xboxdevwiki - User contributions [en]

Xemu

2021-05-03T06:52:33Z

Dracc:

xemu is a continuation of xqemu which is a low-level Xbox / Chihiro Emulator started in mid-late 2012 by espes[https://github.com/espes/xqemu/commit/d823f5802e7c4c84163aea8b4d924044951c705e].

xemu was started in early 2020 by mborgerson[https://github.com/mborgerson]

The official homepage is https://xemu.app

== Compatibility list ==

Compatibility list can be found at https://xemu.app/#compatibility.

== Features ==

Currently the features that are supported are Gamepad Support, System Link, Snapshots (Save States).

Xemu

2021-05-03T06:52:08Z

Dracc:

xemu is a continuation of xqemu which is a low-level Xbox / Chihiro Emulator started in mid-late 2012 by espes[https://github.com/espes/xqemu/commit/d823f5802e7c4c84163aea8b4d924044951c705e].

xemu was started in early 2020 by mborgerson[https://github.com/mborgerson]

The official homepage can be found at [https://xemu.app xemu.app]

== Compatibility list ==

Compatibility list can be found at https://xemu.app/#compatibility.

== Features ==

Currently the features that are supported are Gamepad Support, System Link, Snapshots (Save States).

Main Page

2021-01-28T13:02:06Z

Dracc:

{{:Main Page/Header}}
__NOTOC__

== Hardware ==

* [[Chihiro]]
* [[Xbox]]

* [[Hardware Revisions]]
* [[Motherboard]]
* [[CPU]]
* [[NV2A]]
** [[NV2A/Vertex attributes]]
** [[NV2A/Fixed Function Pipeline]]
** [[NV2A/Vertex Shader]]
** [[NV2A/Pixel Combiner]]
** [[NV2A/Surface Formats]]
* [[Memory]]
* [[Flash ROM]]
* [[MCPX]]
** [[LPC_Debug_Port|LPC]]
** [[APU]]
*** [[DSP]]
** [[ACI]]
** [[Network]]
* [[PCI]]
* [[SMBus]]
** [[EEPROM]]
** [[SMC]]
** [[Video Encoder]]
*** [[AV Cables]]
* [[DVD Drive]]
** [[Xbox Game Disc]]
* [[Hard Drive]]
** [[Config Sector]]
* [[USB]]
** [[Xbox Input Devices]]
** [[Xbox Memory Unit]]
** [[Xbox Live Communicator]] 
** [[Xbox DVD Movie Playback Kit]]
* [[Power Supply]]
* [[Development Kits]]
** [[Super I/O]]
** [[DVD Emulator]]
* [[Manufacturing Process]]

== System Software ==
* [[MCPX ROM]]
* [[BIOS]] / [[Kernel]]
** [[Boot Process]]
** [[XBE]] (Executable file format)
* [[FATX]] (Filesystem)
* [[Xbox ADPCM]]
* [[Dashboard]]
** [[Soundtracks]]
** [[Fatal Error]]
* [[Exploits]]

== Development Kits and Tools ==
* [https://github.com/xqemu/nxdk nxdk (New Xbox Development Kit)]
* [[OpenXDK]]
* [[Microsoft XDK]]
** [[Xbox Title Libraries]]
** [[Direct3D]]
** [[DirectSound]]
** [[System Link]]
** [[Xbox Live]]
** [[Xbox Debug Monitor]]
** [[Xbox Neighborhood]]
** [[Kernel_Debug|Xbox Kernel Debugging]]

== Games ==
* [[:Category:Games|Games]]
* [[Engine List]]

== Emulation ==
* [[Emulators]]
** [[XQEMU]]
** [[Fusion]]
** [[Fission]]

== Historical Pages ==
(archived from the xbox-linux wiki)
* [[Xbox Hard Drive Locking Mechanism]]
* [[Xbox Savegame System]]
* [[Xbox Hardware Overview]]
* [[Xbox Hard Disk Technical_Details]]
* [[Xbox Hard Disk Partitioning]]
* [[Xbox Manufacturing Process]]
* [[The Hidden Boot Code of the Xbox]]
* [[PIC]]
* [[SMBus]]
* [[NForce]]
* [[17 Mistakes Microsoft Made in the Xbox Security System]]
* [[Porting an Operating System to the Xbox HOWTO]]

== Other ==
* [[Patents]]
* [[Resources]]

Xbox Input Devices

2019-08-09T11:28:12Z

Dracc: Fix Steel Battalion Controller RightJoyFire button Mask according to https://github.com/Ryzee119/ogx360/blob/master/Firmware/ogx360_32u4/ogx360_32u4/steelbattalion.h

== XID Overview ==

XIDs are USB devices.

The hardware side is USB with a different plug while the software side is USB without HID-descriptors.
Technicly a XID is a USB-hub for the Memory-Units and the XBL Communicator.
The logical XID gamepad USB device is internally connected to that hub.

=== USB Adapters ===
The Xbox input devices are USB devices. As such, you can connect a keyboard to the Xbox, or a gamepad to your PC. In fact, Linux already has drivers for the gamepad. In order to preserve Xbox hardware, please do not cut OEM Xbox cables to make an adapter. Decent adapters can be acquired cheaply (~$10 USD ea. on 2017.04.30).

[[File:Xboxmaletousbfemale.png|thumb|right|Wiring diagram to show how male Xbox controller plug maps to standard female USB connector. White cable color is depicted as gray for better visibility. The yellow cable is not connected to the USB side, as it's exclusive to Xbox.]]

{| class="wikitable"
|-
! Port (From)
! Plug (To)
! Link
|-
| Xbox
| USB-A
| [https://www.amazon.com/gp/product/B000RT2868 Amazon]
|-
| USB-A
| Xbox
| [https://www.amazon.com/gp/product/B00F52LQHO Amazon]
|}

=== Wiring ===

Untested / unverified! Take this with a grain of salt.

{| class="wikitable"
!Pin
!Typical cable color
!Description
|-
|1
|Red
|VCC
|-
|2
|White
|USB D+
|-
|3
|Green
|USB D-
|-
|4
|Yellow
|VBlank signal from video output (for Lightguns)
|-
|5
|Black
|GND
|-
|}

=== Protocol ===

XID are similar to HID but have custom Vendor requests

==== Control Transfers ====

===== GET_DESCRIPTOR =====

* bmRequestType: 0xC1
* bRequest: 6
* wValue: 0x4200
* wIndex: Interface number
* wLength: <length of respective report; typically 16>

Actual length is truncated to size of descriptor or wLength. Whichever is smaller.

<pre>
typedef struct XIDDescriptor {
uint8_t bLength;
uint8_t bDescriptorType;
uint16_t bcdXid;
uint8_t bType;
uint8_t bSubType;
uint8_t bMaxInputReportSize;
uint8_t bMaxOutputReportSize;
uint16_t wAlternateProductIds[4];
};
</pre>

bDescriptorType is probably always 0x42.

====== bType = 1: Xbox Gamecontroller ======

* bSubType:
** 0x01 = Gamepad (Duke)
** 0x02 = Gamepad (Controller-S)
** 0x10 = Steering wheel

===== GET_CAPABILITIES =====

* bmRequestType: 0xC1
* bRequest: 1
* wValue:
** 0x0100 for input
** 0x0200 for output
* wIndex: Interface number
* wLength: <length of respective report>

* STALL if wValue not supported.

Actual length is truncated to size of report or wLength. Whichever is smaller.

<pre>typedef struct XIDGamepadCapabilities {
uint8_t bReportId;
uint8_t bLength;
<Data>
}</pre>

The data will be similar to the GET_REPORT, but instead of storing actual values, it will have bits set (1) where the bit is valid in the respective report.
If the bit is auto-generated, it will be cleared (0).

===== SET_REPORT =====

* bmRequestType: 0x21
* bRequest: 9
* wValue: 0x0200
* wIndex: Interface number
* wLength: <length of report; typically 6>

* STALL if wValue not supported.

====== Typical report ======

<pre>typedef struct XIDGamepadReport {
uint8_t bReportId;
uint8_t bLength;
<Data>
}</pre>

===== GET_REPORT =====

* bmRequestType: 0xA1
* bRequest: 1
* wValue: 0x0100
* wIndex: Interface number
* wLength: <length of report; typically 20>

* STALL if wValue not supported or if wLength is greater than report size.
* ACK if supported.

====== Typical report ======

<pre>typedef struct XIDGamepadOutputReport {
uint8_t report_id; //FIXME: is this correct?
uint8_t length;
<Data>
}</pre>

==== Interrupt transfers ====

Alternatively interrupt-in and interrupt-out transfers can be used for GET_REPORT and SET_REPORT respectively.

In case of the interrupt-in, there is another status which can occur now:

* NAK if supported but no changes since last ACK.

== Standard Gamepads ==

=== USB Descriptors ===

Most standard gamepads share the same USB descriptor.
Usually the only difference will be the VID / PID.
See https://github.com/xboxdrv/xboxdrv/blob/stable/src/xpad_device.cpp for a list of devices.

=== Controller to Xbox ===

20 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|{{input-dy+}}
|2
|0x01
|
|-
|{{input-dy-}}
|2
|0x02
|
|-
|{{input-dx-}}
|2
|0x04
|
|-
|{{input-dx+}}
|2
|0x08
|
|-
|{{input-start}}
|2
|0x10
|
|-
|{{input-back}}
|2
|0x20
|
|-
|{{input-ls}}
|2
|0x40
|
|-
|{{input-rs}}
|2
|0x80
|
|-
|{{input-a}}
|4
|0xFF
|Button is analog
|-
|{{input-b}}
|5
|0xFF
|Button is analog
|-
|{{input-x}}
|6
|0xFF
|Button is analog
|-
|{{input-y}}
|7
|0xFF
|Button is analog
|-
|{{input-black}}
|8
|0xFF
|Button is analog
|-
|{{input-white}}
|9
|0xFF
|Button is analog
|-
|{{input-lt}}
|10
|0xFF
|Trigger is analog
|-
|{{input-rt}}
|11
|0xFF
|Trigger is analog
|-
|{{input-lx}}
|12
|0xFFFF
|Negative = Left; Positive = Right
|-
|{{input-ly}}
|14
|0xFFFF
|Negative = Down; Positive = Up
|-
|{{input-rx}}
|16
|0xFFFF
|Negative = Left; Positive = Right
|-
|{{input-ry}}
|18
|0xFFFF
|Negative = Down; Positive = Up
|}

=== Xbox to Controller ===

6 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|Left actuator strength
|2
|0xFFFF
|
|-
|Right actuator strength
|4
|0xFFFF
|
|}

Xbox games use the full range from 0x0000 to 0xFFFF for both the left and right actuators.

The Microsoft Controller S will not react to packets which don't have a value of 6 in the <code>length</code> field of the header.
The Fanatec Speedster 3 ForceShock will still react to those. Further testing is necessary with other gamepads.

== Steering wheels ==

=== MadCatz Wheel ===

{{FIXME}}

=== Fanatec Speedster 3 ForceShock ===

==== Pedals ====

The Pedals are ''not'' a USB device.

Note that the cable going to the pedals is also ''not'' a USB port despite using the Xbox controller breakaway plug.
Likewise, plugging the pedals to a PC / Xbox won't provide a USB / XID (it is detected as garbage):

<pre>
new full-speed USB device number 14 using xhci_hcd
device descriptor read/64, error -71
device descriptor read/64, error -71
new full-speed USB device number 15 using xhci_hcd
device descriptor read/64, error -71
device descriptor read/64, error -71
new full-speed USB device number 16 using xhci_hcd
Device not responding to setup address.
Device not responding to setup address.
device not accepting address 16, error -71
new full-speed USB device number 17 using xhci_hcd
Device not responding to setup address.
Device not responding to setup address.
device not accepting address 17, error -71
unable to enumerate USB device
</pre>

==== Internal HUB ====

===== USB Descriptors =====

Power not connected, pedals not connected, not in Tuning mode:

<pre>
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 9 Hub
bDeviceSubClass 0
bDeviceProtocol 0 Full speed (or root) hub
bMaxPacketSize0 8
idVendor 0x3767
idProduct 0x0102
bcdDevice 0.01
iManufacturer 0
iProduct 1 End
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 25
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xa0
(Bus Powered)
Remote Wakeup
MaxPower 64mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 9 Hub
bInterfaceSubClass 0
bInterfaceProtocol 0 Full speed (or root) hub
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0001 1x 1 bytes
bInterval 255
Hub Descriptor:
bLength 9
bDescriptorType 41
nNbrPorts 3
wHubCharacteristic 0x000d
Per-port power switching
Compound device
Per-port overcurrent protection
bPwrOn2PwrGood 50 * 2 milli seconds
bHubContrCurrent 64 milli Ampere
DeviceRemovable 0x02
PortPwrCtrlMask 0xff
Hub Port Status:
Port 1: 0000.0103 power enable connect
Port 2: 0000.0100 power
Port 3: 0000.0100 power
can't get debug descriptor: Resource temporarily unavailable
Device Status: 0x0003
Self Powered
Remote Wakeup Enabled
</pre>

==== Steering wheel (and Pedals) ====

Always connected to port 1 of the internal HUB

===== USB Descriptors =====

<pre>
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 8
idVendor 0x3767
idProduct 0x0101
bcdDevice 2.80
iManufacturer 0
iProduct 0
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 88 Xbox
bInterfaceSubClass 66 Controller
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
can't get debug descriptor: Resource temporarily unavailable
Device Status: 0x0000
(Bus Powered)
</pre>

== Light guns ==

=== EMS TopGun II ===

''This is an unlicensed / unofficial Xbox accessory.''

The website for this product can be found at http://www.hkems.com/product/xbox/EMSTopGun2.htm

The gun presents itself as a standard Xbox gamepad. It uses a different USB descriptor for Xbox (X) and the other mode (P).
There is no internal hub in this device.

{| class="wikitable"
! EMS TopGun II !! Xbox Gamepad !! Notes
|-
| Stick || {{input-d}} ||
|-
| Trigger || {{input-a}} || rowspan="4" | Digital only, either 0 or 255
|-
| Grip || {{input-b}}
|-
| A || {{input-x}}
|-
| B || {{input-y}}
|-
| START || {{input-start}} ||
|-
| SE/BA || {{input-back}} ||
|-
| Aim Left / Right || {{input-lx}} || rowspan="2" | Absolute position using the full stick range
|-
| Aim Up / Down || {{input-ly}}
|}

There is no right thumbstick, thumbstick presses, black/white button or trigger buttons (All of those read constant zeros).

===== Turbo Mode =====

* Turbo mode 0 keeps {{input-a}} pressed while trigger is held
* Turbo mode 1 toggles {{input-a}} rapidly while trigger is held
* Turbo mode 2 toggles {{input-a}} rapidly and once in a while {{input-b}} while trigger is held

===== Force Feedback =====

The upper part of the gun is moveable and should push back to simulate recoil (possibly hurting your thumb while you are using the stick).
I could not get the force feedback working, but I'm sure I've had it working in the past on PC.{{citation needed}}

==== USB Descriptors ====

This is the descriptor in the Xbox mode (X).

<pre>
Bus 003 Device 016: ID 0b9a:016b
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x0b9a
idProduct 0x016b
bcdDevice 4.57
iManufacturer 1 EMS̖E
iProduct 2 EMS TopGun
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 88 Xbox
bInterfaceSubClass 66 Controller
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 8
can't get debug descriptor: Resource temporarily unavailable
Device Status: 0x0000
(Bus Powered)
</pre>

=== Joytech Sharp Shooter ===

''This is an unlicensed / unofficial Xbox accessory.''

The third party light gun from Joytech reports itself as 2 devices and mentions pattent [http://www.google.com/patents/US6287198 US6287198]
it came with a detachable viewfinder scope without any magnification. a red dot apears in the viewfinder, its a reflection of a red led, powered by the gun over usb.

model numer: JS-901D

{| class="wikitable"
! Joytech Sharp Shooter !! Xbox Gamepad !! Notes
|-
| Stick || {{input-d}} ||
|-
| Trigger || {{input-a}} || rowspan="6" | Digital only, either 0 or 255 {{citation needed}}
|-
| B (Left side) || rowspan="3" | {{input-b}}
|-
| B (Right side)
|-
| B (Magazine button)
|-
| x || {{input-x}}
|-
| y || {{input-y}}
|-
| START || {{input-start}} ||
|-
| BACK || {{input-back}} ||
|-
| Aim Left / Right || {{input-lx}} || {{citation needed}}
|-
| Aim Up / Down || {{input-ly}} || {{citation needed}}
|}

There is no right thumbstick, thumbstick presses, black/white button or trigger buttons {{citation needed}}

===== Fire/Reload Mode =====

* Normal mode does nothing, normal operation
* Auto reload mode toggles {{input-b}} rapidly to rappidly reload {{citation needed}}
* Auto fire+reload mode toggles {{input-a}} + {{input-b}} rapidly {{citation needed}}

==== USB Descriptors ====

<pre>

Bus 003 Device 025: ID 1292:3006 Innomedia
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 8
idVendor 0x1292 Innomedia
idProduct 0x3006
bcdDevice 1.50
iManufacturer 0
iProduct 0
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 1 (error)
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 88 Xbox
bInterfaceSubClass 66 Controller
bInterfaceProtocol 0
iInterface 2 (error)
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4

Bus 003 Device 024: ID 1292:3006 Innomedia
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 9 Hub
bDeviceSubClass 0
bDeviceProtocol 0 Full speed (or root) hub
bMaxPacketSize0 8
idVendor 0x1292 Innomedia
idProduct 0x3006
bcdDevice 1.50
iManufacturer 1 (c) 2004 R0R3 Inc.
iProduct 2 US Patent 6,287,198
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 25
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 4 (c) R0R3 Devices Inc. US Patent 6,287,19Ē
bmAttributes 0xa0
(Bus Powered)
Remote Wakeup
MaxPower 64mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 9 Hub
bInterfaceSubClass 0
bInterfaceProtocol 0 Full speed (or root) hub
iInterface 5 (error)
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0001 1x 1 bytes
bInterval 255
Hub Descriptor:
bLength 9
bDescriptorType 41
nNbrPorts 3
wHubCharacteristic 0x000d
Per-port power switching
Compound device
Per-port overcurrent protection
bPwrOn2PwrGood 32 * 2 milli seconds
bHubContrCurrent 64 milli Ampere
DeviceRemovable 0x02
PortPwrCtrlMask 0x0e
Hub Port Status:
Port 1: 0000.0103 power enable connect
Port 2: 0000.0100 power
Port 3: 0100.0100 power
Device Status: 0x0000
(Bus Powered)
</pre>

== Steel Battalion Controller ==

[[File:SBC.jpg|thumb|200px|Steel Battalion Controller Layout]]

=== USB Descriptors ===

<pre>
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 8
idVendor 0x0a7b
idProduct 0xd000
bcdDevice 1.00
iManufacturer 0
iProduct 0
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 500mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 88 Xbox
bInterfaceSubClass 66 Controller
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
</pre>

=== Controller to Xbox ===

From http://steelbattalionnet.codeplex.com/SourceControl/latest#SBC/SteelBattalionController.cs

26 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|RightJoyMainWeapon
|2
|0x01
|
|-
|RightJoyFire
|2
|0x02
|
|-
|RightJoyLockOn
|2
|0x04
|
|-
|Eject
|2
|0x08
|
|-
|CockpitHatch
|2
|0x10
|
|-
|Ignition
|2
|0x20
|
|-
|Start
|2
|0x40
|
|-
|MultiMonOpenClose
|2
|0x80
|
|-
|MultiMonMapZoomInOut
|3
|0x01
|
|-
|MultiMonModeSelect
|3
|0x02
|
|-
|MultiMonSubMonitor
|3
|0x04
|
|-
|MainMonZoomIn
|3
|0x08
|
|-
|MainMonZoomOut
|3
|0x10
|
|-
|FunctionFSS
|3
|0x20
|
|-
|FunctionManipulator
|3
|0x40
|
|-
|FunctionLineColorChange
|3
|0x80
|
|-
|Washing
|4
|0x01
|
|-
|Extinguisher
|4
|0x02
|
|-
|Chaff
|4
|0x04
|
|-
|FunctionTankDetach
|4
|0x08
|
|-
|FunctionOverride
|4
|0x10
|
|-
|FunctionNightScope
|4
|0x20
|
|-
|FunctionF1
|4
|0x40
|
|-
|FunctionF2
|4
|0x80
|
|-
|FunctionF3
|5
|0x01
|
|-
|WeaponConMain
|5
|0x02
|
|-
|WeaponConSub
|5
|0x04
|
|-
|WeaponConMagazine
|5
|0x08
|
|-
|Comm1
|5
|0x10
|
|-
|Comm2
|5
|0x20
|
|-
|Comm3
|5
|0x40
|
|-
|Comm4
|5
|0x80
|
|-
|Comm5
|6
|0x01
|
|-
|LeftJoySightChange
|6
|0x02
|
|-
|ToggleFilterControl
|6
|0x04
|
|-
|ToggleOxygenSupply
|6
|0x08
|
|-
|ToggleFuelFlowRate
|6
|0x10
|
|-
|ToggleBuffreMaterial
|6
|0x20
|
|-
|ToggleVTLocation
|6
|0x40
|
|-
|
|6
|0x80
|
|-
|
|7
|0xFF
|
|-
|
|8
|0xFF
|
|-
|AimingX
|9
|0xFF, maybe 0xFFFF at offset 8?
|"Aiming Lever" joystick on the right. X Axis value.
|-
|AimingY
|11
|0xFF, maybe 0xFFFF at offset 10?
|"Aiming Lever" joystick on the right. Y Axis value.
|-
|RotationLever
|13
|0xFF, maybe 0xFFFF at offset 12?
|"Rotation Lever" joystick on the left.
|-
|SightChangeX
|15
|0xFF, maybe 0xFFFF at offset 14?
|"Sight Change" analog stick on the "Rotation Lever" joystick. X Axis value.
|-
|SightChangeY
|17
|0xFF, maybe 0xFFFF at offset 16?
|"Sight Change" analog stick on the "Rotation Lever" joystick. Y Axis value.
|-
|LeftPedal
|19
|0xFF, maybe 0xFFFF at offset 18?
|
|-
|MiddlePedal
|21
|0xFF, maybe 0xFFFF at offset 20?
|
|-
|RightPedal
|23
|0xFF, maybe 0xFFFF at offset 22?
|
|-
|TunerDial
|24
|0x0F
|The 9 o'clock postion is 0, and the 6 o'clock position is 12. The blank area between the 6 and 9 o'clock positions is 13, 14, and 15 clockwise.
|-
|
|24
|0xF0
|
|-
|GearLever
|25
|0xFF
|The gear lever on the left block.
|}

=== Xbox to Controller ===

From http://steelbattalionnet.codeplex.com/SourceControl/latest#SBC/SteelBattalionController.cs

34 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|EmergencyEject
|2
|0x0F
|
|-
|CockpitHatch
|2
|0xF0
|
|-
|Ignition
|3
|0x0F
|
|-
|Start
|3
|0xF0
|
|-
|OpenClose
|4
|0x0F
|
|-
|MapZoomInOut
|4
|0xF0
|
|-
|ModeSelect
|5
|0x0F
|
|-
|SubMonitorModeSelect
|5
|0xF0
|
|-
|MainMonitorZoomIn
|6
|0x0F
|
|-
|MainMonitorZoomOut
|6
|0xF0
|
|-
|ForecastShootingSystem
|7
|0x0F
|
|-
|Manipulator
|7
|0xF0
|
|-
|LineColorChange
|8
|0x0F
|
|-
|Washing
|8
|0xF0
|
|-
|Extinguisher
|9
|0x0F
|
|-
|Chaff
|9
|0xF0
|
|-
|TankDetach
|10
|0x0F
|
|-
|Override
|10
|0xF0
|
|-
|NightScope
|11
|0x0F
|
|-
|F1
|11
|0xF0
|
|-
|F2
|12
|0x0F
|
|-
|F3
|12
|0xF0
|
|-
|MainWeaponControl
|13
|0x0F
|
|-
|SubWeaponControl
|13
|0xF0
|
|-
|MagazineChange
|14
|0x0F
|
|-
|Comm1
|14
|0xF0
|
|-
|Comm2
|15
|0x0F
|
|-
|Comm3
|15
|0xF0
|
|-
|Comm4
|16
|0x0F
|
|-
|Comm5
|16
|0xF0
|
|-
|
|17
|0x0F
|
|-
|GearR
|17
|0xF0
|
|-
|GearN
|18
|0x0F
|
|-
|Gear1
|18
|0xF0
|
|-
|Gear2
|19
|0x0F
|
|-
|Gear3
|19
|0xF0
|
|-
|Gear4
|20
|0x0F
|
|-
|Gear5
|20
|0xF0
|
|}

== Related links ==
[https://github.com/xqemu/xqemu/blob/xbox/hw/xbox/xid.c XID emulation in XQEMU]

Config Sector

2019-06-12T18:32:13Z

Dracc: Updated reference link to a working one

{| class="wikitable"
!Offset
!Size
!Description
|-
|0x1020
|4
|Static IP Address
|-
|0x1024
|4
|Static Subnet Mask
|-
|0x1028
|4
|Static Default Gateway
|-
|0x102C
|4
|Static Primary DNS Server
|-
|0x1030
|4
|Static Secondary DNS Server
|-
|0x1034
|32
!(Unknown padding)
|-
|0x1054
|4
|Xbox Live IP Address
|-
|0x1058
|4
|Xbox Live Subnet Mask
|-
|0x105C
|4
|Xbox Live Default Gateway
|-
|0x1060
|4
|Xbox Live Primary DNS Server
|-
|0x1064
|4
|Xbox Live Secondary DNS Server
|-
|0x1068
|40
|Xbox Live Hostname
|-
|0x1090
|64
|Xbox Live PPPOE Username
|-
|0x10D0
|64
|Xbox Live PPPOE Password
|-
|0x1110
|40
!(Unknown padding)
|-
|0x1138
|40
|Xbox Live PPPOE Service Name
|-
|0x1160
|12
!(Unknown)
|-
|0x116C
|4
|DHCP IP Address
|-
|0x1170
|4
|DHCP Subnet Mask
|-
|0x1174
|4
|DHCP Default Gateway
|-
|0x1178
|4
|DHCP Primary DNS Server
|-
|0x117C
|4
|DHCP Secondary DNS Server
|-
|0x1180
|4
|PPPOE IP Address (?)
|-
|0x1184
|4
|PPPOE Subnet Mask (?)
|-
|0x1188
|4
|PPPOE Gateway Address (?)
|-
|0x118C
|4
|PPPOE Primary DNS Server (?)
|-
|0x1190
|4
|PPPOE Secondary DNS Server (?)
|}

==References==
* [https://web.archive.org/web/20190604222002/https://assemblergames.com/threads/xbox-live-accounts-xqemu-and-mu.60352/ Xbox live (accounts, xqemu and MU) | ASSEMbler - Home of the obscure (archive.org)]

EEPROM

2019-06-12T16:07:25Z

Dracc: /* Contents */

The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54.
Parts of the EEPROM are encrypted using [[Kernel/XboxEEPROMKey]].

== Contents ==

{| class="wikitable"
! Start !! End !! Notes
|-
| 0x00
| 0x13
| HMAC_SHA1 Hash
|-
| 0x14
| 0x1B
| RC4 Encrypted Confounder ??
|-
| 0x1C
| 0x2B
| RC4 Encrypted HDD key
|-
| 0x2C
| 0x2F
| RC4 Encrypted Region code
* 0x00000001 = North America
* 0x00000002 = Japan
* 0x00000004 = Europe & Australia
* 0x80000000 = Manufacturing plant
|-
| 0x30
| 0x33
| Checksum2 - Checksum of next 44 (0x2C) bytes (0x34 - 0x5F)*
|-
| 0x34
| 0x3F
| Xbox serial number - (ASCII chars 0x30 - 0x39 to match each digit in SN)
|-
| 0x40
| 0x45
| Ethernet MAC address (Microsoft Xbox - 00:50:F2:xx:xx:xx)
This is the MAC address of the Ethernet hardware, which has been [https://web.archive.org/web/20100617020733/http://standards.ieee.org/regauth/oui/oui_public.txt issued by the IEEE].
|-
| 0x46
| 0x47
| Unknown Padding ?
|-
| 0x48
| 0x57
| Online Key ?
|-
| 0x58
| 0x5B
| Video Standard
* 0x00000000 = not set (INVALID)
* 0x00400100 = NTSC-M
* 0x00400200 = NTSC-J
* 0x00800300 = PAL-I
* 0x00400400 = PAL-M
|-
| 0x5C
| 0x5F
| Unknown Padding ?
|-
| 0x60
| 0x63
| Checksum3 - Checksum of the next 92 (0x5C) bytes (0x64 - 0xBF)*
|-
| 0x64
| 0x67
| Zone Bias - Offset in # minutes to subtract from GMT time
(e.g., for GMT-06 Central; 6hr = 360min = 0x00000168)
|-
| 0x68
| 0x6B
| Standard Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CST\0, ACST)
|-
| 0x6C
| 0x6F
| Daylight Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CDT\0, ACDT)
|-
| 0x70
| 0x77
| Unknown Padding ?
|-
| 0x78
| 0x7B
| Standard Time Starts 10-05-00-02 (Month-Day-DayOfWeek-Hour)
|-
| 0x7C
| 0x7F
| Daylight Savings Time Starts 04-01-00-02 (Month-Day-DayOfWeek-Hour)
|-
| 0x80
| 0x87
| Unknown Padding ?
|-
| 0x88
| 0x8B
| Standard Timezone Bias; if not DST, 0 (0x00000000) minute time adjust
|-
| 0x8C
| 0x8F
| Daylight Savings Time Bias; if DST, -60 (0xFFFFFFC4) minute time adjust
|-
| 0x90
| 0x93
| Language ID (0 = not set)
* 0x00000001 = English
* 0x00000002 = Japanese
* 0x00000003 = German
* 0x00000004 = French
* 0x00000005 = Spanish
* 0x00000006 = Italian
* 0x00000007 = Korean
* 0x00000008 = Chinese
* 0x00000009 = Portuguese
|-
| 0x94
| 0x97
| Video Settings
* 0x00080000 = 480p
* 0x00020000 = 720p
* 0x00040000 = 1080i

* 0x00010000 = Widescreen{{FIXME|reason=What happens if Widescreen and letterbox are enabled at the same time? Can this happen?}}
* 0x00100000 = Letterbox{{FIXME|reason=What happens if Widescreen and letterbox are enabled at the same time? Can this happen?}}

* 0x00400000 = 60Hz{{FIXME|reason=Unconfirmed; Also, what happens if both refresh rates are disabled?}}
* 0x00800000 = 50Hz{{FIXME|reason=Unconfirmed; Also, what happens if both refresh rates are disabled?}}
|-
| 0x98
| 0x9B
| Audio Settings
* 0x00000000 = Stereo
* 0x00000001 = Mono
* 0x00000002 = Surround
* 0x00010000 = Enable AC3
* 0x00020000 = Enable DTS
|-
| 0x9C
| 0x9F
| Games Parental Control (0 = Max rating)
* 0x00000000 = Rating Pending (RP)
* 0x00000001 = Adults Only (AO)
* 0x00000002 = Mature (M)
* 0x00000003 = Teen (T)
* 0x00000004 = Everyone (E)
* 0x00000005 = Kids to Adults (K-A)
* 0x00000006 = Early Childhood (EC)
|-
| 0xA0
| 0xA3
| Parental Control Passcode; 4 button sequence (each key stored in a nibble)
* 0x1 = {{input-dy+}} or {{input-ly+}}
* 0x2 = {{input-dy-}} or {{input-ly-}}
* 0x3 = {{input-dx-}} or {{input-lx-}}
* 0x4 = {{input-dx+}} or {{input-lx+}}
* 0x5 = {{input-a}}
* 0x6 = {{input-b}}
* 0x7 = {{input-x}}
* 0x8 = {{input-y}}
* 0xB = {{input-lt}}
* 0xC = {{input-rt}}
* 0x0 = Disabled{{FIXME|reason=Is this 0x00000000 only, or are shorter codes possible? can a middle section be 0x00 or would that end the sequence?}}

''Note'':
* A passcode 0x00001423 is D-pad directions up (0x1), right (0x4), down (0x2), left (0x3).
* Pass code only uses the lower 16 bits; each button is stored as a nibble in the word. First button in the most significant nibble and last in the least significant nibble.
|-
| 0xA4
| 0xA7
| Movies Parental Control (0 = Max rating)
* 0x00000001 = Adults Only (NC-17)
* 0x00000002 = Restricted (R)
* 0x00000004 = Parents Strongly Cautioned (PG-13)
* 0x00000005 = Parental Guidance Suggested (PG)
* 0x00000007 = General Audiences (G)
|-
| 0xA8
| 0xAB
| XBOX Live IP Address..
|-
| 0xAC
| 0xAF
| XBOX Live DNS Server..
|-
| 0xB0
| 0xB3
| XBOX Live Gateway Address..
|-
| 0xB4
| 0xB7
| XBOX Live Subnet Mask..
|-
| 0xB8
| 0xBB
| Other XBLive settings ?
|-
| 0xBC
| 0xBF
| DVD Playback Kit Zone
* 0x00000000 = None
* 0x00000001 = Region 1
* ...
* 0x00000006 = Region 6{{FIXME|reason=We should document which regions were actually sold in stores}}
|-
| 0xC0
| 0xFF
| Unknown Codes / History ? do not change any values in this range
|-
|}

Note: Info in above table comes from XKUtils [https://svn.exotica.org.uk:8443/xbmc4xbox/tags/3.5.3/xbmc/xbox/XKEEPROM.h XKEEPROM.h].

*Configmagic-FINAL-1.6 uses the wrong size when computing Checksum2 (40 instead of 44 bytes) and Checksum3 (96 instead of 92 bytes). Checksum2 value computed was correct only because the extra 4 bytes not used in the CRC computation were all 0's which does not change the CRC value. However, a similiar problem with computation of Checksum3 is present. The CRC computed for v1.6 Xbox's is incorrect as the 4 extra bytes are not 0's as on earlier versions.

== Reading/Writing the EEPROM ==

=== Software Method ===
This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.

=== Hardware Method ===
If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an I2C host adapter (see [http://dangerousprototypes.com/blog/bus-pirate-manual/ here]
or [https://www.totalphase.com/products/aardvark-i2cspi/ here]), build an [https://www.youtube.com/watch?v=UcK6nKyKGVQ I2C-Serial cable], or use a device like a RaspberryPi which has an I2C interface. Connect SDA/SCL/ground to the LPC pinout on the board. See [https://github.com/grimdoomer/PiPROM here] for pinout information. Then use the corresponding software to read/write the EEPROM.

== The HMAC HDD Key ==

The HMAC HDD Key is generated{{FIXME|reason=Stored? Derived? At factory?}} out of the first 48 bytes{{FIXME|reason=..first 48 EEPROM bytes? Encrypted / Decrypted?}}. This section has been identified clearly{{FIXME|reason=What does this mean?}}.

== Checksum Algorithm ==

Checksum2 and Checksum3 values can be calculated by running the following code snippet over the area the checksum covers:

<pre> /* The EepromCRC algorithm was obtained from the XKUtils 0.2 source released by
* TeamAssembly under the GNU GPL.
* Specifically, from XKCRC.cpp
*
* Rewritten to ANSI C by David Pye (dmp@davidmpye.dyndns.org)
*
* Adapted for XboxDevWiki
*/
uint32_t EepromCRC(unsigned char *data, long dataLen) {

// Initialize result to zero
uint8_t crc[4] = { 0x00, 0x00, 0x00, 0x00 };

//Circle shift input data one byte right
unsigned char* CRC_Data = (unsigned char *)malloc(dataLen + 4);
memset(CRC_Data, 0x00, dataLen + 4);
memcpy(CRC_Data + 0x01 , data, dataLen - 1);
memcpy(CRC_Data, data + dataLen - 1, 0x01);

// Calculate checksum
for (unsigned int i = 0; i < 4; i++) {
unsigned short CRCPosVal = 0xFFFF;
for (unsigned long l = i; l < dataLen; l += 4) {
CRCPosVal -= *(unsigned short*)(&CRC_Data[l]);
}
CRCPosVal &= 0xFF00;
crc[i] = (unsigned char) (CRCPosVal << 8);
}

free(CRC_Data);

return *(uint32_t*)&checksum;
}
</pre>

== Read Checksum Algorithm ==

When the Xbox reads from the FACTORY_SETTINGS or the USER_SETTINGS section of the EEPROM, this algorithm is ran over the entire section accessed (including the CRC checksum mentioned above) to ensure that the data is valid. If the result of the checksum algorithm does not equal 0xFFFFFFFF, STATUS_DEVICE_DATA_ERROR is returned from the Kernel.

<pre>static uint32_t eeprom_section_checksum(
const uint32_t* section_data,
uint32_t section_data_length
)
{
const uint32_t bitmask = 0xFFFFFFFF;
uint64_t checksum = 0;
uint32_t carry_count = 0;

// Process the data in 32 bit steps
for(unsigned int i = 0; i < section_data_length / 4; i++) {
checksum += *section_data;
if(checksum > bitmask) {
carry_count++;
checksum &= bitmask;
}
section_data++;
}
checksum += carry_count;
if(checksum > bitmask) {
checksum += 1;
}
return (uint32_t)(checksum & bitmask);
}
</pre>

== Further Reading ==

* [https://web.archive.org/web/20040604013125/http://console-dev.com:80/eeprom.htm Information about EEPROM contents]
* [https://github.com/grimdoomer/PiPROM Read/Write an original Xbox EEPROM chip with a Raspberry Pi]
* [https://www.youtube.com/watch?v=UcK6nKyKGVQ How To Make Xbox EEPROM Reader / Write (Video)]
* [https://www.youtube.com/watch?v=uzrljlHDr9w How To Extract Xbox EEPROM Easy (Video)]

EEPROM

2019-06-12T16:06:33Z

Dracc: Add Audio settings as described by LukeUsher

The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54.
Parts of the EEPROM are encrypted using [[Kernel/XboxEEPROMKey]].

== Contents ==

{| class="wikitable"
! Start !! End !! Notes
|-
| 0x00
| 0x13
| HMAC_SHA1 Hash
|-
| 0x14
| 0x1B
| RC4 Encrypted Confounder ??
|-
| 0x1C
| 0x2B
| RC4 Encrypted HDD key
|-
| 0x2C
| 0x2F
| RC4 Encrypted Region code
* 0x00000001 = North America
* 0x00000002 = Japan
* 0x00000004 = Europe & Australia
* 0x80000000 = Manufacturing plant
|-
| 0x30
| 0x33
| Checksum2 - Checksum of next 44 (0x2C) bytes (0x34 - 0x5F)*
|-
| 0x34
| 0x3F
| Xbox serial number - (ASCII chars 0x30 - 0x39 to match each digit in SN)
|-
| 0x40
| 0x45
| Ethernet MAC address (Microsoft Xbox - 00:50:F2:xx:xx:xx)
This is the MAC address of the Ethernet hardware, which has been [https://web.archive.org/web/20100617020733/http://standards.ieee.org/regauth/oui/oui_public.txt issued by the IEEE].
|-
| 0x46
| 0x47
| Unknown Padding ?
|-
| 0x48
| 0x57
| Online Key ?
|-
| 0x58
| 0x5B
| Video Standard
* 0x00000000 = not set (INVALID)
* 0x00400100 = NTSC-M
* 0x00400200 = NTSC-J
* 0x00800300 = PAL-I
* 0x00400400 = PAL-M
|-
| 0x5C
| 0x5F
| Unknown Padding ?
|-
| 0x60
| 0x63
| Checksum3 - Checksum of the next 92 (0x5C) bytes (0x64 - 0xBF)*
|-
| 0x64
| 0x67
| Zone Bias - Offset in # minutes to subtract from GMT time
(e.g., for GMT-06 Central; 6hr = 360min = 0x00000168)
|-
| 0x68
| 0x6B
| Standard Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CST\0, ACST)
|-
| 0x6C
| 0x6F
| Daylight Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CDT\0, ACDT)
|-
| 0x70
| 0x77
| Unknown Padding ?
|-
| 0x78
| 0x7B
| Standard Time Starts 10-05-00-02 (Month-Day-DayOfWeek-Hour)
|-
| 0x7C
| 0x7F
| Daylight Savings Time Starts 04-01-00-02 (Month-Day-DayOfWeek-Hour)
|-
| 0x80
| 0x87
| Unknown Padding ?
|-
| 0x88
| 0x8B
| Standard Timezone Bias; if not DST, 0 (0x00000000) minute time adjust
|-
| 0x8C
| 0x8F
| Daylight Savings Time Bias; if DST, -60 (0xFFFFFFC4) minute time adjust
|-
| 0x90
| 0x93
| Language ID (0 = not set)
* 0x00000001 = English
* 0x00000002 = Japanese
* 0x00000003 = German
* 0x00000004 = French
* 0x00000005 = Spanish
* 0x00000006 = Italian
* 0x00000007 = Korean
* 0x00000008 = Chinese
* 0x00000009 = Portuguese
|-
| 0x94
| 0x97
| Video Settings
* 0x00080000 = 480p
* 0x00020000 = 720p
* 0x00040000 = 1080i

* 0x00010000 = Widescreen{{FIXME|reason=What happens if Widescreen and letterbox are enabled at the same time? Can this happen?}}
* 0x00100000 = Letterbox{{FIXME|reason=What happens if Widescreen and letterbox are enabled at the same time? Can this happen?}}

* 0x00400000 = 60Hz{{FIXME|reason=Unconfirmed; Also, what happens if both refresh rates are disabled?}}
* 0x00800000 = 50Hz{{FIXME|reason=Unconfirmed; Also, what happens if both refresh rates are disabled?}}
|-
| 0x98
| 0x9B
| Audio Settings
* Channels
* 0x00000000 = Stereo
* 0x00000001 = Mono
* 0x00000002 = Surround
* Flags
* 0x00010000 = Enable AC3
* 0x00020000 = Enable DTS
|-
| 0x9C
| 0x9F
| Games Parental Control (0 = Max rating)
* 0x00000000 = Rating Pending (RP)
* 0x00000001 = Adults Only (AO)
* 0x00000002 = Mature (M)
* 0x00000003 = Teen (T)
* 0x00000004 = Everyone (E)
* 0x00000005 = Kids to Adults (K-A)
* 0x00000006 = Early Childhood (EC)
|-
| 0xA0
| 0xA3
| Parental Control Passcode; 4 button sequence (each key stored in a nibble)
* 0x1 = {{input-dy+}} or {{input-ly+}}
* 0x2 = {{input-dy-}} or {{input-ly-}}
* 0x3 = {{input-dx-}} or {{input-lx-}}
* 0x4 = {{input-dx+}} or {{input-lx+}}
* 0x5 = {{input-a}}
* 0x6 = {{input-b}}
* 0x7 = {{input-x}}
* 0x8 = {{input-y}}
* 0xB = {{input-lt}}
* 0xC = {{input-rt}}
* 0x0 = Disabled{{FIXME|reason=Is this 0x00000000 only, or are shorter codes possible? can a middle section be 0x00 or would that end the sequence?}}

''Note'':
* A passcode 0x00001423 is D-pad directions up (0x1), right (0x4), down (0x2), left (0x3).
* Pass code only uses the lower 16 bits; each button is stored as a nibble in the word. First button in the most significant nibble and last in the least significant nibble.
|-
| 0xA4
| 0xA7
| Movies Parental Control (0 = Max rating)
* 0x00000001 = Adults Only (NC-17)
* 0x00000002 = Restricted (R)
* 0x00000004 = Parents Strongly Cautioned (PG-13)
* 0x00000005 = Parental Guidance Suggested (PG)
* 0x00000007 = General Audiences (G)
|-
| 0xA8
| 0xAB
| XBOX Live IP Address..
|-
| 0xAC
| 0xAF
| XBOX Live DNS Server..
|-
| 0xB0
| 0xB3
| XBOX Live Gateway Address..
|-
| 0xB4
| 0xB7
| XBOX Live Subnet Mask..
|-
| 0xB8
| 0xBB
| Other XBLive settings ?
|-
| 0xBC
| 0xBF
| DVD Playback Kit Zone
* 0x00000000 = None
* 0x00000001 = Region 1
* ...
* 0x00000006 = Region 6{{FIXME|reason=We should document which regions were actually sold in stores}}
|-
| 0xC0
| 0xFF
| Unknown Codes / History ? do not change any values in this range
|-
|}

Note: Info in above table comes from XKUtils [https://svn.exotica.org.uk:8443/xbmc4xbox/tags/3.5.3/xbmc/xbox/XKEEPROM.h XKEEPROM.h].

*Configmagic-FINAL-1.6 uses the wrong size when computing Checksum2 (40 instead of 44 bytes) and Checksum3 (96 instead of 92 bytes). Checksum2 value computed was correct only because the extra 4 bytes not used in the CRC computation were all 0's which does not change the CRC value. However, a similiar problem with computation of Checksum3 is present. The CRC computed for v1.6 Xbox's is incorrect as the 4 extra bytes are not 0's as on earlier versions.

== Reading/Writing the EEPROM ==

=== Software Method ===
This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.

=== Hardware Method ===
If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an I2C host adapter (see [http://dangerousprototypes.com/blog/bus-pirate-manual/ here]
or [https://www.totalphase.com/products/aardvark-i2cspi/ here]), build an [https://www.youtube.com/watch?v=UcK6nKyKGVQ I2C-Serial cable], or use a device like a RaspberryPi which has an I2C interface. Connect SDA/SCL/ground to the LPC pinout on the board. See [https://github.com/grimdoomer/PiPROM here] for pinout information. Then use the corresponding software to read/write the EEPROM.

== The HMAC HDD Key ==

The HMAC HDD Key is generated{{FIXME|reason=Stored? Derived? At factory?}} out of the first 48 bytes{{FIXME|reason=..first 48 EEPROM bytes? Encrypted / Decrypted?}}. This section has been identified clearly{{FIXME|reason=What does this mean?}}.

== Checksum Algorithm ==

Checksum2 and Checksum3 values can be calculated by running the following code snippet over the area the checksum covers:

<pre> /* The EepromCRC algorithm was obtained from the XKUtils 0.2 source released by
* TeamAssembly under the GNU GPL.
* Specifically, from XKCRC.cpp
*
* Rewritten to ANSI C by David Pye (dmp@davidmpye.dyndns.org)
*
* Adapted for XboxDevWiki
*/
uint32_t EepromCRC(unsigned char *data, long dataLen) {

// Initialize result to zero
uint8_t crc[4] = { 0x00, 0x00, 0x00, 0x00 };

//Circle shift input data one byte right
unsigned char* CRC_Data = (unsigned char *)malloc(dataLen + 4);
memset(CRC_Data, 0x00, dataLen + 4);
memcpy(CRC_Data + 0x01 , data, dataLen - 1);
memcpy(CRC_Data, data + dataLen - 1, 0x01);

// Calculate checksum
for (unsigned int i = 0; i < 4; i++) {
unsigned short CRCPosVal = 0xFFFF;
for (unsigned long l = i; l < dataLen; l += 4) {
CRCPosVal -= *(unsigned short*)(&CRC_Data[l]);
}
CRCPosVal &= 0xFF00;
crc[i] = (unsigned char) (CRCPosVal << 8);
}

free(CRC_Data);

return *(uint32_t*)&checksum;
}
</pre>

== Read Checksum Algorithm ==

When the Xbox reads from the FACTORY_SETTINGS or the USER_SETTINGS section of the EEPROM, this algorithm is ran over the entire section accessed (including the CRC checksum mentioned above) to ensure that the data is valid. If the result of the checksum algorithm does not equal 0xFFFFFFFF, STATUS_DEVICE_DATA_ERROR is returned from the Kernel.

<pre>static uint32_t eeprom_section_checksum(
const uint32_t* section_data,
uint32_t section_data_length
)
{
const uint32_t bitmask = 0xFFFFFFFF;
uint64_t checksum = 0;
uint32_t carry_count = 0;

// Process the data in 32 bit steps
for(unsigned int i = 0; i < section_data_length / 4; i++) {
checksum += *section_data;
if(checksum > bitmask) {
carry_count++;
checksum &= bitmask;
}
section_data++;
}
checksum += carry_count;
if(checksum > bitmask) {
checksum += 1;
}
return (uint32_t)(checksum & bitmask);
}
</pre>

== Further Reading ==

* [https://web.archive.org/web/20040604013125/http://console-dev.com:80/eeprom.htm Information about EEPROM contents]
* [https://github.com/grimdoomer/PiPROM Read/Write an original Xbox EEPROM chip with a Raspberry Pi]
* [https://www.youtube.com/watch?v=UcK6nKyKGVQ How To Make Xbox EEPROM Reader / Write (Video)]
* [https://www.youtube.com/watch?v=uzrljlHDr9w How To Extract Xbox EEPROM Easy (Video)]

EEPROM

2019-06-12T07:00:09Z

Dracc: Video settings "Normal" confirmed

The Xbox EEPROM is a 256 byte non-volatile storage device which contains device-specific information. It is connected via I²C and located on address 0x54.
Parts of the EEPROM are encrypted using [[Kernel/XboxEEPROMKey]].

== Contents ==

{| class="wikitable"
! Start !! End !! Notes
|-
| 0x00
| 0x13
| HMAC_SHA1 Hash
|-
| 0x14
| 0x1B
| RC4 Encrypted Confounder ??
|-
| 0x1C
| 0x2B
| RC4 Encrypted HDD key
|-
| 0x2C
| 0x2F
| RC4 Encrypted Region code
* 0x00000001 = North America
* 0x00000002 = Japan
* 0x00000004 = Europe & Australia
* 0x80000000 = Manufacturing plant
|-
| 0x30
| 0x33
| Checksum2 - Checksum of next 44 (0x2C) bytes (0x34 - 0x5F)*
|-
| 0x34
| 0x3F
| Xbox serial number - (ASCII chars 0x30 - 0x39 to match each digit in SN)
|-
| 0x40
| 0x45
| Ethernet MAC address (Microsoft Xbox - 00:50:F2:xx:xx:xx)
This is the MAC address of the Ethernet hardware, which has been [https://web.archive.org/web/20100617020733/http://standards.ieee.org/regauth/oui/oui_public.txt issued by the IEEE].
|-
| 0x46
| 0x47
| Unknown Padding ?
|-
| 0x48
| 0x57
| Online Key ?
|-
| 0x58
| 0x5B
| Video Standard
* 0x00000000 = not set (INVALID)
* 0x00400100 = NTSC-M
* 0x00400200 = NTSC-J
* 0x00800300 = PAL-I
* 0x00400400 = PAL-M
|-
| 0x5C
| 0x5F
| Unknown Padding ?
|-
| 0x60
| 0x63
| Checksum3 - Checksum of the next 92 (0x5C) bytes (0x64 - 0xBF)*
|-
| 0x64
| 0x67
| Zone Bias - Offset in # minutes to subtract from GMT time
(e.g., for GMT-06 Central; 6hr = 360min = 0x00000168)
|-
| 0x68
| 0x6B
| Standard Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CST\0, ACST)
|-
| 0x6C
| 0x6F
| Daylight Timezone Name: 4 characters, NULL fill remainder if shorter (e.g., CDT\0, ACDT)
|-
| 0x70
| 0x77
| Unknown Padding ?
|-
| 0x78
| 0x7B
| Standard Time Starts 10-05-00-02 (Month-Day-DayOfWeek-Hour)
|-
| 0x7C
| 0x7F
| Daylight Savings Time Starts 04-01-00-02 (Month-Day-DayOfWeek-Hour)
|-
| 0x80
| 0x87
| Unknown Padding ?
|-
| 0x88
| 0x8B
| Standard Timezone Bias; if not DST, 0 (0x00000000) minute time adjust
|-
| 0x8C
| 0x8F
| Daylight Savings Time Bias; if DST, -60 (0xFFFFFFC4) minute time adjust
|-
| 0x90
| 0x93
| Language ID (0 = not set)
* 0x00000001 = English
* 0x00000002 = Japanese
* 0x00000003 = German
* 0x00000004 = French
* 0x00000005 = Spanish
* 0x00000006 = Italian
* 0x00000007 = Korean
* 0x00000008 = Chinese
* 0x00000009 = Portuguese
|-
| 0x94
| 0x97
| Video Settings

Offset 0x96:
* 0x00=Normal
* 0xB0=Widescreen
* 0xB4=Letterbox
|-
| 0x98
| 0x9B
| Audio Settings
|-
| 0x9C
| 0x9F
| Games Parental Control (0 = Max rating)
* 0x00000000 = Rating Pending (RP)
* 0x00000001 = Adults Only (AO)
* 0x00000002 = Mature (M)
* 0x00000003 = Teen (T)
* 0x00000004 = Everyone (E)
* 0x00000005 = Kids to Adults (K-A)
* 0x00000006 = Early Childhood (EC)
|-
| 0xA0
| 0xA3
| Parental Control Passcode; 4 button sequence (each key stored in a nibble)
* 0x1 = {{input-dy+}} or {{input-ly+}}
* 0x2 = {{input-dy-}} or {{input-ly-}}
* 0x3 = {{input-dx-}} or {{input-lx-}}
* 0x4 = {{input-dx+}} or {{input-lx+}}
* 0x5 = {{input-a}}
* 0x6 = {{input-b}}
* 0x7 = {{input-x}}
* 0x8 = {{input-y}}
* 0xB = {{input-lt}}
* 0xC = {{input-rt}}
* 0x0 = Disabled{{FIXME|reason=Is this 0x00000000 only, or are shorter codes possible? can a middle section be 0x00 or would that end the sequence?}}

''Note'':
* A passcode 0x00001423 is D-pad directions up (0x1), right (0x4), down (0x2), left (0x3).
* Pass code only uses the lower 16 bits; each button is stored as a nibble in the word. First button in the most significant nibble and last in the least significant nibble.
|-
| 0xA4
| 0xA7
| Movies Parental Control (0 = Max rating)
* 0x00000001 = Adults Only (NC-17)
* 0x00000002 = Restricted (R)
* 0x00000004 = Parents Strongly Cautioned (PG-13)
* 0x00000005 = Parental Guidance Suggested (PG)
* 0x00000007 = General Audiences (G)
|-
| 0xA8
| 0xAB
| XBOX Live IP Address..
|-
| 0xAC
| 0xAF
| XBOX Live DNS Server..
|-
| 0xB0
| 0xB3
| XBOX Live Gateway Address..
|-
| 0xB4
| 0xB7
| XBOX Live Subnet Mask..
|-
| 0xB8
| 0xBB
| Other XBLive settings ?
|-
| 0xBC
| 0xBF
| DVD Playback Kit Zone
* 0x00000000 = None
* 0x00000001 = Region 1
* ...
* 0x00000006 = Region 6{{FIXME|reason=We should document which regions were actually sold in stores}}
|-
| 0xC0
| 0xFF
| Unknown Codes / History ? do not change any values in this range
|-
|}

Note: Info in above table comes from XKUtils [https://svn.exotica.org.uk:8443/xbmc4xbox/tags/3.5.3/xbmc/xbox/XKEEPROM.h XKEEPROM.h].

*Configmagic-FINAL-1.6 uses the wrong size when computing Checksum2 (40 instead of 44 bytes) and Checksum3 (96 instead of 92 bytes). Checksum2 value computed was correct only because the extra 4 bytes not used in the CRC computation were all 0's which does not change the CRC value. However, a similiar problem with computation of Checksum3 is present. The CRC computed for v1.6 Xbox's is incorrect as the 4 extra bytes are not 0's as on earlier versions.

== Reading/Writing the EEPROM ==

=== Software Method ===
This is the easiest way to dump an Xbox EEPROM. Use your alternative dashboard to dump the EEPROM to a file and download it over FTP.

=== Hardware Method ===
If you cannot dump the EEPROM using software, you can dump it using hardware. You have several options: use an I2C host adapter (see [http://dangerousprototypes.com/blog/bus-pirate-manual/ here]
or [https://www.totalphase.com/products/aardvark-i2cspi/ here]), build an [https://www.youtube.com/watch?v=UcK6nKyKGVQ I2C-Serial cable], or use a device like a RaspberryPi which has an I2C interface. Connect SDA/SCL/ground to the LPC pinout on the board. See [https://github.com/grimdoomer/PiPROM here] for pinout information. Then use the corresponding software to read/write the EEPROM.

== The HMAC HDD Key ==

The HMAC HDD Key is generated{{FIXME|reason=Stored? Derived? At factory?}} out of the first 48 bytes{{FIXME|reason=..first 48 EEPROM bytes? Encrypted / Decrypted?}}. This section has been identified clearly{{FIXME|reason=What does this mean?}}.

== Checksum Algorithm ==

Checksum2 and Checksum3 values can be calculated by running the following code snippet over the area the checksum covers:

<pre> /* The EepromCRC algorithm was obtained from the XKUtils 0.2 source released by
* TeamAssembly under the GNU GPL.
* Specifically, from XKCRC.cpp
*
* Rewritten to ANSI C by David Pye (dmp@davidmpye.dyndns.org)
*
* Adapted for XboxDevWiki
*/
uint32_t EepromCRC(unsigned char *data, long dataLen) {

// Initialize result to zero
uint8_t crc[4] = { 0x00, 0x00, 0x00, 0x00 };

//Circle shift input data one byte right
unsigned char* CRC_Data = (unsigned char *)malloc(dataLen + 4);
memset(CRC_Data, 0x00, dataLen + 4);
memcpy(CRC_Data + 0x01 , data, dataLen - 1);
memcpy(CRC_Data, data + dataLen - 1, 0x01);

// Calculate checksum
for (unsigned int i = 0; i < 4; i++) {
unsigned short CRCPosVal = 0xFFFF;
for (unsigned long l = i; l < dataLen; l += 4) {
CRCPosVal -= *(unsigned short*)(&CRC_Data[l]);
}
CRCPosVal &= 0xFF00;
crc[i] = (unsigned char) (CRCPosVal << 8);
}

free(CRC_Data);

return *(uint32_t*)&checksum;
}
</pre>

== Read Checksum Algorithm ==

When the Xbox reads from the FACTORY_SETTINGS or the USER_SETTINGS section of the EEPROM, this algorithm is ran over the entire section accessed (including the CRC checksum mentioned above) to ensure that the data is valid. If the result of the checksum algorithm does not equal 0xFFFFFFFF, STATUS_DEVICE_DATA_ERROR is returned from the Kernel.

<pre>static uint32_t eeprom_section_checksum(
const uint32_t* section_data,
uint32_t section_data_length
)
{
const uint32_t bitmask = 0xFFFFFFFF;
uint64_t checksum = 0;
uint32_t carry_count = 0;

// Process the data in 32 bit steps
for(unsigned int i = 0; i < section_data_length / 4; i++) {
checksum += *section_data;
if(checksum > bitmask) {
carry_count++;
checksum &= bitmask;
}
section_data++;
}
checksum += carry_count;
if(checksum > bitmask) {
checksum += 1;
}
return (uint32_t)(checksum & bitmask);
}
</pre>

== Further Reading ==

* [https://web.archive.org/web/20040604013125/http://console-dev.com:80/eeprom.htm Information about EEPROM contents]
* [https://github.com/grimdoomer/PiPROM Read/Write an original Xbox EEPROM chip with a Raspberry Pi]
* [https://www.youtube.com/watch?v=UcK6nKyKGVQ How To Make Xbox EEPROM Reader / Write (Video)]
* [https://www.youtube.com/watch?v=uzrljlHDr9w How To Extract Xbox EEPROM Easy (Video)]

Main Page

2019-06-11T12:18:11Z

Dracc: Added Config Sector to the listing

{{:Main Page/Header}}
__NOTOC__

== Hardware ==

* [[Chihiro]]
* [[Xbox]]

* [[Hardware Revisions]]
* [[Motherboard]]
* [[CPU]]
* [[NV2A]]
** [[NV2A/Vertex attributes]]
** [[NV2A/Fixed Function Pipeline]]
** [[NV2A/Vertex Shader]]
** [[NV2A/Pixel Combiner]]
** [[NV2A/Surface Formats]]
* [[Memory]]
* [[Flash ROM]]
* [[MCPX]]
** [[APU]]
*** [[DSP]]
** [[ACI]]
** [[Network]]
* [[PCI]]
* [[SMBus]]
** [[EEPROM]]
** [[SMC]]
** [[Video Encoder]]
*** [[AV Cables]]
* [[DVD Drive]]
** [[Xbox Game Disc]]
* [[Hard Drive]]
** [[Config Sector]]
* [[USB]]
** [[Xbox Input Devices]]
** [[Xbox Memory Unit]]
** [[Xbox Live Communicator]] 
** [[Xbox DVD Movie Playback Kit]]
* [[Power Supply]]
* [[Development Kits]]
** [[Super I/O]]
** [[DVD Emulator]]
* [[Manufacturing Process]]

== System Software ==
* [[MCPX ROM]]
* [[BIOS]] / [[Kernel]]
** [[Boot Process]]
** [[XBE]] (Executable file format)
* [[FATX]] (Filesystem)
* [[Xbox ADPCM]]
* [[Dashboard]]
** [[Soundtracks]]
* [[Exploits]]

== Development Kits and Tools ==
* [https://github.com/xqemu/nxdk nxdk (New Xbox Development Kit)]
* [[OpenXDK]]
* [[Microsoft XDK]]
** [[Xbox Title Libraries]]
** [[Direct3D]]
** [[DirectSound]]
** [[System Link]]
** [[Xbox Live]]
** [[Xbox Debug Monitor]]
** [[Xbox Neighborhood]]
** [[Kernel_Debug| Xbox Kernel Debugging]]

== Games ==
* [[:Category:Games|Games]]
* [[Engine List]]

== Emulation ==
* [[Emulators]]
** [[XQEMU]]
** [[Xbox 360 Backward Compatibility]]

== Historical Pages ==
(archived from the xbox-linux wiki)
* [[Xbox Hard Drive Locking Mechanism]]
* [[Xbox Savegame System]]
* [[Xbox Hardware Overview]]
* [[Xbox Hard Disk Technical_Details]]
* [[Xbox Hard Disk Partitioning]]
* [[Xbox Manufacturing Process]]
* [[The Hidden Boot Code of the Xbox]]
* [[PIC]]
* [[SMBus]]
* [[NForce]]
* [[17 Mistakes Microsoft Made in the Xbox Security System]]
* [[Porting an Operating System to the Xbox HOWTO]]

== Other ==
* [[Patents]]
* [[Resources]]

Config Sector

2019-06-11T12:16:55Z

Dracc: Created page with "{| class="wikitable" !Offset !Size !Description |- |0x1020 |4 |Static IP Address |- |0x1024 |4 |Static Subnet Mask |- |0x1028 |4 |Static Default Gateway |- |0x102C |4 |Static..."

{| class="wikitable"
!Offset
!Size
!Description
|-
|0x1020
|4
|Static IP Address
|-
|0x1024
|4
|Static Subnet Mask
|-
|0x1028
|4
|Static Default Gateway
|-
|0x102C
|4
|Static Primary DNS Server
|-
|0x1030
|4
|Static Secondary DNS Server
|-
|0x1034
|32
!(Unknown padding)
|-
|0x1054
|4
|Xbox Live IP Address
|-
|0x1058
|4
|Xbox Live Subnet Mask
|-
|0x105C
|4
|Xbox Live Default Gateway
|-
|0x1060
|4
|Xbox Live Primary DNS Server
|-
|0x1064
|4
|Xbox Live Secondary DNS Server
|-
|0x1068
|40
|Xbox Live Hostname
|-
|0x1090
|64
|Xbox Live PPPOE Username
|-
|0x10D0
|64
|Xbox Live PPPOE Password
|-
|0x1110
|40
!(Unknown padding)
|-
|0x1138
|40
|Xbox Live PPPOE Service Name
|-
|0x1160
|12
!(Unknown)
|-
|0x116C
|4
|DHCP IP Address
|-
|0x1170
|4
|DHCP Subnet Mask
|-
|0x1174
|4
|DHCP Default Gateway
|-
|0x1178
|4
|DHCP Primary DNS Server
|-
|0x117C
|4
|DHCP Secondary DNS Server
|-
|0x1180
|4
|PPPOE IP Address (?)
|-
|0x1184
|4
|PPPOE Subnet Mask (?)
|-
|0x1188
|4
|PPPOE Gateway Address (?)
|-
|0x118C
|4
|PPPOE Primary DNS Server (?)
|-
|0x1190
|4
|PPPOE Secondary DNS Server (?)
|}

==References==
* [https://archive.fo/c9s3B Xbox live (accounts, xqemu and MU) | ASSEMbler - Home of the obscure (archive.org)]

Xbox Input Devices

2018-10-11T13:29:57Z

Dracc:

== XID Overview ==

XIDs are USB devices.

The hardware side is USB with a different plug while the software side is USB without HID-descriptors.
Technicly a XID is a USB-hub for the Memory-Units and the XBL Communicator.
The logical XID gamepad USB device is internally connected to that hub.

=== USB Adapters ===
The Xbox input devices are USB devices. As such, you can connect a keyboard to the Xbox, or a gamepad to your PC. In fact, Linux already has drivers for the gamepad. In order to preserve Xbox hardware, please do not cut OEM Xbox cables to make an adapter. Decent adapters can be acquired cheaply (~$10 USD ea. on 2017.04.30).

{| class="wikitable"
|-
! Port (From)
! Plug (To)
! Link
|-
| Xbox
| USB-A
| [https://www.amazon.com/gp/product/B000RT2868 Amazon]
|-
| USB-A
| Xbox
| [https://www.amazon.com/gp/product/B00F52LQHO Amazon]
|}

=== Wiring ===

Untested / unverified! Take this with a grain of salt.

{| class="wikitable"
!Pin
!Typical cable color
!Description
|-
|1
|Red
|VCC
|-
|2
|White
|USB D+
|-
|3
|Green
|USB D-
|-
|4
|Yellow
|VBlank signal from video output (for Lightguns)
|-
|5
|Black
|GND
|-
|}

=== Protocol ===

XID are similar to HID but have custom Vendor requests

==== Control Transfers ====

===== GET_DESCRIPTOR =====

* bmRequestType: 0xC1
* bRequest: 6
* wValue: 0x4200
* wIndex: Interface number
* wLength: <length of respective report; typically 16>

Actual length is truncated to size of descriptor or wLength. Whichever is smaller.

<pre>
typedef struct XIDDescriptor {
uint8_t bLength;
uint8_t bDescriptorType;
uint16_t bcdXid;
uint8_t bType;
uint8_t bSubType;
uint8_t bMaxInputReportSize;
uint8_t bMaxOutputReportSize;
uint16_t wAlternateProductIds[4];
};
</pre>

bDescriptorType is probably always 0x42.

====== bType = 1: Xbox Gamecontroller ======

* bSubType:
** 0x01 = Gamepad (Duke)
** 0x02 = Gamepad (Controller-S)
** 0x10 = Steering wheel

===== GET_CAPABILITIES =====

* bmRequestType: 0xC1
* bRequest: 1
* wValue:
** 0x0100 for input
** 0x0200 for output
* wIndex: Interface number
* wLength: <length of respective report>

* STALL if wValue not supported.

Actual length is truncated to size of report or wLength. Whichever is smaller.

<pre>typedef struct XIDGamepadCapabilities {
uint8_t bReportId;
uint8_t bLength;
<Data>
}</pre>

The data will be similar to the GET_REPORT, but instead of storing actual values, it will have bits set (1) where the bit is valid in the respective report.
If the bit is auto-generated, it will be cleared (0).

===== SET_REPORT =====

* bmRequestType: 0x21
* bRequest: 9
* wValue: 0x0200
* wIndex: Interface number
* wLength: <length of report; typically 6>

* STALL if wValue not supported.

====== Typical report ======

<pre>typedef struct XIDGamepadReport {
uint8_t bReportId;
uint8_t bLength;
<Data>
}</pre>

===== GET_REPORT =====

* bmRequestType: 0xA1
* bRequest: 1
* wValue: 0x0100
* wIndex: Interface number
* wLength: <length of report; typically 20>

* STALL if wValue not supported or if wLength is greater than report size.
* ACK if supported.

====== Typical report ======

<pre>typedef struct XIDGamepadOutputReport {
uint8_t report_id; //FIXME: is this correct?
uint8_t length;
<Data>
}</pre>

==== Interrupt transfers ====

Alternatively interrupt-in and interrupt-out transfers can be used for GET_REPORT and SET_REPORT respectively.

In case of the interrupt-in, there is another status which can occur now:

* NAK if supported but no changes since last ACK.

== Standard Gamepads ==

=== USB Descriptors ===

Most standard gamepads share the same USB descriptor.
Usually the only difference will be the VID / PID.
See https://github.com/xboxdrv/xboxdrv/blob/stable/src/xpad_device.cpp for a list of devices.

=== Controller to Xbox ===

20 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|{{input-dy+}}
|2
|0x01
|
|-
|{{input-dy-}}
|2
|0x02
|
|-
|{{input-dx-}}
|2
|0x04
|
|-
|{{input-dx+}}
|2
|0x08
|
|-
|{{input-start}}
|2
|0x10
|
|-
|{{input-back}}
|2
|0x20
|
|-
|{{input-ls}}
|2
|0x40
|
|-
|{{input-rs}}
|2
|0x80
|
|-
|{{input-a}}
|4
|0xFF
|Button is analog
|-
|{{input-b}}
|5
|0xFF
|Button is analog
|-
|{{input-x}}
|6
|0xFF
|Button is analog
|-
|{{input-y}}
|7
|0xFF
|Button is analog
|-
|{{input-black}}
|8
|0xFF
|Button is analog
|-
|{{input-white}}
|9
|0xFF
|Button is analog
|-
|{{input-lt}}
|10
|0xFF
|Trigger is analog
|-
|{{input-rt}}
|11
|0xFF
|Trigger is analog
|-
|{{input-lx}}
|12
|0xFFFF
|Negative = Left; Positive = Right
|-
|{{input-ly}}
|14
|0xFFFF
|Negative = Down; Positive = Up
|-
|{{input-rx}}
|16
|0xFFFF
|Negative = Left; Positive = Right
|-
|{{input-ry}}
|18
|0xFFFF
|Negative = Down; Positive = Up
|}

=== Xbox to Controller ===

6 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|Left actuator strength
|2
|0xFFFF
|
|-
|Right actuator strength
|4
|0xFFFF
|
|}

The Microsoft Controller S will not react to packets which don't have a value of 6 in the <code>length</code> field of the header.
The Fanatec Speedster 3 ForceShock will still react to those. Further testing is necessary with other gamepads.

== Steering wheels ==

=== MadCatz Wheel ===

{{FIXME}}

=== Fanatec Speedster 3 ForceShock ===

==== Pedals ====

The Pedals are ''not'' a USB device.

Note that the cable going to the pedals is also ''not'' a USB port despite using the Xbox controller breakaway plug.
Likewise, plugging the pedals to a PC / Xbox won't provide a USB / XID (it is detected as garbage):

<pre>
new full-speed USB device number 14 using xhci_hcd
device descriptor read/64, error -71
device descriptor read/64, error -71
new full-speed USB device number 15 using xhci_hcd
device descriptor read/64, error -71
device descriptor read/64, error -71
new full-speed USB device number 16 using xhci_hcd
Device not responding to setup address.
Device not responding to setup address.
device not accepting address 16, error -71
new full-speed USB device number 17 using xhci_hcd
Device not responding to setup address.
Device not responding to setup address.
device not accepting address 17, error -71
unable to enumerate USB device
</pre>

==== Internal HUB ====

===== USB Descriptors =====

Power not connected, pedals not connected, not in Tuning mode:

<pre>
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 9 Hub
bDeviceSubClass 0
bDeviceProtocol 0 Full speed (or root) hub
bMaxPacketSize0 8
idVendor 0x3767
idProduct 0x0102
bcdDevice 0.01
iManufacturer 0
iProduct 1 End
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 25
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xa0
(Bus Powered)
Remote Wakeup
MaxPower 64mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 9 Hub
bInterfaceSubClass 0
bInterfaceProtocol 0 Full speed (or root) hub
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0001 1x 1 bytes
bInterval 255
Hub Descriptor:
bLength 9
bDescriptorType 41
nNbrPorts 3
wHubCharacteristic 0x000d
Per-port power switching
Compound device
Per-port overcurrent protection
bPwrOn2PwrGood 50 * 2 milli seconds
bHubContrCurrent 64 milli Ampere
DeviceRemovable 0x02
PortPwrCtrlMask 0xff
Hub Port Status:
Port 1: 0000.0103 power enable connect
Port 2: 0000.0100 power
Port 3: 0000.0100 power
can't get debug descriptor: Resource temporarily unavailable
Device Status: 0x0003
Self Powered
Remote Wakeup Enabled
</pre>

==== Steering wheel (and Pedals) ====

Always connected to port 1 of the internal HUB

===== USB Descriptors =====

<pre>
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 8
idVendor 0x3767
idProduct 0x0101
bcdDevice 2.80
iManufacturer 0
iProduct 0
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 88 Xbox
bInterfaceSubClass 66 Controller
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
can't get debug descriptor: Resource temporarily unavailable
Device Status: 0x0000
(Bus Powered)
</pre>

== Light guns ==

=== EMS TopGun II ===

''This is an unlicensed / unofficial Xbox accessory.''

The website for this product can be found at http://www.hkems.com/product/xbox/EMSTopGun2.htm

The gun presents itself as a standard Xbox gamepad. It uses a different USB descriptor for Xbox (X) and the other mode (P).
There is no internal hub in this device.

{| class="wikitable"
! EMS TopGun II !! Xbox Gamepad !! Notes
|-
| Stick || {{input-d}} ||
|-
| Trigger || {{input-a}} || rowspan="4" | Digital only, either 0 or 255
|-
| Grip || {{input-b}}
|-
| A || {{input-x}}
|-
| B || {{input-y}}
|-
| START || {{input-start}} ||
|-
| SE/BA || {{input-back}} ||
|-
| Aim Left / Right || {{input-lx}} || rowspan="2" | Absolute position using the full stick range
|-
| Aim Up / Down || {{input-ly}}
|}

There is no right thumbstick, thumbstick presses, black/white button or trigger buttons (All of those read constant zeros).

===== Turbo Mode =====

* Turbo mode 0 keeps {{input-a}} pressed while trigger is held
* Turbo mode 1 toggles {{input-a}} rapidly while trigger is held
* Turbo mode 2 toggles {{input-a}} rapidly and once in a while {{input-b}} while trigger is held

===== Force Feedback =====

The upper part of the gun is moveable and should push back to simulate recoil (possibly hurting your thumb while you are using the stick).
I could not get the force feedback working, but I'm sure I've had it working in the past on PC.{{citation needed}}

==== USB Descriptors ====

This is the descriptor in the Xbox mode (X).

<pre>
Bus 003 Device 016: ID 0b9a:016b
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x0b9a
idProduct 0x016b
bcdDevice 4.57
iManufacturer 1 EMS̖E
iProduct 2 EMS TopGun
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 88 Xbox
bInterfaceSubClass 66 Controller
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 8
can't get debug descriptor: Resource temporarily unavailable
Device Status: 0x0000
(Bus Powered)
</pre>

=== Joytech Sharp Shooter ===

''This is an unlicensed / unofficial Xbox accessory.''

The third party light gun from Joytech reports itself as 2 devices and mentions pattent [http://www.google.com/patents/US6287198 US6287198]
it came with a detachable viewfinder scope without any magnification. a red dot apears in the viewfinder, its a reflection of a red led, powered by the gun over usb.

model numer: JS-901D

{| class="wikitable"
! Joytech Sharp Shooter !! Xbox Gamepad !! Notes
|-
| Stick || {{input-d}} ||
|-
| Trigger || {{input-a}} || rowspan="6" | Digital only, either 0 or 255 {{citation needed}}
|-
| B (Left side) || rowspan="3" | {{input-b}}
|-
| B (Right side)
|-
| B (Magazine button)
|-
| x || {{input-x}}
|-
| y || {{input-y}}
|-
| START || {{input-start}} ||
|-
| BACK || {{input-back}} ||
|-
| Aim Left / Right || {{input-lx}} || {{citation needed}}
|-
| Aim Up / Down || {{input-ly}} || {{citation needed}}
|}

There is no right thumbstick, thumbstick presses, black/white button or trigger buttons {{citation needed}}

===== Fire/Reload Mode =====

* Normal mode does nothing, normal operation
* Auto reload mode toggles {{input-b}} rapidly to rappidly reload {{citation needed}}
* Auto fire+reload mode toggles {{input-a}} + {{input-b}} rapidly {{citation needed}}

==== USB Descriptors ====

<pre>

Bus 003 Device 025: ID 1292:3006 Innomedia
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 8
idVendor 0x1292 Innomedia
idProduct 0x3006
bcdDevice 1.50
iManufacturer 0
iProduct 0
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 1 (error)
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 88 Xbox
bInterfaceSubClass 66 Controller
bInterfaceProtocol 0
iInterface 2 (error)
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4

Bus 003 Device 024: ID 1292:3006 Innomedia
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 9 Hub
bDeviceSubClass 0
bDeviceProtocol 0 Full speed (or root) hub
bMaxPacketSize0 8
idVendor 0x1292 Innomedia
idProduct 0x3006
bcdDevice 1.50
iManufacturer 1 (c) 2004 R0R3 Inc.
iProduct 2 US Patent 6,287,198
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 25
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 4 (c) R0R3 Devices Inc. US Patent 6,287,19Ē
bmAttributes 0xa0
(Bus Powered)
Remote Wakeup
MaxPower 64mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 9 Hub
bInterfaceSubClass 0
bInterfaceProtocol 0 Full speed (or root) hub
iInterface 5 (error)
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0001 1x 1 bytes
bInterval 255
Hub Descriptor:
bLength 9
bDescriptorType 41
nNbrPorts 3
wHubCharacteristic 0x000d
Per-port power switching
Compound device
Per-port overcurrent protection
bPwrOn2PwrGood 32 * 2 milli seconds
bHubContrCurrent 64 milli Ampere
DeviceRemovable 0x02
PortPwrCtrlMask 0x0e
Hub Port Status:
Port 1: 0000.0103 power enable connect
Port 2: 0000.0100 power
Port 3: 0100.0100 power
Device Status: 0x0000
(Bus Powered)
</pre>

== Steel Battalion Controller ==

[[File:SBC.jpg|thumb|200px|Steel Battalion Controller Layout]]

=== USB Descriptors ===

From http://www.yaronet.com/topics/154490-steel-battalion-controller-homemade#post-15

<pre>bcdUSB: 0x0110
bDeviceClass: 0x00
bDeviceSubClass: 0x00
bDeviceProtocol: 0x00
bMaxPacketSize0: 0x08 (8)
idVendor: 0x0A7B
idProduct: 0xD000
bcdDevice: 0x0100
iManufacturer: 0x00
iProduct: 0x00
iSerialNumber: 0x00
bNumConfigurations: 0x01

ConnectionStatus: DeviceConnected
Current Config Value: 0x00
Device Bus Speed: Full
Device Address: 0x03
Open Pipes: 0

Configuration Descriptor:
wTotalLength: 0x0020
bNumInterfaces: 0x01
bConfigurationValue: 0x01
iConfiguration: 0x00
bmAttributes: 0x80 (Bus Powered )
MaxPower: 0xFA (500 Ma)

Interface Descriptor:
bInterfaceNumber: 0x00
bAlternateSetting: 0x00
bNumEndpoints: 0x02
bInterfaceClass: 0x58
bInterfaceSubClass: 0x42
bInterfaceProtocol: 0x00
iInterface: 0x00

Endpoint Descriptor:
bEndpointAddress: 0x82
Transfer Type: Interrupt</pre>

=== Controller to Xbox ===

From http://steelbattalionnet.codeplex.com/SourceControl/latest#SBC/SteelBattalionController.cs

26 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|RightJoyMainWeapon
|2
|0x01
|
|-
|RightJoyFire
|2
|0x03{{FIXME|reason=WTF?! Might be bad?}}
|
|-
|RightJoyLockOn
|2
|0x04
|
|-
|Eject
|2
|0x08
|
|-
|CockpitHatch
|2
|0x10
|
|-
|Ignition
|2
|0x20
|
|-
|Start
|2
|0x40
|
|-
|MultiMonOpenClose
|2
|0x80
|
|-
|MultiMonMapZoomInOut
|3
|0x01
|
|-
|MultiMonModeSelect
|3
|0x02
|
|-
|MultiMonSubMonitor
|3
|0x04
|
|-
|MainMonZoomIn
|3
|0x08
|
|-
|MainMonZoomOut
|3
|0x10
|
|-
|FunctionFSS
|3
|0x20
|
|-
|FunctionManipulator
|3
|0x40
|
|-
|FunctionLineColorChange
|3
|0x80
|
|-
|Washing
|4
|0x01
|
|-
|Extinguisher
|4
|0x02
|
|-
|Chaff
|4
|0x04
|
|-
|FunctionTankDetach
|4
|0x08
|
|-
|FunctionOverride
|4
|0x10
|
|-
|FunctionNightScope
|4
|0x20
|
|-
|FunctionF1
|4
|0x40
|
|-
|FunctionF2
|4
|0x80
|
|-
|FunctionF3
|5
|0x01
|
|-
|WeaponConMain
|5
|0x02
|
|-
|WeaponConSub
|5
|0x04
|
|-
|WeaponConMagazine
|5
|0x08
|
|-
|Comm1
|5
|0x10
|
|-
|Comm2
|5
|0x20
|
|-
|Comm3
|5
|0x40
|
|-
|Comm4
|5
|0x80
|
|-
|Comm5
|6
|0x01
|
|-
|LeftJoySightChange
|6
|0x02
|
|-
|ToggleFilterControl
|6
|0x04
|
|-
|ToggleOxygenSupply
|6
|0x08
|
|-
|ToggleFuelFlowRate
|6
|0x10
|
|-
|ToggleBuffreMaterial
|6
|0x20
|
|-
|ToggleVTLocation
|6
|0x40
|
|-
|
|6
|0x80
|
|-
|
|7
|0xFF
|
|-
|
|8
|0xFF
|
|-
|AimingX
|9
|0xFF, maybe 0xFFFF at offset 8?
|"Aiming Lever" joystick on the right. X Axis value.
|-
|AimingY
|11
|0xFF, maybe 0xFFFF at offset 10?
|"Aiming Lever" joystick on the right. Y Axis value.
|-
|RotationLever
|13
|0xFF, maybe 0xFFFF at offset 12?
|"Rotation Lever" joystick on the left.
|-
|SightChangeX
|15
|0xFF, maybe 0xFFFF at offset 14?
|"Sight Change" analog stick on the "Rotation Lever" joystick. X Axis value.
|-
|SightChangeY
|17
|0xFF, maybe 0xFFFF at offset 16?
|"Sight Change" analog stick on the "Rotation Lever" joystick. Y Axis value.
|-
|LeftPedal
|19
|0xFF, maybe 0xFFFF at offset 18?
|
|-
|MiddlePedal
|21
|0xFF, maybe 0xFFFF at offset 20?
|
|-
|RightPedal
|23
|0xFF, maybe 0xFFFF at offset 22?
|
|-
|TunerDial
|24
|0x0F
|The 9 o'clock postion is 0, and the 6 o'clock position is 12. The blank area between the 6 and 9 o'clock positions is 13, 14, and 15 clockwise.
|-
|
|24
|0xF0
|
|-
|GearLever
|25
|0xFF
|The gear lever on the left block.
|}

=== Xbox to Controller ===

From http://steelbattalionnet.codeplex.com/SourceControl/latest#SBC/SteelBattalionController.cs

34 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|EmergencyEject
|2
|0x0F
|
|-
|CockpitHatch
|2
|0xF0
|
|-
|Ignition
|3
|0x0F
|
|-
|Start
|3
|0xF0
|
|-
|OpenClose
|4
|0x0F
|
|-
|MapZoomInOut
|4
|0xF0
|
|-
|ModeSelect
|5
|0x0F
|
|-
|SubMonitorModeSelect
|5
|0xF0
|
|-
|MainMonitorZoomIn
|6
|0x0F
|
|-
|MainMonitorZoomOut
|6
|0xF0
|
|-
|ForecastShootingSystem
|7
|0x0F
|
|-
|Manipulator
|7
|0xF0
|
|-
|LineColorChange
|8
|0x0F
|
|-
|Washing
|8
|0xF0
|
|-
|Extinguisher
|9
|0x0F
|
|-
|Chaff
|9
|0xF0
|
|-
|TankDetach
|10
|0x0F
|
|-
|Override
|10
|0xF0
|
|-
|NightScope
|11
|0x0F
|
|-
|F1
|11
|0xF0
|
|-
|F2
|12
|0x0F
|
|-
|F3
|12
|0xF0
|
|-
|MainWeaponControl
|13
|0x0F
|
|-
|SubWeaponControl
|13
|0xF0
|
|-
|MagazineChange
|14
|0x0F
|
|-
|Comm1
|14
|0xF0
|
|-
|Comm2
|15
|0x0F
|
|-
|Comm3
|15
|0xF0
|
|-
|Comm4
|16
|0x0F
|
|-
|Comm5
|16
|0xF0
|
|-
|
|17
|0x0F
|
|-
|GearR
|17
|0xF0
|
|-
|GearN
|18
|0x0F
|
|-
|Gear1
|18
|0xF0
|
|-
|Gear2
|19
|0x0F
|
|-
|Gear3
|19
|0xF0
|
|-
|Gear4
|20
|0x0F
|
|-
|Gear5
|20
|0xF0
|
|}

== Related links ==
[https://github.com/xqemu/xqemu/blob/xbox/hw/xbox/xid.c XID emulation in XQEMU]