Thread: xbox360 chatpad, awsome backlit mini keyboard

Well, I broke down and purchased a chatpad and controller. Disassembly was a breeze with c0nsumer's photos. This morning I traced the J1 connector signals to the PIC 16F883. The good news is that the I/O connection is using the UART TX/RX lines.

The UART link appears to use 115200 8-N-1. There is a NULL character handshake sequence with some data exchange. I see this at connect and disconnect. I could be off on the link settings. Keep in mind that I am connected to a PC and not an XBOX, so the controller is not activating the chatpad. c0nsumer or someone else with a TTL serial analyzer should be able to sniff the link on an XBOX-connected controller. The J1 surface mount pins are large enough for micro test clip connections, so no soldering required.

Once we get the init sequence and decode the keycode protocol this will be a snap! I have two candidates for the UART-to-USB HID host side translation. I have included I/O information and partial BOM reference information below. I am guessing on U2, mainly from diode drop readings. I briefly reviewed the LED backlight circuitry. The U5 part has a "AUH" laser marking but I was unable to decipher the part. Not really an issue since I plan to interface at J1.

Parts
(Q3, Q5, Q6, Q7) PMBT2222A NPN Transistor SOT23 (W1P Marking):
http://www.nxp.com/acrobat_download/...22_2222A_5.pdf

(U2) BAV99DW Switching Diode Array SOT363 (JG Marking):
http://www.diodes.com/datasheets/ds30145.pdf

SMD Marking Decoders
http://www.tkb-4u.com/code/smdcode/
http://lab.artematrix.org/papers/SMD_codes.pdf (PDF Version)

Package Types
http://www.infineon.com/cms/en/produ...ed_Devices/SOT

Originally Posted by CrazyIvan

Hi all,

Great site you have here. Has anyone sniffed the PC to wireless gaming receiver USB connection (or just the direct controller USB connection if not using wireless) to see if the keystrokes are obfuscated at all? Even if they aren't ascii or PS2, as long as the same code is sent as USB data for the same key each time it is pressed we are off to the races.

You will need a hardware USB protocol monitor to snoop the USB connection on a controller connected to the XBOX 360. I don't think you will get much from the link on the PC side. I could be wrong here as I don't know much about USB driver programming (yet ) . If we compare the USBView readings with and without the chatpad connected, would this give us more insight into the interface? I will investigate more when I get some time.

It looks like we roll our own interface now and wait for Mircosoft to get off their duff and release a PC driver. Maybe end of next year? They could release interface specs and host the driver development as an open source project on CodePlex (http://www.codeplex.com/). Maybe they would have to divulge too much? Definitely not Microsoft's style.

I think the XBOX 360 host side queries the controller for devices. If present, then the chatpad is initialized (i.e. backlight illuminates) and key strokes are processed. For the PC side, the host side doesn't instruct the controller to initialize the chatpad and it is ignored. I suppose it depends on the level of controller intelligence. Is host-side initialization required before keystroke codes are sent to the PC?

Any seasoned USB driver developers in here? What's your take?

Originally Posted by thermoptic

Well, I broke down and purchased a chatpad and controller. Disassembly was a breeze with c0nsumer's photos. This morning I traced the J1 connector signals to the PIC 16F883. The good news is that the I/O connection is using the UART TX/RX lines.

The UART link appears to use 115200 8-N-1. There is a NULL character handshake sequence with some data exchange. I see this at connect and disconnect. I could be off on the link settings. Keep in mind that I am connected to a PC and not an XBOX, so the controller is not activating the chatpad. c0nsumer or someone else with a TTL serial analyzer should be able to sniff the link on an XBOX-connected controller. The J1 surface mount pins are large enough for micro test clip connections, so no soldering required.

Nice work. I'm glad to see someone else actually digging into things. It's convenient that the work I'm doing right now (not on this project) just happens to be a serial data level converter for communicating with some specialized machinery. I've got a toolchain already in place to do bidirectional serial decoding with a very hacked together decoder. I just use a MAX232 (clone), two serial ports on my PC, and some freeware serial port monitoring software.

How much would you like to bet we'll just see the chatpad spitting out unicode strings?

There's a nice little PC USB writeup with some decent sample code here:

http://www.alanmacek.com/usb/

That sucks that the host has to tell the controller to start sending chatpad keys. If that bit could be figured out (captured) it could be sent from the PC to a connected controller to hopefully activate it on Windows. Would a new PID device then show up or would keys start showing up in windows via the controller HID device? If the activation sequence could be captured on an xbox maybe the sample code could be used to send it to the controller from a PC...

The vid/pid for the xbox360 controller is 45e/719:

Ok, i took a digital oscilloscope to the uart leads of the controller. This is what i have found out.

Looking at the controller normally, the leads go from left to right as:

Ground, Recieve (Rx), Transmit (Tx), Vpp (3V)

Now, my oscilloscope could not tell if this was 3.3V uart or 5v uart, but im guessing the 3.3 version because the power source is 3v. Anyone care to comment on the voltage levels of the signals?

Also, the baud rate of the uart is 120 buad. This is really slow, but i guess it doesnt need to be any faster.

The controller polls for external ascessories with the command 0x8C. Once there is a return signal, the controller holds the Tx line high.

So to activate the keyboard, you need to send the signal of 0x8C at 120 buad serially to the keyboard's Rx line. Once that occurs, im sure the keyboard will start spitting out characters. However, i dont have a chatpad, so i cant be too certain.

This is kind of exciting. Watching a hacking project in real time.

Originally Posted by c0nsumer

Nice work. I'm glad to see someone else actually digging into things. It's convenient that the work I'm doing right now (not on this project) just happens to be a serial data level converter for communicating with some specialized machinery. I've got a toolchain already in place to do bidirectional serial decoding with a very hacked together decoder. I just use a MAX232 (clone), two serial ports on my PC, and some freeware serial port monitoring software.

How much would you like to bet we'll just see the chatpad spitting out unicode strings?

Unicode sounds logical. I believe you own an XBOX 360, correct? Ideally you have the wireless controller and you can drop it right into your testbed. Three test leads to clip... what are you waiting for?

I have a similar hacked MAX 232 which I can interface directly to PC software or to an external RS-232 hardware analyzer (1 us granularity and autobaud capabilities via Xilinx FPGA) with some commercial decoder software. Unfortunately this setup only handles RS-232 and I have to remap signals to snoop a circuit, thus only RX or TX is decoded to hex. It gets the job done using only one serial port.

I referenced a USB logic analyzer earlier in this thread that I have not used, but have heard great things about from a co-worker. Nice form factor.

http://www.pctestinstruments.com/
http://www.pctestinstruments.com/log...terpreters.htm

Good luck on your current endeavor and hopefully you find some time over the next few weeks to devote to the chatpad.

Originally Posted by ioi8

Ok, i took a digital oscilloscope to the uart leads of the controller. This is what i have found out.

Looking at the controller normally, the leads go from left to right as:

Ground, Recieve (Rx), Transmit (Tx), Vpp (3V)

Now, my oscilloscope could not tell if this was 3.3V uart or 5v uart, but im guessing the 3.3 version because the power source is 3v. Anyone care to comment on the voltage levels of the signals?

Also, the baud rate of the uart is 120 buad. This is really slow, but i guess it doesnt need to be any faster.

The controller polls for external ascessories with the command 0x8C. Once there is a return signal, the controller holds the Tx line high.

So to activate the keyboard, you need to send the signal of 0x8C at 120 buad serially to the keyboard's Rx line. Once that occurs, im sure the keyboard will start spitting out characters. However, i dont have a chatpad, so i cant be too certain.

Thanks for probing the controller port. The signal level will be 3.3V for wired controllers and 3.0V for wireless (AA x 2):

http://pictures.xbox-scene.com/xbox3...ort_pinout.jpg

Yeah, 120 baud seems very slow. Since we are not dealing with symbols, 120 baud is 120 bps, which yields 8.333 ms per bit. Assuming 8-N-1, a single transfer would be ten characters requiring 83.33 ms. With UTF-8 you would have one or maybe two data bytes per character. A worst case of two-byte UTF-8 would require 166.66 ms per character. Now a tweaked gamer full of redbull could fire off 6 characters per second which hits the 1 second ceiling. This is pushing it...especially if you factor in in-band messaging/control characters. Perhaps the keypad matrix refresh timing keeps the rate below a few characters per second? Too many assumptions...

Can you determine the UART format? Is it using one start bit, eight data bits, and one stop bit? Perhaps you need more data to decipher the format? I had a difficult time with my hacked setup and I have no XBOX. If you have an XBOX, chatpads are only $30. That's a drop in the bucket... Just think of all the deprived chatpad owners who need PC chatpad access . . . this is a global crisis!