigger is pressed, a mechanism slides a 30KΩ linear potentiometer. However, the mechanism only uses about 1/4 of the full travel of the potentiometer. At the bottom of that travel, the mechanism actuates a switch. One might speculate that the bottom-out switch allows the controller to tolerate manufacturing differences between potentiometers without going through a calibration step. Regardless of the variation in the potentiometer, the trigger is considered fully pressed when the bottom-out switch closes.

It appears that all six of the potentiometers on the device: both triggers, both axes of each joystick, appear to be wired in parallel. All of the ends appear to be wired to the unit's power supply and ground, and the wiper (the electrical part that indicates the position of the slider) is probably are connected to analog-to-digital inputs on the microcontroller. Thus, one might speculate that the voltage that the microcontroller sees is between 3.3 and 0 volts. So it may be possible to repurpose these ranged inputs to measure other electrical signals in the same voltage range.

The through-hole switches should be easy to replace with soldered-in leads and moved to an off-board switch. Membrane switches should also be repurposable, but not as readily.

Guitar Hero (Wii) Guitars

Note: These are different from Rock Band guitars, which are USB.

These Guitars are identified by the 6 bytes: 00 00 A4 20 01 03 at register address 0x(4)a400fa. The first 00 indicates that it is a guitar and not drums (which would be 01).

If you initialise the expansion the old way, by writing 0 to 0x(4)a40040, then on a Guitar Hero 3 Gibson Les Paul guitar those 6 bytes will be readable but encrypted, and on a Guitar Hero World Tour or 3rd party Guitar those bytes will be FF FF FF FF FF FF. To make a GHWT or 3rd Party guitar work, you need to write 0x55 to 0x(4)a400f0, then 0 to 0x(4)a400fb. That will allow the 6 bytes to be read, and has the side effect of making all the expansion data, including those 6 bytes, unencrypted. Testing with the old method first allows you to know whether it is a GH3 Guitar or a GHWT Guitar.

3rd party

Nyko Frontman: requires the new kind of initialisation

MetopGame: once sold at Walmart

RAGE wireless guitar for Wii: Has another set of fret buttons lower down the neck, presumably these button trigger both the fret and one of the strum buttons at the same time.

CTA Digital Shred Axe:

Neutac NJoy:

Datel Vii:

TGC Wii Wireless Guitar: Has another set of fret buttons lower down, probably identical to upper buttons

Wii Dragon Wireless Guitar: Has another set of fret buttons lower down, probably identical to upper buttons

INTEC G5689 NINTENDO WII(TM) ROCK ICON GUITAR G5689:

Smart Guitar III:

Data Format

The Guitar reports its information as 6 bytes of data, readable at 0xa40008 and streamable using Data Reporting Modes that include Extension bytes (unused bytes are filled with 0x00). The data is packed into the six bytes as follows (after decryption):

	Bit
Byte	7	6	5	4	3	2	1	0
0	GH3	GH3	SX
1	GH3	GH3	SY
2	0	0	0	TB
3	0	0	0	WB
4	1	BD	1	B-	1	B+	1	1
5	BO	BR	BB	BG	BY	1	1	BU

SX,SY are the Analog Stick X and Y positions. BG,BR,BY,BB,BO are the fret buttons by color (Green, Red, Yellow, Blue, Orange). B-,B+ are the + and - buttons at the base of the controller, on the GHWT Guitars the B- is the StarPower button. BU and BD are up and down on the strum bar, respectively. WB is the analog whammy bar. Bits marked GH3 seem to be 1 on GH3 Gibson Les Paul Guitars and 0 on GHWT Guitars.

TB is the analog touchbar found on the neck of the Guitar Hero World Tour Guitars, which does not exist on Guitar Hero 3 Guitars.

Not touching it  -  0F
1st (top) fret   -  04
1st AND 2nd      -  07
2nd              -  0A
2nd AND 3rd      -  0C/0D (keeps changing)
3rd              -  12/13
3rd AND 4th      -  14/15
4th              -  17/18
4th and 5th      -  1A
5th (bottom)     -  1F

You can hold two (touchbar) frets at once, as long as those two (touchbar) frets are adjacent, otherwise it will take the value of the lowest fret held (Eg, if you hold the highest and lowest fret, it reads 1F) Note that high/low means physically on the guitar neck (in musical terms I think it's the other way around, so I thought I'd better specify)

Guitar Hero World Tour (Wii) Drums

Note: This is different from Rock Band drums, which are USB.

The Drums are identified by the 6 bytes: 01 00 A4 20 01 03 at register address 0x(4)a400fa. The first 01 indicates that it is drums and not a guitar (which would be 00). To read these bytes unencrypted, you must first write 0x55 to 0x(4)a400f0, then 0 to 0x(4)a400fb. Trying to read the 6 bytes after initialising the old way will just return FF FF FF FF FF FF, like many other expansions.

Data Format

The drum kit reports its information as 6 bytes of data, readable at 0x(4)a40008 and streamable using Data Reporting Modes that include Extension bytes. The Guitar Hero World Tour game uses mode 0x37 with continuous reporting. The data is packed into the six bytes as follows (after decryption):

	Bit
Byte	7	6	5	4	3	2	1	0
0	0	0	SX
1	0	0	SY
2	HHP	None	Which					??
3	Softness			0110				??
4	??	1	1	B-	1	B+	1	??
5	O	R	Y	G	B	Bass	1	1

R, B, and G are the drum pads by colour (Red, Blue, and Green). O and Y are the cymbals. Bass is the pedal. B- and B+ are the black - and + buttons behind the Wii Remote. They will be 0 when hit, 1 when not.

SX and SY are the black analog stick behind the Wii Remote. 0x20 means centered.

None will be 0 if there is velocity data, and 1 if there is none. If there is none, bytes 2 and 3 will be FF FF and contain no data, and all the ??s will be 1.

If there is velocity data, then "Which" tells you which pad it is for:

Pedal =  11011 = 27 dec, 0x1B
Red =    11001 = 25 dec, 0x19
Yellow = 10001 = 17 dec, 0x11
Blue =   01111 = 15 dec, 0x0F
Orange = 01110 = 14 dec, 0x0E
Green =  10010 = 18 dec, 0x12

"Softness" is how hard or soft you hit the pad. It ranges from 0 = Very hard to 6 = very soft, with 7 = not hit at all

"HHP" is 0 if the velocity data is for the hi-hat pedal (unmarked 3.5mm jack above bass pedal jack), and 1 otherwise. When hi-hat pedal data is sent, "Which" is set as it is for the bass drum pedal (ie 11011). The velocity varies according to how far the pedal is pressed. The pedal to connect to the jack is not the same as the bass drum pedal; it must be a some sort of variable resistor (varying between 20k Ohms when down and 40 Ohms when up seems to give a good spread of velocity values from 0 to 7). The messages are not always sent and are delayed by around 35ms (probably due to the home-made pedal I'm using working wrong).

"0110" is 0110 if there is velocity information, or 1111 if there is not. Its meaning is unknown.

The data in the "??" bits is also unknown, although they are always 1 if there is no velocity data.

Thanks to Metallica1969, death_au, l0stsign, MonkeyJamboree and Carl Kenner.

Balance Board

The Balance Board extension is identified by the 16-bit constant 0x2A2C (0x0402 encrypted) at register address 0xa400fe. This extension is only found connected to the Wii Balance Board device, and is documented on that page.

Wii Motion Plus

The Wii Motion Plus is at register 0xA60000 instead of register 0xA40000, because it has its own extension port on the back allowing a Nunchuk for example to be plugged in along with the Wii Motion Plus.

Games attempt to detect the Wii Motion Plus by trying to read the two-byte expansion identifier at 0xA600FE. It is unknown what value the Wii Motion Plus returns for expansion type. If a Wii Motion Plus is not detected then the attempt to read those bytes will fail.

The Wii Motion Plus consists of two rate-gyros. These gyros measure rotation SPEED, but can't actually measure absolute orientation, which causes drift if not corrected by some other data source. Speed is one step better than the acceleration reported by the accelerometers. One of the two gyros will obviously have to measure yaw, since that can't be measured by accelerometers. The other axis is unknown, but I would guess pitch. Unlike the rotation measured by accelerometers, whose axes are defined by gravity, the gyro axes are relative to the angle of the Wiimote. So even if it can measure yaw when the Wiimote is in the normal orientation, it won't be able to detect yaw when the Wiimote is vertical.

In addition to providing yaw, the gyros also allow the software to tell the difference between orientation and acceleration, which are difficult to tell apart from the accelerometers which measure a mixture of both.

Wii Motion Plus will be released between June 8 and June 12, depending on the region. More information will be available on June 11.

Wii Motion Plus Documentation at AiLive