Dismantling weapons of mass distraction. Reverse engineering the Move Controller extension port. (part 2)
Read Part1
In this second part, we tear down a move controller and its Sharp Shooter attachement in the hope that this will reveal some of their secrets. Did I mention I only have a very basic understanding of electronics? :D Fortunately, we will have some help from the good people of http://bausteln.de/ to make up for my lack of hardware know-how. Please bear with my very naive approach.
The PS Move Controller was Sony's late answer to the Wiimote. Though it has not yet supplanted it, the Move scores over Nintendo's previous device in two important respects. First, it's slightly cheaper (actually, it's slightly more expensive)Â its orientation and position tracking are a lot more precise; and, second, it displays vibrant RGB colors through a large friendly rubber sphere.
Okay, enough nerdy misquoting, let's dive in!
Today's special: japanese lobster.
I won't detail the teardown of the Move controller in itself (iFixit gives very good step-by-step instructions: http://www.ifixit.com/Teardown/PlayStation+Move+Teardown/3594).
The Sharp Shooter didn't get a proper step-by-step teardown either as we only wanted to scavenge the electronic parts from it and weren't particularly careful (however, you can find some information in this video: http://youtu.be/VbreQS4wTUI)
How to cut a lobster in half lengthways.
The remapped buttons are all connected to the main board in the middle that is itself connected to the EXT plug. The trigger block (the black thing next to the main board) is just a piece of plastic that hosts two small circuits: one for the trigger, square and triangle buttons and another for the so-called “firing mode selector”.
Here is how it looks once you get rid of all the plastic.
The button wiring is rather straightforward. The “firing mode selector” has a funny steampunk feel with it's rotating contact strips that alternatively hit each of the three contacts on the board.
All the encoding must happen in the mystery chip on the main board.
It seems to reads: “L1F1 PHVG 113Z”... Hey, wait a minute! “Lifi phug liez” yourself!
We didn't manage to find a datasheet for this chip so it looks like it's custom build. Thank you Sony, don't make it too easy for us, we like puzzles.
Ok, let's have a look at the Move Controller.
The small board at the top left is the EXT connector board.
Now if we take a closer look...
The numbers 1 and 8 seem to mark the pins. However, on the bottom, they are labelled 1 to 9. Finally, if we look closely at the connector itself, we can count 8 pins. So what's going on? I imagine that the ninth contact could be the ground connected to the external metal sheet of the connector (but that's a wild guess).
We can see a mysterious “J15” marking on the top, close to the connector. Looking it up didn't get us very far. This PDF (http://goo.gl/eh9SS) mentions a 9 pin connector called J15 on a machine made by a company that builds “motion controller products”. That gave me hope for a moment before I realized it was just a crazy coincidence.
Going back to the main board on the Sharp Shooter, we can learn a little more about the connection with the EXT port.
That's some nasty soldering!
Just 6 cables? I though it was either 8 or 9. What's going on?
I only have this very bad picture of the EXT plug of the Sharp Shooter but it does seem to have only 6 contacts.
Ok, this is it for today. This teardown brought some answers but also more questions. Next step will be to read the signals and try to understand the protocol. If you have some questions, answers or suggestions, please contact me via my Twitter @sableRaph or post on the psmoveapi mailing list (https://lists.ims.tuwien.ac.at/mailman/listinfo/psmove).
Sharp Shooter manual (click on the “Part names” page): http://uk.playstation.com/ps3/peripherals/detail/item337495/PlayStation%C2%AEMove-sharp-shooter/