Hacking Hacking the WiiU gamepad

[neverendsDull]

Well, 2.4G WIFI for streaming is not a good idea, and since we know the pad has no powerful processor nor plentiful memory, I think it would be better to stick to using the pad as a streaming client instead of an independent console right?

 

[Arisotura]

Depends what you want to do with it, I guess. Technically, no reason it couldn't support both kinds of uses.

 

[jeffyTheHomebrewer]

Status update, been looking into wifi again.

Good news is, I might finally have gotten it to attempt to connect to an AP.

Bad news is, the cheapo dongle thing I'm using to make an AP seems to do something wrong, and nothing can actually connect to it, all I get is "AP not found" errors. The gamepad is able to find the AP's MAC address and attempt to connect, but it seems to either disconnect for some reason, or get nowhere...

So I need to either fix this issue or get a proper 5GHz AP.

Still haven't figured out how to support 2.4GHz... Also unknown if Nintendo's modifications would prevent normal WPA auth from working.

But once I'm able to get a connection going, I can refine this API a bit and port a TCP/IP stack and have network functionality. That would be a milestone.

I don't even know if it HAS a 2.4ghz radio. Pretty sure you'd be better off with trying 5ghz anyway

 

[Arisotura]

I will go with 5GHz because either way you'll need a 5GHz AP if you want to install custom software on the gamepad at all.

The wifi chipset in the gamepad (Broadcom BCM4319) supports both 2.4GHz and 5GHz. The problem is figuring out how to switch between the two. Nintendo's wifi firmware only reports the 5GHz band, so it isn't possible to switch to 2.4GHz. Other firmwares I found are 2.4GHz, and they work to some extent -- I was able to scan for APs -- but they have the opposite problem, can't switch to 5GHz.

Post automatically merged: Jan 18, 2025

Little status update on the wifi front: I'm able to send data frames from the gamepad!

Just a couple problems, I haven't gotten WPA auth to work yet, so I'm doing it with an unsecured AP, which isn't ideal. Also, for some reason my data frame is being sent twice. And the link seems to die after ~10s. But shit is being sent.

At this point I could probably port sgIP (or whatever other TCP/IP stack) and get actual networking going. There's also a lot of cleanup to do to have a proper wifi API.

And also fix the aforementioned issues, but we'll get there.

Once I get networking working, that'll be an important step towards getting out an actual release people could try on their gamepads. Then we'll get to see what people make with it, I guess. Improving the gamepad's existing functionality, building upon it, or making games/emulators/etc, who knows. The gamepad may not be very powerful but it could probably still emulate retro consoles.

 

[jeffyTheHomebrewer]

I will go with 5GHz because either way you'll need a 5GHz AP if you want to install custom software on the gamepad at all.

The wifi chipset in the gamepad (Broadcom BCM4319) supports both 2.4GHz and 5GHz. The problem is figuring out how to switch between the two. Nintendo's wifi firmware only reports the 5GHz band, so it isn't possible to switch to 2.4GHz. Other firmwares I found are 2.4GHz, and they work to some extent -- I was able to scan for APs -- but they have the opposite problem, can't switch to 5GHz.

Post automatically merged: Jan 18, 2025

Little status update on the wifi front: I'm able to send data frames from the gamepad!

Just a couple problems, I haven't gotten WPA auth to work yet, so I'm doing it with an unsecured AP, which isn't ideal. Also, for some reason my data frame is being sent twice. And the link seems to die after ~10s. But shit is being sent.

At this point I could probably port sgIP (or whatever other TCP/IP stack) and get actual networking going. There's also a lot of cleanup to do to have a proper wifi API.

And also fix the aforementioned issues, but we'll get there.

Once I get networking working, that'll be an important step towards getting out an actual release people could try on their gamepads. Then we'll get to see what people make with it, I guess. Improving the gamepad's existing functionality, building upon it, or making games/emulators/etc, who knows. The gamepad may not be very powerful but it could probably still emulate retro consoles.

Any plans on making the FW flashable over Wi-Fi? I don't wanna have to solder something to my gamepad's internals, but would love to give this a test drive someday..

 

[Arisotura]

Yup, that's the plan -- exactly why I'm trying to get wifi working, actually

The stock firmware already has an update functionality, and I'll build up on that.

 

[jeffyTheHomebrewer]

Yup, that's the plan -- exactly why I'm trying to get wifi working, actually

The stock firmware already has an update functionality, and I'll build up on that.

Good. We'd still need some tool on the Wii U console itself to connect to the gamepad in either firmware and either push the custom one, or push the official one. Might be a good idea to impliment an emergency update mode in the case of bricked FW

 

[awesomeee]

Good. We'd still need some tool on the Wii U console itself to connect to the gamepad in either firmware and either push the custom one, or push the official one. Might be a good idea to impliment an emergency update mode in the case of bricked FW

Good idea aswell. We do not want any bricks happening, so this would be a great tool

 

[GaryOderNichts]

Good. We'd still need some tool on the Wii U console itself to connect to the gamepad in either firmware and either push the custom one, or push the official one. Might be a good idea to impliment an emergency update mode in the case of bricked FW

https://github.com/GaryOderNichts/DRXUtil can already flash a modified gamepad firmware.

 

[awesomeee]

edit: Comment deleted

 

[jeffyTheHomebrewer]

https://github.com/GaryOderNichts/DRXUtil can already flash a modified gamepad firmware.

Oh. Too bad it ain't got a precompiled release..

 

[Arisotura]

Good. We'd still need some tool on the Wii U console itself to connect to the gamepad in either firmware and either push the custom one, or push the official one. Might be a good idea to impliment an emergency update mode in the case of bricked FW

My plans are to provide a sort of menu that could do things (launch homebrew or whatever) but also launch the stock firmware. The menu would also let you revert the gamepad to stock firmware (and do so in case of emergency, like unsupported hardware type).

You'd still need either a Wii U or a computer with a compatible wifi connection to push this custom menu to the gamepad. However, my custom menu would ideally support regular wifi networks.

 

[jeffyTheHomebrewer]

Hmm, do you plan to allow the modified Wii U gamepad to emulate a Pro Controller or Wiimote? It would be cool to be able to use a second gamepad for some games.

Edit: Silly question, nevermind. It would be very complicated

My plans are to provide a sort of menu that could do things (launch homebrew or whatever) but also launch the stock firmware. The menu would also let you revert the gamepad to stock firmware (and do so in case of emergency, like unsupported hardware type).

You'd still need either a Wii U or a computer with a compatible wifi connection to push this custom menu to the gamepad. However, my custom menu would ideally support regular wifi networks.

Good, I already have a Wii U (which is what I'd prefer to use, I don't think I have any other wifi hardware that'd work with the stock gamepad FW) but that's good that it can revert like that. Does the gamepad pull a Wii Boot2 and store two copies of the FW, or?

 

[Arisotura]

Good, I already have a Wii U (which is what I'd prefer to use, I don't think I have any other wifi hardware that'd work with the stock gamepad FW) but that's good that it can revert like that. Does the gamepad pull a Wii Boot2 and store two copies of the FW, or?

Yeah. It keeps the current and previous firmware versions. In theory, going back to the stock firmware would be as simple as changing a byte in Flash, as long as the homebrew firmware/menu isn't installed twice.

Even if that were the case, it could still be fixed -- the stock gamepad firmware can be retrieved from Nintendo's CDN, and it will likely be sitting in your WiiU's filesystem too.

 

[Arisotura]

So I got a proper 5GHz access point... and this turned into a little project of its own.

Long story short, I bought a second-hand AP that turned out to be the kind they install in public buildings, hospitals, airports, etc. It was meant to be configured over the Cloud, but the vendor pulled the plug long ago. I had to hack it and install OpenWRT to make it useful.

I tried connecting the gamepad to it, and so far:

* I had to set the AP to 802.11n. Apparently, the gamepad won't connect to a 802.11ac network.

* I successfully had the gamepad connect to an open network. This time, I do get the proper "joined network" events, and the link doesn't die. So it seems I was right about the dongle and its beacons.

* I still haven't tackled encryption, and it's giving me some trouble rn. I'm using Nintendo's wifi firmware, so I hope whatever changes they made to it don't completely break standard encryption.

We're getting there!

 

[Tur7L3]

Hmm, do you plan to allow the modified Wii U gamepad to emulate a Pro Controller or Wiimote? It would be cool to be able to use a second gamepad for some games.

Edit: Silly question, nevermind. It would be very complicated

Already exists as a plugin

Post automatically merged: Jan 25, 2025

Very interested in this so far... Love your emulator, has worked wonders for me. This and MattKC's project for gamepad emulation seem like they could be for enhancing the Gamepad experience

 

[Arisotura]

* I still haven't tackled encryption, and it's giving me some trouble rn. I'm using Nintendo's wifi firmware, so I hope whatever changes they made to it don't completely break standard encryption.

Good news and bad news...

Good news, I got WPA working.

Bad news, it is as I feared, Nintendo's firmware only supports their modified variant of WPA, not regular WPA.

To test this, I backported libdrc's changes to hostapd to the wpad version my AP is running, which means it does Nintendo auth now. Sure enough, can't connect my laptop or anything else to it.

I fired up the gamepad and attempted to connect. Before, all I could get was auth failures. But now, it worked right away. And sure enough, if I change the passphrase to be incorrect, it fails.

I don't really know what to make of this, for now.

After all, to get anything uploaded to the gamepad in the first place, one would need to setup an AP with Nintendo auth, or use a Wii U.

But that also means it wouldn't be possible to connect the gamepad to a regular wifi network, unless the wifi firmware is patched.

 

[Tur7L3]

Good news and bad news...

Good news, I got WPA working.

Bad news, it is as I feared, Nintendo's firmware only supports their modified variant of WPA, not regular WPA.

To test this, I backported libdrc's changes to hostapd to the wpad version my AP is running, which means it does Nintendo auth now. Sure enough, can't connect my laptop or anything else to it.

I fired up the gamepad and attempted to connect. Before, all I could get was auth failures. But now, it worked right away. And sure enough, if I change the passphrase to be incorrect, it fails.

I don't really know what to make of this, for now.

After all, to get anything uploaded to the gamepad in the first place, one would need to setup an AP with Nintendo auth, or use a Wii U.

But that also means it wouldn't be possible to connect the gamepad to a regular wifi network, unless the wifi firmware is patched.

Using a Wii U doesn't sound like the worst. If Gamepad Updates are documented atleast

 

[neverendsDull]

Good news and bad news...

Good news, I got WPA working.

Bad news, it is as I feared, Nintendo's firmware only supports their modified variant of WPA, not regular WPA.

To test this, I backported libdrc's changes to hostapd to the wpad version my AP is running, which means it does Nintendo auth now. Sure enough, can't connect my laptop or anything else to it.

I fired up the gamepad and attempted to connect. Before, all I could get was auth failures. But now, it worked right away. And sure enough, if I change the passphrase to be incorrect, it fails.

I don't really know what to make of this, for now.

After all, to get anything uploaded to the gamepad in the first place, one would need to setup an AP with Nintendo auth, or use a Wii U.

But that also means it wouldn't be possible to connect the gamepad to a regular wifi network, unless the wifi firmware is patched.

Then maybe using a dedicated wired to wireless AP with sth like modified openwrt to communicate with the pad to do the PC streaming...
bah that is zigzaging

 

[Arisotura]

I'm trying to come up with ideas for an actual product with this. Here's what I have in mind so far:

My first idea is a custom boot menu of sorts. The menu could either come up every time you start the gamepad, or be set to only come up when pressing a specific key combo.

It could then let you boot into the stock firmware, or into alternate programs, games, CFW, whatever you want.

It could let you connect to a wifi network to download said programs into your gamepad. IR could also be another way to transfer data, but I would have to reverse-engineer the UART hardware.

It could also have some utility features, like dumping the UIC EEPROM and whatnot.

Could even let you boot into the service firmware, if I figure out a safe way to do that. For whatever it's worth.

-

From a technical standpoint, the menu would be made of a custom bootloader (which would have boot options coded in) and the actual menu part implemented as a small 'firmware' of sorts. The latter part would be installed in one of the free spots in Flash.

I went over the Flash memory structure and usage. There are 7 'slots' of about 1MB each, which could be used to store homebrew or whatever you want. 3 more MB can be freed if you don't mind getting rid of the service firmware.

It could be worthwhile to look into expanding the gamepad's storage if there's actual interest into homebrew, but I think for now this will be good enough for a start.

-

Thoughts?