Reverse engineering Joy-Con of Nintendo Switch

Nintendo SwitchReverse engineered Joy-Con, a dedicated controllerdekuNukemThinks that the result is an open source project sharing siteGitHubPublished on above.

GitHub - dekuNukem / Nintendo_Switch_Reverse_Engineering: A look at inner workings of Joycon and Nintendo Switch
https://github.com/dekuNukem/Nintendo_Switch_Reverse_Engineering

The information published on GitHub is the information of "after" that disassembled the Nintendo Switch apart. If you check the process of disassembling Nintendo Switch by iFixit below beforehand, it becomes easier to understand what part you are talking about.

Disassembled Nintendo Switch apart, proved easy to repair and designed to be used long - GIGAZINE


The following motherboardsOn the left in Joy-Con. Joy-Con operates at 1.8 V. The built-in keypad scanner "BCM 20734" reads buttons at an operating clock of 128 KHz. this isTASOr Twitch, Joy - Con is not pointing out, "Since ProCon is probably different, it is necessary to purchase (if playing with TAS or Twitch)." There is a joystick button as a button other than the keypad, which works by pushing it.


The bus has 4 Mb of "MX25U4033E" flash memory and 6 axesMEMSTwo accelerometers and gyroscope "LSM 6 DS 3"SPIThere are devices. At the moment the Joy - Con 's battery is connected, the following SPI line will flow and connect with the Nintendo Switch body. When accessing the flash memory, SCK operates at 12.5 MHz, but when accessing the MEMS chip it switches to 6.25 MHz.


When the SPI device is connected, the microcontroller resets the software of the MEMS chip and sets the accelerometer and gyroscope as follows.

·Accelerometer
ODR: 1.66 KHz
Full scale: ± 8 g

· Gyroscope
ODR: 208 Hz
Full scale: 2000 dps

The accelerometer has a 100 Hz bandwidth AA filter with lowpass filtering enabled and a slope filter with a cutoff frequency set to 416 Hz. Joy - Con polls all the accelerometer and gyroscope data at every axis at 1.35 ms (740 Hz). Joy-Con polls the MEMS data every 1.35 ms, but since it only sends controllers updates every 15 ms, it may mean that averaging may be done internally to make the data smoother .

When Joy - Con is connected to the main unit, Joy - Con will communicate with the main unit via the physical connection terminal instead of Bluetooth. There are ten pins on this physical connection terminal.


Take out the connecting terminal part like this. When the left and right Joy-Con face each other, the left end is PIN 1 and the right end is PIN 10.


The last few bytes of each command of Joy-Con is some sort ofChecksumIt seems that it is becoming. It seems that it will become difficult for the console to not accept commands with wrong checksums and to test the behavior of each command.

An example of a checksum is as follows.

19 01 03 07 00 91 10 00 00 00 00 3D
19 01 03 07 00 91 01 00 00 00 00 24
19 01 03 07 00 91 11 00 00 00 00 0 E

19 81 03 07 00 94 10 00 00 00 00 D 6
19 81 03 07 00 94 11 00 00 0 F 00 33

In normal operation, the Nintendo Switch body requests Joy-Con to update every 15 ms. Commands requesting update are as follows.

19 01 03 08 00 92 00 01 00 00 69 2 d 1 f

About 4 ms afterwards, Joy - Con responds with a length of 61 bytes. An example of response is as follows.

19 81 03 38
00 92 00 31
00 00 e 9 2 e
30 7f 40 00
00 00 65 f 7
81 00 00 00
c 0 23 01 e 2
ff 3e 10 0 a
00 d6 ff d0
ff 23 01 e1
ff 37 10 0 a
00 d6 ff cf
ff 29 01 dd
ff 34 10 0a
00 d7 ff ce
ff

From here we guessed what each byte represents, following the figure


In addition, the 16th and 17th bytes indicate the state of the button, and pressing the button sets the corresponding bit to 1.


Values ​​for the joystick are contained in the 19th and 20th bytes and are sent as raw 8 bit ADC data. The 19th byte indicates the X axis, the 20th byte indicates the value of the Y axis, and the 4 bit information on the X axis is sent in a state inverted to an odd thing.

What information is included in other bytes is currently being decoded. However, it seems that it contains battery level, button state, joystick position, accelerometer and gyroscope data, etc.

The capacitive touch screen controller of FT 9 CJ is adopted as the touch screen controller which controls the touch screen of Nintendo Switch.Tech InsightsAccording to, this touch screen controller seems to be custom parts for STMicroelectronics' Nintendo Switch. It is said that it is being polled every 4 ms for updating.


The dedicated dock for the Nintendo Switch uses a microcontroller called "STM32F048". The motherboard is labeled "STM32F048", which seems to be used by ST to preprogram the flash memory in the factory using the FASTROM option. The dedicated dock has 32 KB of flash memory and 6 KB of RAM (memory), and operates at 48 MHz.


Besides that, detailed role of each connector pin in Joy - Con and data verifying the difference of response of Joy - Con in detail are also released.

GitHub - dekuNukem / Nintendo_Switch_Reverse_Engineering: A look at inner workings of Joycon and Nintendo Switch