1001

[tentimesahundredplusone]

Use logic. Reverse engineering the Move Controller extension port (part 4)

Let's go back to the Sharp Shooter board and take a closer look.

We notice three test pads on the back of the board. Let's assume that the one on the far right is the ground and probe the two others...

Bingo!

Here's a clock signal on the yellow channel and some data on the blue one. Look a the timeline on top and you'll see there is 5 other packets of data similar to this one.

So now we can label our pins as follows:

Fire up the logic analyzer, I2C decoder and be happy:

Next time, we will start diving into the I2C messages themselves and match them to button presses. Stay tuned!

R.

[tentimesahundredplusone]

Under the scope. Reverse engineering the Move Controller extension port. (part 3)

First, I have to thank Alexander Nitsch for pointing me to this previous work by Kenn Sebesta who already did most of the reverse engineering for the Move Controller itself (click for detailled schematics of the Move, custom firmware and reverse engineering of the various sensors in the device).

However, the SharpShooter wasn't available at the time so we don't have much information about the communications through the extension port.

So, let's hook up our disembodied Sharp Shooter to the move and see what happens when we press a button. I probed the 9 pins of the connector inside the Move one after another, pausing the scope and taking a screenshot each time. While measuring, I was randomly pressing on the "reload" button of the Sharp Shooter. 

Here are the readings:

PIN 1

Nothing. Looks like ground to me...

PIN 2

The spikes are me pressing and releasing the button.

PIN 3

Looks pretty much the same.

PIN 4

Another ground?

PIN 5

Same as 2 and 3.

PIN 6

Same but higher voltage.

PIN 7

Same as 2, 3 and 5.

PIN 8

Same as 6.

PIN 9 

Same as 2, 3, 5 and 7.

Actually, the profile of the spikes looked pretty much the same regardless of which button was pressed so I don't really know how these are discriminated. Maybe someone with proper electrical engineering background can enlighten me.

If you have questions or wish to help decoding these, you can reach me on Twitter @sableRaph or join the PS Move API mailing list.

Thanks for reading.

[tentimesahundredplusone]

Dismantling weapons of mass distraction. Reverse engineering the Move Controller extension port. (part 2)

Read Part1 In this second part, we tear down a move controller and its Sharp Shooter attachement in the hope that this will reveal some of their secrets. Did I mention I only have a very basic understanding of electronics? :D Fortunately, we will have some help from the good people of http://bausteln.de/ to make up for my lack of hardware know-how. Please bear with my very naive approach.

The PS Move Controller was Sony's late answer to the Wiimote. Though it has not yet supplanted it, the Move scores over Nintendo's previous device in two important respects. First, it's slightly cheaper (actually, it's slightly more expensive) its orientation and position tracking are a lot more precise; and, second, it displays vibrant RGB colors through a large friendly rubber sphere. Okay, enough nerdy misquoting, let's dive in!

Today's special: japanese lobster. I won't detail the teardown of the Move controller in itself (iFixit gives very good step-by-step instructions: http://www.ifixit.com/Teardown/PlayStation+Move+Teardown/3594).

The Sharp Shooter didn't get a proper step-by-step teardown either as we only wanted to scavenge the electronic parts from it and weren't particularly careful (however, you can find some information in this video: http://youtu.be/VbreQS4wTUI)

So what's inside?

How to cut a lobster in half lengthways.

The remapped buttons are all connected to the main board in the middle that is itself connected to the EXT plug. The trigger block (the black thing next to the main board) is just a piece of plastic that hosts two small circuits: one for the trigger, square and triangle buttons and another for the so-called “firing mode selector”. Here is how it looks once you get rid of all the plastic.

The button wiring is rather straightforward. The “firing mode selector” has a funny steampunk feel with it's rotating contact strips that alternatively hit each of the three contacts on the board.

All the encoding must happen in the mystery chip on the main board.

It seems to reads: “L1F1 PHVG 113Z”... Hey, wait a minute! “Lifi phug liez” yourself!

We didn't manage to find a datasheet for this chip so it looks like it's custom build. Thank you Sony, don't make it too easy for us, we like puzzles.

Ok, let's have a look at the Move Controller.

The small board at the top left is the EXT connector board.

Now if we take a closer look...

The numbers 1 and 8 seem to mark the pins. However, on the bottom, they are labelled 1 to 9. Finally, if we look closely at the connector itself, we can count 8 pins. So what's going on? I imagine that the ninth contact could be the ground connected to the external metal sheet of the connector (but that's a wild guess).

We can see a mysterious “J15” marking on the top, close to the connector. Looking it up didn't get us very far. This PDF (http://goo.gl/eh9SS) mentions a 9 pin connector called J15 on a machine made by a company that builds “motion controller products”. That gave me hope for a moment before I realized it was just a crazy coincidence.

Going back to the main board on the Sharp Shooter, we can learn a little more about the connection with the EXT port.

That's some nasty soldering!

Just 6 cables? I though it was either 8 or 9. What's going on?

I only have this very bad picture of the EXT plug of the Sharp Shooter but it does seem to have only 6 contacts.

Ok, this is it for today. This teardown brought some answers but also more questions. Next step will be to read the signals and try to understand the protocol. If you have some questions, answers or suggestions, please contact me via my Twitter @sableRaph or post on the psmoveapi mailing list (https://lists.ims.tuwien.ac.at/mailman/listinfo/psmove).

Sources:

Sharp Shooter manual (click on the “Part names” page): http://uk.playstation.com/ps3/peripherals/detail/item337495/PlayStation%C2%AEMove-sharp-shooter/

[tentimesahundredplusone]

What the EXT? Reverse engineering the Move Controller extension port. (part 1)

This is the first of a series of posts documenting the efforts to reverse engineer the Playstation Move Controller's mysterious EXT port.

Nobody seems to know how this works...

At the time of this writing, the EXT port is only used by the Sharp Shooter attachement.

The Move itself already received a lot of attention and there is now an API [4] that lets you use the controller in your programs, including button presses, sensor fusion and tracking. However, it has never been used with accessories.

So how does it work when you plug the move into the Sharp Shooter?

First, the buttons on the move still seem to behave as usual: presses get caught by the API. Same for the start and select buttons that are aligned to the real buttons and mechanically transmit the presses.

The “pump action” also directly presses on the trigger.

That's actually where things get complicated.

The trigger on the Sharp Shooter is just a push button with a spring. When fully pressed, it sends the maximum value of the analog trigger (255). That input is still catched by the API. So the question is: how does the Playstation distinguishes between the Sharp Shooter trigger being pressed and a very nervous pump action going suddenly from 0 to 255?

The “square” and “triangle” buttons are identical on both sides of the gun. They seem to work as they would on the controller itself. Same goes for the “move” button under the trigger.

The “Lock” button mechanically prevents accidentally pressing on the “move” button. The 3 positions switch on top is more problematic. It doesn't seem to be mapped to any of the buttons on the move and doesn't get read by the API.

Same for the “reload” button on the bottom.

In the second part, we will tear down the Sharp Shooter and the move and try to eavesdrop on their communications. 

This project is carried on by Raphaël de Courville and Hauke Altmann of Graffiti Research Lab Germany.

Sources: 

Move teardown (video): http://youtu.be/BN2tnTOXzHc

Ifixit move teardown: http://www.ifixit.com/Teardown/PlayStation+Move+Teardown/3594

Sharp Shooter promo video: http://youtu.be/rXNrlAFjq88

PS Move API: http://thp.io/2010/psmove/