CrazyIvan

There's a nice little PC USB writeup with some decent sample code here:

http://www.alanmacek.com/usb/

That sucks that the host has to tell the controller to start sending chatpad keys. If that bit could be figured out (captured) it could be sent from the PC to a connected controller to hopefully activate it on Windows. Would a new PID device then show up or would keys start showing up in windows via the controller HID device? If the activation sequence could be captured on an xbox maybe the sample code could be used to send it to the controller from a PC...

The vid/pid for the xbox360 controller is 45e/719:

MP3Car.com

 

ioi8

Ok, i took a digital oscilloscope to the uart leads of the controller. This is what i have found out.

Looking at the controller normally, the leads go from left to right as:

Ground, Recieve (Rx), Transmit (Tx), Vpp (3V)

Now, my oscilloscope could not tell if this was 3.3V uart or 5v uart, but im guessing the 3.3 version because the power source is 3v. Anyone care to comment on the voltage levels of the signals?

Also, the baud rate of the uart is 120 buad. This is really slow, but i guess it doesnt need to be any faster.

The controller polls for external ascessories with the command 0x8C. Once there is a return signal, the controller holds the Tx line high.

So to activate the keyboard, you need to send the signal of 0x8C at 120 buad serially to the keyboard's Rx line. Once that occurs, im sure the keyboard will start spitting out characters. However, i dont have a chatpad, so i cant be too certain.

wmpwi

This is kind of exciting. Watching a hacking project in real time.

__________________
A computer lets you make more mistakes faster than any invention in human history
- with the possible exceptions of handguns and tequila.

thermoptic

Unicode sounds logical. I believe you own an XBOX 360, correct? Ideally you have the wireless controller and you can drop it right into your testbed. Three test leads to clip... what are you waiting for?

I have a similar hacked MAX 232 which I can interface directly to PC software or to an external RS-232 hardware analyzer (1 us granularity and autobaud capabilities via Xilinx FPGA) with some commercial decoder software. Unfortunately this setup only handles RS-232 and I have to remap signals to snoop a circuit, thus only RX or TX is decoded to hex. It gets the job done using only one serial port.

I referenced a USB logic analyzer earlier in this thread that I have not used, but have heard great things about from a co-worker. Nice form factor.

http://www.pctestinstruments.com/
http://www.pctestinstruments.com/log...terpreters.htm

Good luck on your current endeavor and hopefully you find some time over the next few weeks to devote to the chatpad.

thermoptic

Thanks for probing the controller port. The signal level will be 3.3V for wired controllers and 3.0V for wireless (AA x 2):

http://pictures.xbox-scene.com/xbox3...ort_pinout.jpg

Yeah, 120 baud seems very slow. Since we are not dealing with symbols, 120 baud is 120 bps, which yields 8.333 ms per bit. Assuming 8-N-1, a single transfer would be ten characters requiring 83.33 ms. With UTF-8 you would have one or maybe two data bytes per character. A worst case of two-byte UTF-8 would require 166.66 ms per character. Now a tweaked gamer full of redbull could fire off 6 characters per second which hits the 1 second ceiling. This is pushing it...especially if you factor in in-band messaging/control characters. Perhaps the keypad matrix refresh timing keeps the rate below a few characters per second? Too many assumptions...

Can you determine the UART format? Is it using one start bit, eight data bits, and one stop bit? Perhaps you need more data to decipher the format? I had a difficult time with my hacked setup and I have no XBOX. If you have an XBOX, chatpads are only $30. That's a drop in the bucket... Just think of all the deprived chatpad owners who need PC chatpad access . . . this is a global crisis!

c0nsumer

Bah. My current project just went in the toilet (realized the sniffer I was building wouldn't capture the Honda CD changer protocol properly, so I need to redesign it) so I'm going to tear into my chatpad now. I have to send in my 360 for repair anyway (yes, one of the new models is already bad) so I think this is a good time.

mungewell

you have to do it yourself. ;-)

Enjoy,
Mungewell

Attached Images

	chatpad_hardware.pdf (261.5 KB, 269 views)

c0nsumer

Well, I didn't have much luck. I had no problem connecting the 360 chatpad's data lines to a PC's serial port via a MAX232, but when I tried every baud rate I had in the app I normally use, I was only getting back what appeared to be garbage. Nothing seemed to produce consistent results. Of course, I used no parity bits and one stop bit for everything. This could be wrong, but I don't currently know how to determine that without a logic analyzer or DSO, neither of which I have.

I was able to see (thanks to my crappy old scope) that the data appears to be 0-2V. This made me wonder if it was too close to the threshold of the MAX232 and maybe I actually am getting garbage. The data appeared almost consistent, but key presses didn't throw up anything particularly recognizable.

I'll probably poke with this more a bit later, but for now I'm calling it a night.

Oh, here's a couple more photos:

• Detail of soldered jumpers so the test leads would fit.
• Full res screenshot of captured data.

MP3Car.com

 

mungewell

I hate to sound negative, but you're probably going to find it difficult to reverse engine the protocol that this thing uses without a scope (at least till someone gets some understanding of it).

My guess would be that it'll use some weird multi-byte protocol (this is Microsoft after all) and they will probably be scan-codes with 'pressed', 'repeat' and 'released' information.

Looking at the keyboard it has an extended character set and there are also the right/left shifts to accomodate.

A few questions to get you thinking:
1). Do the shift lights light when pressed, ie. does it require the 360 to set their state.

2). If you hold a key down do you get the same sequence of data repeated?

3). Do you get one instance of different data when key is released?

Good luck,
Mungewell.

PS: for reference on PS2 keyboard operation:
http://www.computer-engineering.org/ps2keyboard/

c0nsumer

I think a logic analyzer would be much more useful, which is why I'm not going much further. I don't personally have much of a need for this, I just wanted to see if it was possible / how easy it might be. Maybe someone else can pick things up.

I also wouldn't be surprised if MS does some manner of key exchange between the two devices, then encrypts things, uses a pre-shared key, or who knows what. That'd help keep third party devs from making their own keypads with macros and whatnot.

ioi8

Hey guys, this is my logic analyzer.

http://cgi.ebay.com/PC-USB-Oscillosc...QQcmdZViewItem

It works pretty good, although i cannot stream digital logic. I have to capture it first before i can see the data. I hope one day i can own one of these bad boys.

http://www.usbee.com/

Too expensive for anything we do here. But it would be great for what i would like to do.

Im thinking about buying a chatpad really soon. My gf wants to dump me, so all the money im saving by not spending on her anymore i can put forth on the 'puter. O well.

sporty_drew

Hey i love your logic

I hope you decide to hop in a give these guys a hand.

__________________

thermoptic

Nice! You could overthrow a small country with the DX.

c0nsumer

I had one of those and sold it after finding it to be a huge pain in the ***. The buffer wasn't large enough to hold any reasonable amount of serial data, it not being isolated from the PC made noisy grounds a problem (my Dell laptop is really bad for this), and the build quality of the board itself just wasn't that great.

Also, the scope probes which come with it are basically just cheap multimeter probes with a BNC connector on the end.

I'd say you can do a lot better buying a Bitscope. Or the ZXbee, but with the Bitscope you at least get a scope as well... Personally I'm probably just going to drop the $1200 on a decent Tek scope (2002B or so) and maybe eventually a better PC-based logic analyzer. (Such as the aforementioned Intronix / pctestinstruments.com one.)

Detailed photos of the HobbyLab which I took are available here.

mungewell

And for anyone who's interested, here's the layout of the keyboard matrix.



I am thinking that any project to 're-purpose' this keyboard would be better served by having a web page of it's own, rather than existing in a forum discussion list. I would suggest Sourceforge as a suitable location (I have used them before for hardware/firmware projects).

As I see there are 2 halves/alternatives to this project:
1). A keyboard driver that listens on a serial port and speaks 'chatpad' protocol.
2). Alternative firmware for PIC which make it behave like a normal PS/2 keyboard.

I have thought of a pretty goodname (ssshhh top secret) and will register it to set up a project if others think that it is a good idea.

My other projects have be GPL'ed licensed, which prevents commercial exploitation of 'our' work, but still allows openness for others to build on our combined knowledge. I would prefer to work under a similar license.

Cheers,
Mungewell.

Attached Images

	chatpad_matrix.pdf (33.6 KB, 273 views)

MP3Car.com