Hacking [Tool] Joy-Con Toolkit

[d4mation]

Has anyone tried this with the Joy-Con Firmware Update that released yesterday?

1. Do you have to revert to a backup in order to update?
2. Does it still work on the newest Joy-Con Firmware?

 

[CTCaer]

1. Do you have to revert to a backup in order to update?
2. Does it still work on the newest Joy-Con Firmware?

1. No
2. Yes. The update, flashes a new OTA FW in specific regions in SPI. These have code. Not unique configuration. Also if the code changes the location they will break the spec and your updated joy-con will not have color info in your friend's not updated switch.

I'm very eager to check what they updated in the OTA FW (PatchRAM). After work I will grab my online switch and start some REing.

EDIT:
https://www.reddit.com/r/NintendoSw...ntendo_switch_system_update_40_breaks_8bitdo/

If 8bitdo controllers use the same vendor id and device id as Pro controller, then maybe they changed something in the spec.

We'll see..

 

[CTCaer]

Preliminary results for Joy-Con FW v3.86 show that the configuration and protocol spec is the same.

So everything you can do with this tool, remains the same.

 

[Hario337]

Preliminary results for Joy-Con FW v3.86 show that the configuration and protocol spec is the same.

So everything you can do with this tool, remains the same.

what does the new firmware do?

 

[CTCaer]

what does the new firmware do?

Don't know yet. I need to disassemble it first.

 

[CTCaer]

Joy-Con fw v3.86

• 2 new subcmd x24 and x25

x24 copies the argument to a buffer and enables sth?
x25 resets the buffer and disables sth.
The buffer for both is actually a part of the bt device struct that keeps all the configuration)

• changes to joy-con initialization/boot?
• some changes to MCU write subcmd for configuring IR and NFC.
• optimizations to IR and 6-Axis algorithms/filters?
• a hash algorithm was changed.
• Updated RF patterns
• bugfixes

 

[cualquiercosa327]

Joy-Con fw v3.86

• 2 new subcmd x24 and x25

x24 sets copies the argument to a buffer and enables sth?
x25 resets the buffer and disables sth.
The buffer for both is actually a part of the bt device struct that keeps all the configuration)

• changes to joy-con initialization/boot?
• some changes to MCU write subcmd for configuring IR and NFC.
• optimizations to IR and 6-Axis algorithms/filters?
• a hash algorithm was changed.
• bugfixes

Hi.are there the filters and algorithm inside of the fw?
I thought it was on the library for use the joycon.

 

[CTCaer]

Hi.are there the filters and algorithm inside of the fw?
I thought it was on the library for use the joycon.

The are some noise filters inside.
And there is other processing (depending on the mode used) going inside the joy-con.

The heavy stuff is done by the switch though.

I still need to finish my RE on IR stuff, but I'm reluctant because the configuration write command looks like a mess and it also has crc checking. Plus not a lot of time.

 

[cualquiercosa327]

The are some noise filters inside.
And there is other processing (depending on the mode used) going inside the joy-con.

The heavy stuff is done by the switch though.

I still need to finish my RE on IR stuff, but I'm reluctant because the configuration write command looks like a mess and it also has crc checking. Plus not a lot of time.

Thanks

 

[Shadow#1]

@CTCaer does not seem to want to detect my Joy-Cons connected with the 8Bitdo SNES Retro Reciver

 

[CTCaer]

Retro receiver probably denies raw hid access to the device.

I don't know if it acts as a normal bt adapter by connecting it to a pc through its usb.
I assume that it maintains it's original function and just translates the hid messages responsible for buttons/stick only.

So, check if it has a pass-through/bypass/work-like-bt-adapter option.

 

[Shadow#1]

Retro receiver probably denies raw hid access to the device.

I don't know if it acts as a normal bt adapter by connecting it to a pc through its usb.
I assume that it maintains it's original function and just translates the hid messages responsible for buttons/stick only.

So, check if it has a pass-through/bypass/work-like-bt-adapter option.

Where these options be?

 

[CTCaer]

Where these options be?

So, check if it has a pass-through/bypass/work-like-bt-adapter option.

^

(I don't know, I don't own an 8bitdo adapter.. My whole reply was hypothetical)


Anyway, I checked its manual and shows that it uses XINPUT for PC.
This means that it translates the hid packets to an xinput compatible format.

This app is designed to work like a Switch. That means that it expects a BT adapter that does not mess with the hid communication and does not alter the packets sent.
It will not work with these type of devices.

 

[luk_pop]

After update Switch to 4.0.0 and Joy-Con to 3.86 there is no problem with lost conection left joy-con.
Tested on two sets.

 

[CTCaer]

Good to hear. So that's what these big arrays were. RF patterns/filters.

 

[kingsora831]

Has anyone gotten this to work over parallels on a mac?

Im having issue with getting the bluetooth to crossover to the windows side.
The joy con connects fine on the mac side.

Just installed some translucent red joycons (getting ready for Mario Odyssey) and would love to switch the colors on the Switch OS.

 

[trainboy2019]

Has anyone gotten this to work over parallels on a mac?

Im having issue with getting the bluetooth to crossover to the windows side.
The joy con connects fine on the mac side.

Just installed some translucent red joycons (getting ready for Mario Odyssey) and would love to switch the colors on the Switch OS.

I've tried, Parallels doesn't seem to support bluetooth, you're better off boot camping.

 

[CTCaer]

@kingsora831 @trainboy2019
Check this

And based on the kextunload I saw, no modification to Mac is done. It just unloads the driver and after a restart the driver loads again.

 

[kingsora831]

@kingsora831 @trainboy2019
Check this

And based on the kextunload I saw, no modification to Mac is done. It just unloads the driver and after a restart the driver loads again.

Parallels and VB are different programs so hopefully this fix applies, but i will definitely try this later today and report back. Thanks.

 

[machinoman]

I have used VirtualBox in the past while on mac to allow a windows image to use my bluetooth device, although I have heard it depends on which kind of bluetooth adapter you have. If it is USB, passing it through is simple, and also most internal bluetooth adapters are internally recognized as a sort of USB device, but it varies from system to system. The only way to find out is to see if it shows up in your USB menu on virtualbox.