Print

[assafms]

Hi all,

I hope this is the right Forum, if not please excuse me.
I'm building my own xbox controller (just fot the challenge), the hardware is all compleate based on freescale HC08 mcrocontroller (small changes from the IR-BOY LIRC xbox reciver).
I programed all the USB firmware needed and when i connect the device to a PC runnig XBCD , the XBCD thinks i am a real controller .

however , when i connect the device to an xbox (regular xbox not running linux) , i can see the xbox sending me a  

GetDescriptor -> i answer correctly
and then a proprietary request:

0xC1 0x06 0x0042 0x0000 0x0010

this is not a reguler USB information . i have no idea what to send back .

anyone knows somthing about the protocol MS is using ?
any idea on how to sniff information sent to a real controller ?

thanks in advance
Assaf

[hargle]

Cool and interesting!

There are specialized USB packet sniffers, but you probably don't want to buy some hardware just to fix this issue.  My suggestion (you've probably already thought of this) if it's possible to try and hook up an xbox controller to your PC and try and send that packet to it and see what it responds back with.  

Sorry it's not much, but it's all I can think of at the moment.

[assafms]

Thanks man , but  i allready tried that

it seems that the usb host controller blocks this information (HC status -> PID stall )
(as i said this PID is not a part of USB specification).

What about writing a small sniffer on the XBOX .... to you think that with the XDK (i never worked with XDK)
i could write a usb sniffer ?


Assaf

[gonkle]

try out this informtion, maybe it helps a bit http://euc.jp/periph...troller.en.html

when you get an MC working as a controller, report it here

[assafms]

Sure , I'll post the Source files when its done .
any idea on how to sniff the usb port ?

[torne]

What do you need sniffing? I have access to a USB protocol analyser box at work, and may be able to take my xbox and a controller there...

I know very little about the details of the USB protocol, though, so all I can really do is give you whatever the software for the analyser spits out (IMG:style_emoticons/default/wink.gif)

This post has been edited by torne: Apr 14 2006, 10:21 PM

[assafms]

excellent!
it would solve this problem in a few seconds ...

when you first plug in the controller the host sends a few requests to the device ....
get descriptor and then send config and so on ....
this is the part i need the sniffing done - the first few secondes of both the xbox and xpad.

a few massages later the Xpad start continuously send information about the buttons status , it looks like this :
 0x00 0x14 0x00 0x00 0x00 0x00  ....
and the Xbox sends  continuously rumble information that looks like this :
0x00 0x06 0x00 ....

if you this msg then you can stop the sniffing ...
any log will be a big help .

thanks a lot !

[torne]

OK, I'll see if I can get a chance to bring the xbox in to work and ask someone who actually knows about USB how to get the analyser to log anything

[sibrdav]

I have an incomplete usb driver i wrote based on xbdev's xpad, that I can monitor in or out transactions on the usb.  I will check it out later on this evening to see if i can find out what you're looking for.
    This is my first reply, so I need to thank everyone for all the great info contributed here, and especially xbdev.net for guiding me to writing a usb_serial driver for the xbox.  Keep up the good work everyone!

[sibrdav]

Well, I'm not seeing that message you're showing.  It appears to be a vendor defined descriptor request.  When I send it to the xpad, I also receive a stall.  Maybe there is something incorrect in your descriptors you're sending back to the xbox, causing it to request something unnecessary such as an alternate interface descriptor.  Post your full descriptor list and I'll look through it.

[assafms]

Hi , thanks again for the help . i am using a dragon box controller (not the orignal MS Xpad)

this is the information i send back when i am connected to a PC running XBCD . the information i send to the XBOX is the same . please send me your sniffer so i can test it with my controller .

__________________________________________________________________
1   in down   n/a   0.001   GET_DESCRIPTOR_FROM_DEVICE      
URB Header (length: 80)
SequenceNumber: 1
Function: 000b (GET_DESCRIPTOR_FROM_DEVICE)
1   in up   n/a   0.035   CONTROL_TRANSFER   12 01 10 01 00 00 00 08   0x00000000
URB Header (length: 80)
SequenceNumber: 1
Function: 0008 (CONTROL_TRANSFER)
PipeHandle: 81b1df18

SetupPacket:
0000: 80 06 00 01 00 00 12 00
bmRequestType: 80
  DIR: Device-To-Host
  TYPE: Standard
  RECIPIENT: Device
bRequest: 06  
  GET_DESCRIPTOR
Descriptor Type: 0x0001
  DEVICE


TransferBuffer: 0x00000012 (18) length
0000: 12 01 10 01 00 00 00 08 30 0f 02 02 12 03 01 02
0010: 00 01
    bLength            : 0x12 (18)
    bDescriptorType    : 0x01 (1)
    bcdUSB             : 0x0110 (272)
    bDeviceClass       : 0x00 (0)
    bDeviceSubClass    : 0x00 (0)
    bDeviceProtocol    : 0x00 (0)
    bMaxPacketSize0    : 0x08 (
    idVendor           : 0x0f30 (3888)
    idProduct          : 0x0202 (514)
    bcdDevice          : 0x0312 (786)
    iManufacturer      : 0x01 (1)
    iProduct           : 0x02 (2)
    iSerialNumber      : 0x00 (0)
    bNumConfigurations : 0x01 (1)
2   in down   n/a   0.035   GET_DESCRIPTOR_FROM_DEVICE      
URB Header (length: 80)
SequenceNumber: 2
Function: 000b (GET_DESCRIPTOR_FROM_DEVICE)
2   in up   n/a   0.066   CONTROL_TRANSFER   09 02 20 00 01 01 00 80   0x00000000
URB Header (length: 80)
SequenceNumber: 2
Function: 0008 (CONTROL_TRANSFER)
PipeHandle: 81b1df18

SetupPacket:
0000: 80 06 00 02 00 00 09 00
bmRequestType: 80
  DIR: Device-To-Host
  TYPE: Standard
  RECIPIENT: Device
bRequest: 06  
  GET_DESCRIPTOR
Descriptor Type: 0x0002
  CONFIGURATION


TransferBuffer: 0x00000009 (9) length
0000: 09 02 20 00 01 01 00 80 32
    bLength            : 0x09 (9)
    bDescriptorType    : 0x02 (2)
    wTotalLength       : 0x0020 (32)
    bNumInterfaces     : 0x01 (1)
    bConfigurationValue: 0x01 (1)
    iConfiguration     : 0x00 (0)
    bmAttributes       : 0x80 (128)
    MaxPower           : 0x32 (50)
3   in down   n/a   0.066   GET_DESCRIPTOR_FROM_DEVICE      
URB Header (length: 80)
SequenceNumber: 3
Function: 000b (GET_DESCRIPTOR_FROM_DEVICE)
3   in up   n/a   0.099   CONTROL_TRANSFER   09 02 20 00 01 01 00 80   0x00000000
URB Header (length: 80)
SequenceNumber: 3
Function: 0008 (CONTROL_TRANSFER)
PipeHandle: 81b1df18

SetupPacket:
0000: 80 06 00 02 00 00 20 00
bmRequestType: 80
  DIR: Device-To-Host
  TYPE: Standard
  RECIPIENT: Device
bRequest: 06  
  GET_DESCRIPTOR
Descriptor Type: 0x0002
  CONFIGURATION


TransferBuffer: 0x00000020 (32) length
0000: 09 02 20 00 01 01 00 80 32 09 04 00 00 02 58 42
0010: 00 00 07 05 81 03 40 00 0a 07 05 02 03 40 00 0a
    bLength            : 0x09 (9)
    bDescriptorType    : 0x02 (2)
    wTotalLength       : 0x0020 (32)
    bNumInterfaces     : 0x01 (1)
    bConfigurationValue: 0x01 (1)
    iConfiguration     : 0x00 (0)
    bmAttributes       : 0x80 (128)
    MaxPower           : 0x32 (50)
4    down   n/a   0.099   SELECT_CONFIGURATION      
URB Header (length: 80)
SequenceNumber: 4
Function: 0000 (SELECT_CONFIGURATION)
Configuration Descriptor:
bLength: 9 (0x09)
bDescriptorType: 2 (0x02)
wTotalLength: 32 (0x0020)
bNumInterfaces: 1 (0x01)
bConfigurationValue: 1 (0x01)
iConfiguration: 0 (0x00)
bmAttributes: 128 (0x80)
  0x80: Bus Powered
MaxPower: 50 (0x32)
  (in 2 mA units, therefore 100 mA power consumption)

Number of interfaces: 1
Interface[0]:
  Length: 0x0038
  InterfaceNumber: 0x00
  AlternateSetting: 0x00
  Class             = 0x00
  SubClass          = 0x00
  Protocol          = 0x00
  InterfaceHandle   = 0x00000000
  NumberOfPipes     = 0x00000002
  Pipe[0]:
    MaximumPacketSize = 0x0000
    EndpointAddress   = 0x00
    Interval          = 0x00
    PipeType          = 0x00
      UsbdPipeTypeControl
    PipeHandle        = 0x00000000
    Ma** keep this p2p ROMS and WAREZ type shit off of XS **Size   = 0x00001000
    PipeFlags         = 0x00
  Pipe[1]:
    MaximumPacketSize = 0x0000
    EndpointAddress   = 0x00
    Interval          = 0x00
    PipeType          = 0x00
      UsbdPipeTypeControl
    PipeHandle        = 0x00000000
    Ma** keep this p2p ROMS and WAREZ type shit off of XS **Size   = 0x00001000
    PipeFlags         = 0x00
4    up   n/a   0.144   SELECT_CONFIGURATION      0x00000000
URB Header (length: 80)
SequenceNumber: 4
Function: 0000 (SELECT_CONFIGURATION)
Configuration Descriptor:
bLength: 9 (0x09)
bDescriptorType: 2 (0x02)
wTotalLength: 32 (0x0020)
bNumInterfaces: 1 (0x01)
bConfigurationValue: 1 (0x01)
iConfiguration: 0 (0x00)
bmAttributes: 128 (0x80)
  0x80: Bus Powered
MaxPower: 50 (0x32)
  (in 2 mA units, therefore 100 mA power consumption)

Number of interfaces: 1
Interface[0]:
  Length: 0x0038
  InterfaceNumber: 0x00
  AlternateSetting: 0x00
  Class             = 0x58
  SubClass          = 0x42
  Protocol          = 0x00
  InterfaceHandle   = 0x81a5d930
  NumberOfPipes     = 0x00000002
  Pipe[0]:
    MaximumPacketSize = 0x0040
    EndpointAddress   = 0x81
    Interval          = 0x0a
    PipeType          = 0x03
      UsbdPipeTypeInterrupt
    PipeHandle        = 0x81a5d94c
    Ma** keep this p2p ROMS and WAREZ type shit off of XS **Size   = 0x00001000
    PipeFlags         = 0x00
  Pipe[1]:
    MaximumPacketSize = 0x0040
    EndpointAddress   = 0x02
    Interval          = 0x0a
    PipeType          = 0x03
      UsbdPipeTypeInterrupt
    PipeHandle        = 0x81a5d96c
    Ma** keep this p2p ROMS and WAREZ type shit off of XS **Size   = 0x00001000
    PipeFlags         = 0x00

[sibrdav]

Try changing your vendor id from 0x0F30 to 0x45E.  The vendor id can be used to locate a driver, and since you're specifying an id thats not MS(0x45E), the xbox is looking for more info on your id.  Where did you get 0x0F30 from?  I know the request you're getting(C1 06...etc) is a vendor defined descriptor request, which you shouldn't be getting from the xbox for your type of device.  Give that a try and see if the xbox stops that request.  If not, tell me at what point exactly that the xbox sends that request.  For example, after device descriptor is returned, or after set config etc...

[assafms]

Hi,

The ID came from the Xpad i have , as i said this is not an original MS xpad , but a replacment called "jess dragonbox"  .since i dont have a working MS xpad to compare to, i need your help with the rest of the descriptor .please add the log you got from the MS controller so i can create an exact doplicate on my MC.

i'll try the ID you gave me later today and attach the information i get from the Xbox (i have a debug RS232 on my MC).
 

thanks
Assaf

[assafms]

Hi ,

it didn't help . i used this settings and still i get the strange vendor defined descriptor request :

Device Descriptor:
bcdUSB:             0x0110
bDeviceClass:         0x00
bDeviceSubClass:      0x00
bDeviceProtocol:      0x00
bMaxPacketSize0:      0x08 (
idVendor:           0x045E (MS Corporation)
idProduct:          0x0202
bcdDevice:          0x0312
iManufacturer:        0x01
iProduct:             0x02
iSerialNumber:        0x00
bNumConfigurations:   0x01

ConnectionStatus: DeviceConnected
Current Config Value: 0x01
Device Bus Speed:      Low
Device Address:       0x06
Open Pipes:              2

Endpoint Descriptor:
bEndpointAddress:     0x81
Transfer Type:   Interrupt
wMaxPacketSize:     0x0040 (64)
bInterval:            0x0A

Endpoint Descriptor:
bEndpointAddress:     0x02
Transfer Type:   Interrupt
wMaxPacketSize:     0x0040 (64)
bInterval:            0x0A

Configuration Descriptor:
wTotalLength:       0x0020
bNumInterfaces:       0x01
bConfigurationValue:  0x01
iConfiguration:       0x00
bmAttributes:         0x80 (Bus Powered )
MaxPower:             0x32 (100 Ma)

Interface Descriptor:
bInterfaceNumber:     0x00
bAlternateSetting:    0x00
bNumEndpoints:        0x02
bInterfaceClass:      0x58
bInterfaceSubClass:   0x42
bInterfaceProtocol:   0x00
iInterface:           0x00

Endpoint Descriptor:
bEndpointAddress:     0x81
Transfer Type:   Interrupt
wMaxPacketSize:     0x0040 (64)
bInterval:            0x0A

Endpoint Descriptor:
bEndpointAddress:     0x02
Transfer Type:   Interrupt
wMaxPacketSize:     0x0040 (64)
bInterval:            0x0A


this is the log of imformation the xbox is sending me :
Start of main program...
0x80 0x06 0x01 0x00 0x00 0x00 0x00 0x08 Send Descriptor
0x00 0x05 0x00 0x01 0x00 0x00 0x00 0x00 Set address
0x80 0x06 0x02 0x00 0x00 0x00 0x00 0x50 Send config
0x00 0x09 0x00 0x01 0x00 0x00 0x00 0x00 Set configuration
0xC1 0x06 0x42 0x00 0x00 0x00 0x00 0x10 Stall!

my device is low-speed and not full speed but i dont think this is the problem.
could you please send me the source of your sniffer so i can test my controller ?

Assaf

[sibrdav]

ah, a lowspeed device could be your problem since you're specifying a maxpacketsize of 64 (0x40).  Lowspeed devices are only capable of an 8 byte packetsize (0x8).  The source i'm using is available on xbdev.net called xpad in the nonxdk tutorials.  I'm just running it through the xbox debugger so I can step through each transaction.  Also, the original xpad is actually a 3 port hub with 2 ports for the memory slots and one port connected to the actual gamepad.  Is your gamepad also a hub, or is it just the gamepad.  I will post the descriptors when i get a chance to log them.