49
edits
Changes
Jump to navigation
Jump to search
m
Logitech USB steering wheel (view source)
Revision as of 04:12, 19 November 2010
, 04:12, 19 November 2010no edit summary
Line 21:
Line 21:
===USB HID Joystick===+===Configuration===+===Force Feedback===+
−The wheel is capable of supporting 4 simultaneous effects, plus an additional auto-center effect. The various effects are upload into 'slots', the format is as follows:
−: Bytes 1..2 - Negotiated SubChannel Address
−: Byte 3 - Receive Ack (0x40 saw packet, 0x80 missed packet, 0x20 awaiting sync, 0x07..0x04 sync received, 0x10?).
−: Byte 4 - Unknown
−: Bytes 5..10 - Effect Slot 1
−: Bytes 11..16 - Effect Slot 2
−: Bytes 17..22 - Effect Slot 3
−: Bytes 23..28 - Effect Slot 4
−: Bytes 29..30 - Auto Center
−: Byte 31 - Hopping RF Chanel Delta (0xC0 gives sequence 0x33, 0x13, 0x42, 0x22)
−
−The selected slot for an effect is encoded into the 1st byte of the OUT-Endpoint write. Multiple effects can be active at any time, but it is unknown how multiple forces are rationalized by the wheel.
The wheel hardware contains the nRF24L01, a ATMEGA micro, and a PWM/Full-bridge driver for controlling the motor. The micro scans the [[:File:Logitech_usb_buttons.pdf|buttons]] mounted on the wheel, digitises the wheel/accelerator/brake positions and sends the data to the PC/Dongle.
The wheel hardware contains the nRF24L01, a ATMEGA micro, and a PWM/Full-bridge driver for controlling the motor. The micro scans the [[:File:Logitech_usb_buttons.pdf|buttons]] mounted on the wheel, digitises the wheel/accelerator/brake positions and sends the data to the PC/Dongle.
−==USB HID Joystick==
The dongle is a standard USB HID device. The feature port is used to configure the dongle/wireless link, the in-port reads data from the wheel and the out-port is used to send Force Feedback commands.
The dongle is a standard USB HID device. The feature port is used to configure the dongle/wireless link, the in-port reads data from the wheel and the out-port is used to send Force Feedback commands.
Line 53:
Line 53:
</code>
</code>
−==Configuration==
The Wheel/Dongle are configured by writing to the feature port of the USB dongle. This allows the control of the 'on-air' features, such as initiating the wireless link, controlling the RF channel/hooping sequence and RF addressing (sub-channel coding).
The Wheel/Dongle are configured by writing to the feature port of the USB dongle. This allows the control of the 'on-air' features, such as initiating the wireless link, controlling the RF channel/hooping sequence and RF addressing (sub-channel coding).
Line 107:
Line 107:
: Returns values in Byte 5 and Byte 6 which are the values from Command '0xB2' Bytes 2 & 3
: Returns values in Byte 5 and Byte 6 which are the values from Command '0xB2' Bytes 2 & 3
−==Force Feedback==
There are a number of force feed back codes which can be written to the USB out-port, some of these are know/understood but assistance is required to further reverse engineer the rest.
There are a number of force feed back codes which can be written to the USB out-port, some of these are know/understood but assistance is required to further reverse engineer the rest.
−The Force Feedback configuration is sent continuously over the wireless link, which takes the form of a 31 byte payload. These are seen on the SPI bus as they are sent to the RF24L01 output buffer (register 0xA0).
+The selected 'slot' for an effect is encoded into the 1st byte of the OUT-Endpoint write. Multiple effects can be active at any time, but it is unknown how multiple forces are rationalized by the wheel.
−: 0x11 : Slot 1
: 0x11 : Slot 1
Line 183:
Line 170:
: Byte 2 - 0x_F
: Byte 2 - 0x_F
: Byte 3, 4, 5, 6 & 7 - anything (set 0x00)
: Byte 3, 4, 5, 6 & 7 - anything (set 0x00)
+
+===On Air Data===
+
+The Force Feedback configuration is sent continuously over the wireless link, which takes the form of a 31 byte payload. These are seen on the SPI bus as they are sent to the RF24L01 output buffer (register 0xA0). The format is as follows:
+: Bytes 1..2 - Negotiated SubChannel Address
+: Byte 3 - Receive Ack (0x40 saw packet, 0x80 missed packet, 0x20 awaiting sync, 0x07..0x04 sync received, 0x10?).
+: Byte 4 - Unknown
+: Bytes 5..10 - Effect Slot 1
+: Bytes 11..16 - Effect Slot 2
+: Bytes 17..22 - Effect Slot 3
+: Bytes 23..28 - Effect Slot 4
+: Bytes 29..30 - Auto Center
+: Byte 31 - Hopping RF Chanel Delta (0xC0 gives sequence 0x33, 0x13, 0x42, 0x22)
==Testing/Hacking==
==Testing/Hacking==