Hacking [WIP] Emulating Skylander Portal with Arduino

dpad_5678

Ape weak on own. Ape strong in unity.
OP
Member
Joined
Nov 19, 2015
Messages
2,219
Trophies
1
XP
2,880
Country
United States
NOTE: We are trying the emulate the Skylanders Portal for the Wii/WiiU/PS3/PS4 games! Xbox 360 (and most likely ONE, as well) looks for a certain security chip in any USB peripheral attached. This is most likely impossible to emulate with an Arduino


If you're skeptical right away, here's a video:




Download The Portable Arduino Environment (with example code)
Download The Test GUI Program
Download Zadig 2.0.1


So I wanted to figure out a way to get the Skylanders Swap Force game to recognize my Arduino Micro (Micro and Leonardo have Atmega32u4 which are capable of emulating USB devices). I plugged the Portal into my Windows machine and saw that the Portal was recognized as a Raw HID device. I opened up USBVIEW (lsusb for Windows, basically) and copied down the Vendor ID and Product ID. I searched through my Arduino Installation to find the main USB core code. Finally, I found USBCore.cpp located in \hardware\arduino\avr\cores\arduino\.

I finally found some interesting code in the file:
Code:
D_DEVICE(0x00,0x00,0x00,64,USB_VID,USB_PID,0x100,IMANUFACTURER,IPRODUCT,ISERIAL,1);


As you can see, by changing USB_VID and USB_PID in the line of code, you can change the VID and PID of your Arduino board. I changed mine to the VID and PID of my Portal (all Swap Force Portals have the same PID and VID)

At the end, both lines 75 and 78 read the following:

Code:
D_DEVICE(0x00,0x00,0x00,64,0x1430,0x0150,0x100,IMANUFACTURER,IPRODUCT,ISERIAL,1);


Now, I did brick my Arduino Micro quite a few times messing around with the Keyboard.h's library's main code. Luckily I had my Uno (clone) which I was able to reflash the Micro's bootloader with. If you try this, I recommend you have the same.

So I put together a minimal sketch that includes the Keyboard.h library:

Code:
#include <Keyboard.h>

void setup(){

Keyboard.begin();

}


void loop(){

//nothing to see here

}


And uploaded this to my Micro. I fired up Skylanders Swap Force on my Wii and plugged in the Arduino Micro into the USB port of the Wii. Here's where I got excited: THE GAME RECOGNIZED IT AS A PORTAL! Now I got excited I fired up a Test GUI from a library called HIDAPI, and I plugged in my main Portal. I started placing figures on the Portal and the Portal would send data to the computer (however, the colors of the Portal were not changing based off of the type of character I placed on the Portal).

I used Serial.write(); to try to replicate the data that the Portal was sending to my PC, but I forgot that the Portal used a Raw HID method of data transfer, not Serial. So Serial wouldn't work.

I ripped my copy of Skylanders Swap Force to a WBFS file and started the game in Dolphin. It recognized the (real) Portal, but it wouldn't recognize figures. So I followed these instructions to get the Portal working, and got it. Make sure to use Zadig 2.0.1! So now Dolphin is recognizing the Portal and it's working just like a real console. Because we replaced the driver in Zadig, the Test GUI won't recognize our Portal anymore, so I used USBlyzer to see the data.

I think all we need now is a way to write RAW (!) HID data from the Arduino, because that's the protocol the Portal uses.

I'd really like to get this figured out and get a character emulated.



I used a fresh and portable Arduino environment to do this. You can download it here. This includes the test.ino sketch.
 
Last edited by dpad_5678,

Bug_Checker_

Well-Known Member
Member
Joined
Jun 10, 2006
Messages
950
Trophies
0
XP
664
Country
United States
NOTE: We are trying the emulate the Skylanders Portal for the Wii/WiiU/PS3/PS4 games! Xbox 360 (and most likely ONE, as well) looks for a certain security chip in any USB peripheral attached. This is most likely impossible to emulate with an Arduino


If you're skeptical right away, here's a video:




Download The Portable Arduino Environment (with example code)
Download The Test GUI Program
Download Zadig 2.0.1


So I wanted to figure out a way to get the Skylanders Swap Force game to recognize my Arduino Micro (Micro and Leonardo have Atmega32u4 which are capable of emulating USB devices). I plugged the Portal into my Windows machine and saw that the Portal was recognized as a Raw HID device. I opened up USBVIEW (lsusb for Windows, basically) and copied down the Vendor ID and Product ID. I searched through my Arduino Installation to find the main USB core code. Finally, I found USBCore.cpp located in \hardware\arduino\avr\cores\arduino\.

I finally found some interesting code in the file:
Code:
D_DEVICE(0x00,0x00,0x00,64,USB_VID,USB_PID,0x100,IMANUFACTURER,IPRODUCT,ISERIAL,1);


As you can see, by changing USB_VID and USB_PID in the line of code, you can change the VID and PID of your Arduino board. I changed mine to the VID and PID of my Portal (all Swap Force Portals have the same PID and VID)

At the end, both lines 75 and 78 read the following:

Code:
D_DEVICE(0x00,0x00,0x00,64,0x1430,0x0150,0x100,IMANUFACTURER,IPRODUCT,ISERIAL,1);


Now, I did brick my Arduino Micro quite a few times messing around with the Keyboard.h's library's main code. Luckily I had my Uno (clone) which I was able to reflash the Micro's bootloader with. If you try this, I recommend you have the same.

So I put together a minimal sketch that includes the Keyboard.h library:

Code:
#include <Keyboard.h>

void setup(){

Keyboard.begin();

}


void loop(){

//nothing to see here

}


And uploaded this to my Micro. I fired up Skylanders Swap Force on my Wii and plugged in the Arduino Micro into the USB port of the Wii. Here's where I got excited: THE GAME RECOGNIZED IT AS A PORTAL! Now I got excited I fired up a Test GUI from a library called HIDAPI, and I plugged in my main Portal. I started placing figures on the Portal and the Portal would send data to the computer (however, the colors of the Portal were not changing based off of the type of character I placed on the Portal).

I used Serial.write(); to try to replicate the data that the Portal was sending to my PC, but I forgot that the Portal used a Raw HID method of data transfer, not Serial. So Serial wouldn't work.

I ripped my copy of Skylanders Swap Force to a WBFS file and started the game in Dolphin. It recognized the (real) Portal, but it wouldn't recognize figures. So I followed these instructions to get the Portal working, and got it. Make sure to use Zadig 2.0.1! So now Dolphin is recognizing the Portal and it's working just like a real console. Because we replaced the driver in Zadig, the Test GUI won't recognize our Portal anymore, so I used USBlyzer to see the data.

I think all we need now is a way to write RAW (!) HID data from the Arduino, because that's the protocol the Portal uses.

I'd really like to get this figured out and get a character emulated.



I used a fresh and portable Arduino environment to do this. You can download it here. This includes the test.ino sketch.


I believe the Dropbox link is not reliable.


Also, I'll add this here ( I think there is a YouTube demo)
https://github.com/brandonlw/USBSimulator
http://www.brandonw.net/360bridge/doc.php
http://www.brandonw.net

I believe this shows USBSimulator and discusses xbox360 workaround but with Disney Infinity

 
Last edited by Bug_Checker_, , Reason: Updated

dpad_5678

Ape weak on own. Ape strong in unity.
OP
Member
Joined
Nov 19, 2015
Messages
2,219
Trophies
1
XP
2,880
Country
United States
I like the idea. Could you possibly finish this and, if possible, use the same PoC for amiibos? That would be amazing if you could :D
Unfortunatley this method is based on emulating the Skylanders USB Portal. Amiibo's use external readers/writers (O3DS (XL), 2DS) and built in readers/writers (Switch, Wii U N3DS (XL). So for now, just use the NTAG215 method.
 

bennyman123abc

Well-Known Member
Member
Joined
Mar 21, 2013
Messages
920
Trophies
1
Age
22
Location
Alton, IL
XP
1,201
Country
United States
Unfortunatley this method is based on emulating the Skylanders USB Portal. Amiibo's use external readers/writers (O3DS (XL), 2DS) and built in readers/writers (Switch, Wii U N3DS (XL). So for now, just use the NTAG215 method.
Would it be possible with a rewritable and attached NTAG?
 
  • Like
Reactions: Theprodigyhnic

bengalih

Well-Known Member
Member
Joined
Jun 28, 2009
Messages
133
Trophies
0
XP
438
Country
United States
So this is totally related - but I didn't want to start a new one as this thread isn't super old and also there doesn't seem to be that much interest.

I'm just curious as to why someone wasn't able to create a gct cheat code or something that simply bypasses the portal tricks the game into thinking a particular figure is mounted? I of course wouldn't know where to begin with this, but with all the wizards working on this stuff I'm surprised this was so difficult to do.
 

GreyWolf

Well-Known Member
Member
Joined
Mar 2, 2015
Messages
5,399
Trophies
0
Age
54
XP
1,515
Country
United States
So this is totally related - but I didn't want to start a new one as this thread isn't super old and also there doesn't seem to be that much interest.

I'm just curious as to why someone wasn't able to create a gct cheat code or something that simply bypasses the portal tricks the game into thinking a particular figure is mounted? I of course wouldn't know where to begin with this, but with all the wizards working on this stuff I'm surprised this was so difficult to do.

I'm not certain but I think the game also stores data on the figures, not just reading them.
 

Jubliano

New Member
Newbie
Joined
Oct 24, 2018
Messages
1
Trophies
0
Age
33
XP
43
Country
Netherlands
Awesome work dude, unfortunately the dropbox link is down. Could you reupload the files? Also, how did you capture and decrypt the packets?
 

obiima

Member
Newcomer
Joined
May 14, 2017
Messages
12
Trophies
0
XP
835
Country
Netherlands
FYI. It is possible to emulate a Skylanders portal for Xbox 360 but you need the security chip from a real Xbox 360 Skylanders portal (or another Activision Xbox 360 USB device) or a USB host shield with a real Xbox 360 portal connected to it.
 

Shrommygnome

Member
Newcomer
Joined
Jun 7, 2018
Messages
13
Trophies
0
XP
219
Country
United Kingdom
FYI. It is possible to emulate a Skylanders portal for Xbox 360 but you need the security chip from a real Xbox 360 Skylanders portal (or another Activision Xbox 360 USB device) or a USB host shield with a real Xbox 360 portal connected to it.

Obiima will you continue to develop the v4 board?

Thanks alot in advance
 

Theprodigyhnic

Active Member
Newcomer
Joined
Mar 24, 2017
Messages
32
Trophies
0
Age
33
XP
548
Country
United States
What ever became of this project. All the links are dead. Did he give up working on it. Also anyone have any information on Obiima Disney Infinity base emulator I can’t find information any where. I have been trying to find a copy of his V3 firmware and instructions on how to build it but I haven’t had any luck in finding anything.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    LeoTCK @ LeoTCK: hmm