Hacking Hacking the WiiU gamepad

[Arisotura]

This is a project I've had in mind since 2016. I even made attempts back then, and in 2022, but they went nowhere because I lacked proper equipment and skill. I've been trying again about 3 months ago, with more success.

Basically, the WiiU gamepad could technically function as a standalone device, and I've thought since 2016 that doing so would be nifty.

The main entry barrier here is that the only way to upload code to the gamepad is via the wifi update functionality, but for that, you need to have a functional firmware installed, so that excludes any sort of reverse-engineering work.

Unless you're willing to pull out the big guns...

This FPGA board is replacing the onboard FLASH. Not only does it let me upload custom code to the gamepad easily, it also serves as a handy debug output. Without this, during my previous attempts, I was pretty much blind -- the only output I had was toggling the rumble motor, since I didn't know how to turn on the LCD.

This time, I was also able to finally turn on the LCD and display stuff.

These were early tests, but here's a little list of what we covered so far:
* Basic hardware initialization
* LCD and framebuffer initialization
* UIC comm and basic input
* DMA, most if not all of the functionality

I am currently trying to get wifi working (and having a bit of a hard time).

The hardmod above is technically cool but not very practical, obviously the FPGA board doesn't fit in the gamepad case

My idea would be to make a sort of custom menu that could be installed to a gamepad over wifi. The menu would then allow to install and launch homebrew apps over wifi, launch the stock gamepad firmware, or uninstall the menu and revert the gamepad to stock functionality.

I have even been fantasizing about possible addons to add a SD card or other storage (for example via the expansion connector), but we'll see how far we can get with this, I guess. I know this is a pretty niche thing, but I find it nifty.

We're also documenting the gamepad's hardware: https://kuribo64.net/wup/

 

[CMDreamer]

The Wii U gamepad is a little gem in the right hands, possibilites are endless!

Now I'm following this thread.

Great job!

EDIT:

I was thinking about a custom board to fit the gamepad's dimensions using -if not the same- a FPGA of some sort, with all the common features (i.e. Bluetooth, WiFi, USB-C, microSD, etc.), and also a hardware interface for reusing the gamepad's joysticks and buttons.

 

[neverendsDull]

If the pad can be used as a streaming device indenpendent of the console, like the new PS streaming one then....

Anyway it is a gread work indeed.

 

[CMDreamer]

If the pad can be used as a streaming device indenpendent of the console, like the new PS streaming one then....

Anyway it is a gread work indeed.

Even better, how about an HDMI external screen for any HDMI enabled device, that would be awesome.

 

[Arisotura]

EDIT:

I was thinking about a custom board to fit the gamepad's dimensions using -if not the same- a FPGA of some sort, with all the common features (i.e. Bluetooth, WiFi, USB-C, microSD, etc.), and also a hardware interface for reusing the gamepad's joysticks and buttons.

Oh yeah, you would outright replace the gamepad's motherboard with different hardware. I don't think that's been done before in console homebrew/modding history, but that's an interesting idea for sure! I don't know what parts can be sourced by a hobbyist like me, but with a FPGA one would have more possibilities for sure.

But first I need to manage to use the original gamepad's features I'm having a hard time with the wifi stuff, which is a bit of a problem for my plans.

 

[Dakangel]

An amazing achievement!

Reverse engineering (studying and documenting) the hardware and software of a device needed to make another symbiont device work properly opens up the great possibility of cloning its operation or, at least, of manufacturing replacement Gamepads.
Something that was always promised but never came even from third party developers.

 

[emcintosh]

Oh yeah, you would outright replace the gamepad's motherboard with different hardware. I don't think that's been done before in console homebrew/modding history, but that's an interesting idea for sure!

People are definitely eviscerating innocent GamePads to make Raspberry Pi portables. It’s just that comfortable a device, and the buttons are run off ribbon cables you can attach breakout boards to. I found out about this when I was trying to get a list of the test points for fitting my ABXY back buttons.

 

[ChibiMofo]

People are definitely evicerating innocent GamePads to make Raspberry Pi portables. It’s just that comfortable a device, and the buttons are run off ribbon cables you can attach breakout boards to.

Yeah! And it's not as if there are a shortage of Wii U Gamepads out there and that we won't -- as a community -- be sorry some day that people destroyed perfectly serviceable Gamepads in the name of... doing something they can already do cheaper and less destructively.

 

[Arisotura]

yeah... if you're going to do that, might as well just get spare gamepad shell parts and such, or 3D-print it... idk.

Post automatically merged: Oct 14, 2024

Status update... I've been stuck on a weird problem with the wifi stuff for a while now. Not sure if there are any experts in Broadcom wifi stuff around (more specifically BCM4319)? Or where I could go to ask? I tried visiting some IRC channels but they're long dead.

I'm almost getting to the point where I can upload firmware to the wifi board. Except I can't read or write to the memory on there. I can access the registers and enumeration ROM just fine, so I know that code is working. I know the memory core is up and running. Yet, can't access the RAM. Reading results in a data timeout error, and leaves the system in some general error state where nothing works again. Writing doesn't work either, the 'write FIFO ready' IRQ just never comes, and when using DMA nothing actually gets transferred.

I don't understand at all why this happens. I double, triple checked everything in my init code and everything is right as far as I can see. I'm stumped here.

I guess I'll take a short break from this stuff, as much as my brain hates being stuck and wants to stick to this until I have it figured out. Maybe it will help me get fresh ideas.

 

[Duoslow]

uh do you know the battery pinout schema ? (+,?,-,?) i need it but i cant find it anywhere

Post automatically merged: Oct 15, 2024

uh do you know the battery pinout schema ? (+,?,-,?) i need it but i cant find it anywhere

 

[emcintosh]

uh do you know the battery pinout schema ? (+,?,-,?) i need it but i cant find it anywhere

Post automatically merged: Oct 15, 2024

uh do you know the battery pinout schema ? (+,?,-,?) i need it but i cant find it anywhere

has a pinout and description of the charge controlling chip. You want to look for people who have replaced the battery with a larger one and connected the original chip and plug.

 

[Arisotura]

Status update. I did figure out the wifi problem I was having. I'm able to upload firmware and get the wifi card up and running now, still need to work out how to do basic things like scanning for APs, connecting, sending and receiving shit...

Once the wifi stuff is tackled I'll be able to work towards making a first version of a releasable menu thing for the gamepad.

I'll try to see if I can embed some open-source BCM43xx firmware, so one wouldn't need to dump firmware from the stock gamepad firmware...

 

[Blythe93]

I wish you good luck with your project! Following this thread now for the future updates!

 

[neverendsDull]

Gary has certain repo for DRC firmware, so maybe you can ask him?
repo here

He also has Discord channel, not sure if I should share it here though.

 

[jeffyTheHomebrewer]

Just replying here so I can get notifications on this thread, but it would be REALLY nice if we could get back the old TV remote design for the gamepad from earlier firmware versions (mainly the Nintendo TVii era)

 

[zal16]

Do you have any documentation or knowledge about the AIC3012 audio amplifier? I'm currently upgrading the audio on my gamepad. So far, I've replaced the original speakers with Switch OLED speakers, but overall, the sound is richer, however, it's low. In fact, even the P2 sound is low, and in this specific case, I was able to resolve it by removing and bridging the two resistors R3 and R5 in series with the P2 output. However, for the speakers, it appears the sound comes directly from the amplifier without resistors in the path. My intention is to find a way to make the amplifier output a stronger signal to the speakers, similar to some smartphone apps that "unlock" slightly higher volumes not designed by the smartphone manufacturer, but which work well in some cases.

 

[Arisotura]

Status update. I was almost done with the wifi initialization -- managed to retrieve the adapter's MAC address and would just need to write proper code so I can finish the init sequence.

Keyword 'was'.

The project is suffering a setback because my gamepad's motherboard shat itself in a pretty permanent way. That motherboard was already faulty -- it was damaged when I received it, and was faulty even after fixing the damage. It was able to run my custom code, but not the stock firmware. No idea why...

@zal16 I haven't found any documentation about it so far...

I found a datasheet for the AIC3101, might be close enough. Seems there's nothing on the AIC3012.

 

[Jayro]

Oh yeah, you would outright replace the gamepad's motherboard with different hardware. I don't think that's been done before in console homebrew/modding history, but that's an interesting idea for sure! I don't know what parts can be sourced by a hobbyist like me, but with a FPGA one would have more possibilities for sure.

But first I need to manage to use the original gamepad's features I'm having a hard time with the wifi stuff, which is a bit of a problem for my plans.

QMTech makes a DE10-Nano FPGA board (Used for the MiSTer project) that has the bulky SDRAM soldered to the board itself, so a compact setup. You could TOTALLY put it inside this thing after desoldering a few things you won't need, like GPIO pins, the Ethernet port, etc to make it slimmer. It even has a SNAC port for lag-free control inputs directly to the FPGA chip for the lowest-possible latency, and I feel it would be the best contender for something like the WiiU gamepad.

 

[blackkawa]

But the chip controller of the gamepad is not a off the shelves part? I thought so. Then it would be easier making a new replacement board from common parts, than making a fpga replacement, but i see that a fpga one would open many possibilities, since it would make the DE10-Nano as a portable device, and since it can reproduce many game systems, it would be a interesting replacement. But i like more the reproduction board way, since a DE10-nano can be very costly to import

 

[Nokia_guy123]

This thread is intersting! Sureley following it.