141
edits
Changes
no edit summary
Line 1,143:
Line 1,143:
The Wii Remote includes a 6-pin proprietary expansion connector, which carries synchronous serial data to and from external add-ons, using a two-wire interface. These include the Nunchuk and the Classic Controller, the Guitar Hero guitars, the Guitar Hero World Tour drum kit, and Wii Motion Plus. These addons map onto a portion of the Wii Remote's register space, and can also stream data out through Output Reports (see [[#Data Reporting | Data Reporting]] for a list of modes which include Extension Controller data).+
−== Registers / Initialization ==
−
−{{BoxCenter|'''Reminder'''<br />Remember to set bit 2 (0x04) on the first byte of the Output Reports to write to registers!}}
−
−Wii Motion Plus is mapped at register 0xa60000.
−
−Other extension Controllers are mapped at register address 0xa40000. The data is 0x100 bytes long, and it is mirrored across the entire 16-bit address space up to 0xa4FFFF. These registers are readable and writable. Communications are optionally encrypted, and explicit initialization is required to disable encryption (see below).
−
−In encrypted mode, bytes can be decrypted using the following transformation:
−
− decrypted_byte = (encrypted_byte XOR table1[address%8]) + table2[address%8]
−
−Where table1 and table2 are 8-byte tables calculated based on the 16-byte key sent by the host, and address is the address of the byte being read (only the bottom 3 bits matter). If the host key is 16 zero bytes, table1[x] and table2[x] are all 0x97. The value 0x17 was used previously, which is equivalent. Proof of why any two pairs of table entries a,b and x,y are equivalent if (a^b^x^y)&0x80 == 0 is left as an exercise to the reader.
−
−The calculations should be performed '''mod 256''', that is, truncated to 8 bits (in languages such as C and Python, use <span style="font-family: monospace;">&0xFF</span> or work directly with 8-bit datatypes).
−
−If the Wii Remote is initialized using the new method listed below, then the encryption of the extension bytes is disabled and they need not be decrypted using the transform listed above.
−
−The Wii Remote will stream data bytes from the Extension Controller starting at offset 0x08, and continuing for however many bytes the current [[#Data Reporting | Data Reporting Mode]] requires. Data streamed through the Input Reports must also be decrypted using the above transformation if encryption is enabled.
−
−== Identification ==
−Once initialized, the last '''six''' bytes of the register block identify the connected Extension Controller. A six-byte read of register 0xa400fa will return these bytes. The Extension Controller must have been initialized prior to this. There are two ways of initializing the extension.
−
−=== The Old Way ===
−The old way to initialize the extension was by writing the single encryption byte 0x00 to 0x(4)A40040, but that only works on Nintendo's own brand extensions and the GH3 Guitar, and will fail on 3rd party wireless nunchuks and GHWT extensions. If it fails, the 6 bytes will be FFFF FFFF FFFF. With this method you must decrypt the extension bytes to read them.
−
−=== The New Way ===
−The new way to initialize the extension is by writing 0x55 to 0x(4)A400F0, then writing 0x00 to 0x(4)A400FB. It works on all extensions, and makes the extension type bytes '''unencrypted'''. This means that you no longer have to decrypt the extension bytes using the [[#Registers / Initialization | transform]] listed above.
−
−
−{| style="border-collapse: collapse; padding: 0.2em 0.2em 0.2em 0.2em;"
−|- style="text-align: center;"
−| style="border: 1px solid #ccc; padding: 0.2em; background-color: #fdd;" | '''Encrypted'''
−| style="border: 1px solid #ccc; padding: 0.2em; background-color: #dfd;" | '''Decrypted'''
−| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ddf;" | '''Meaning'''
−|-
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" | 0000 0000 0000*
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" | 0x2E2E
−| style="border: 1px solid #ccc; padding: 0.2em; background-color: #eef;" | BladeFX adapter that has been initialised old way, unplugged then replugged
−|-
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" | FFFF FFFF FFFF*
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" | 0xFFFF
−| style="border: 1px solid #ccc; padding: 0.2em; background-color: #eef;" | GHWT Guitar or Drums or synced BladeFX or other wireless nunchuk initialised the old way
−|-
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #fee;" | 0xFEFE
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" | 0000 A420 0000
−| style="border: 1px solid #ccc; padding: 0.2em; background-color: #eef;" | [[Wiimote/Extension_Controllers#Nunchuk|Nunchuk]]
−|-
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #fee;" | 0xFDFD
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" | 0000 A420 0101
−| style="border: 1px solid #ccc; padding: 0.2em; background-color: #eef;" | [[Wiimote/Extension_Controllers#Classic_Controller|Classic Controller]]
−|-
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #fee;" | 0xFDFB
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" | 0000 A420 0103
−| style="border: 1px solid #ccc; padding: 0.2em; background-color: #eef;" | [[Wiimote/Extension_Controllers#Guitar_Hero_.28Wii.29_Guitars|GH3 or GHWT Guitar]]
−|-
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #fee;" | 0xFDFB
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" | 0100 A420 0103
−| style="border: 1px solid #ccc; padding: 0.2em; background-color: #eef;" | [[Wiimote/Extension_Controllers#Guitar_Hero_World_Tour_.28Wii.29_Drums|Guitar Hero World Tour Drums]]
−|-
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" | 0300 A420 0103*
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" |
−| style="border: 1px solid #ccc; padding: 0.2em; background-color: #eef;" | [[Wiimote/Extension Controllers#DJ_Hero_Wii|DJ Hero Turntable]]
−|-
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" | 0000 A420 0402*
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" | 0x2A2C
−| style="border: 1px solid #ccc; padding: 0.2em; background-color: #eef;" | [[Wii Balance Board]]
−|-
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" | 0000 A420 0405*
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" |
−| style="border: 1px solid #ccc; padding: 0.2em; background-color: #eef;" | Activated Wii Motion Plus
−|-
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" | 0000 A420 0505*
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" |
−| style="border: 1px solid #ccc; padding: 0.2em; background-color: #eef;" | Activated Wii Motion Plus in Nunchuck passthrought mode
−|-
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" | 0000 A420 0705*
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" |
−| style="border: 1px solid #ccc; padding: 0.2em; background-color: #eef;" | Activated Wii Motion Plus in Classic Controller passthrought mode
−|}
−
−(4)A60000:
−
−{| style="border-collapse: collapse; padding: 0.2em 0.2em 0.2em 0.2em;"
−|- style="text-align: center;"
−| style="border: 1px solid #ccc; padding: 0.2em; background-color: #fdd;" | '''Encrypted'''
−| style="border: 1px solid #ccc; padding: 0.2em; background-color: #dfd;" | '''Decrypted'''
−| style="border: 1px solid #ccc; padding: 0.2em; background-color: #ddf;" | '''Meaning'''
−|-
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" | 0000 A620 0005*
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" |
−| style="border: 1px solid #ccc; padding: 0.2em; background-color: #eef;" | Inactive Wii Motion Plus
−|-
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" | 0000 A620 0405*
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" |
−| style="border: 1px solid #ccc; padding: 0.2em; background-color: #eef;" | No-longer active Wii Motion Plus
−|-
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" | 0000 A620 0505*
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" |
−| style="border: 1px solid #ccc; padding: 0.2em; background-color: #eef;" | No-longer nunchuk-passthrough Wii Motion Plus
−|-
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" | 0000 A620 0705*
−| style="border: 1px solid #ccc; padding: 0.2em; text-align: center; background-color: #efe;" |
−| style="border: 1px solid #ccc; padding: 0.2em; background-color: #eef;" | No-longer classic-passthrough Wii Motion Plus
−|}
−
−
−The values marked with a * are actually already unencrypted, and should not be decrypted. They are given here along with unencrypted version for those wanting to use simplified detection code. You can easily tell whether a value should be decrypted or not by looking at the other values in the 0xa400fa to 0xa400fd region.
−
−The "Partially inserted" condition allegedly occurs when the connector is loose or has a bad connection. Usually, this will correct itself upon full insertion. However, it has been known to "stick" in the partially inserted state rarely. This is a hardware glitch, the fix is to simply disconnect and reconnect the Extension Controller. Third party controllers such as wireless nunchuks also return this value if initialized with the old method, in which case the whole last 16 bytes will be FF.
−
−Contrary to previous documentation, the 0000 0000 0000 value does NOT occur when nothing is inserted. Instead you get error 7 when you try to read the expansion type. A successful 0000 0000 0000 only occurs when a BladeFX wireless nunchuk is synced, initialized with the old method, then the adapter is unplugged, then the adapter is replugged.
−
−A [[Wii Balance Board]] extension is only found in a Wii Balance Board. Although it exposes functionality as an Extension Controller, they are not separable and this controller is documented separately.
−
−=== Encryption setup ===
−After the identification is read, the encryption can be set up if required. This is done by enabling encryption by writing 0xAA to extension register 0xF0, and then writing the 16-byte key to register 0x40. The key is written in 3 blocks of 6, 6, and 4 bytes. (Writing a single encryption byte to register 0x40 will work on genuine Nintendo controllers, but not on others). After this the extension can be operated in full encryption mode.
= Extension Controllers =
= Extension Controllers =
−''[[Wiimote/Extension Controllers]]''
−= Notes =
= Notes =