xboxdevwiki - User contributions [en]

Xbox Input Devices

2026-02-25T22:12:35Z

JohnVeness: /* XID Overview */ Typos

== XID Overview ==

XIDs are USB devices.

The hardware side is USB with a different plug while the software side is USB without HID descriptors.
Technically a XID is a USB hub for the Memory Units and the Xbox Live Communicator.
The logical XID gamepad USB device is internally connected to that hub.

=== USB Adapters ===
The Xbox's input devices are USB devices. As such, you can connect a keyboard to the Xbox, or a gamepad to your PC. In fact, Linux already has drivers for the gamepad. In order to preserve Xbox hardware, please do not cut OEM Xbox cables to make an adapter; decent adapters can be acquired cheaply (~$10 USD ea. on 2017.04.30).

[[File:Xboxmaletousbfemale.png|thumb|right|Wiring diagram to show how male Xbox controller plug maps to standard female USB connector. White cable color is depicted as gray for better visibility. The yellow cable is not connected to the USB side, as it's exclusive to Xbox.]]

{| class="wikitable"
|-
! Port (From)
! Plug (To)
! Link
|-
| Xbox
| USB-A
| [https://www.amazon.com/gp/product/B000RT2868 Amazon] [https://www.aliexpress.com/item/32948906701.html Aliexpress]
|-
| USB-A
| Xbox
| [https://www.amazon.com/gp/product/B00F52LQHO Amazon] [https://www.aliexpress.com/item/4000452932782.html Aliexpress]
|}

=== Wiring ===

Untested / unverified! Take this with a grain of salt.

{| class="wikitable"
!Pin
!Typical cable color
!Description
|-
|1
|Red
|VCC
|-
|2
|White
|USB D+
|-
|3
|Green
|USB D-
|-
|4
|Yellow
|VBlank signal from video output (for light guns)
|-
|5
|Black
|GND
|-
|}

=== Protocol ===

XID are similar to HID but have custom Vendor requests.

==== Control Transfers ====

===== GET_DESCRIPTOR =====

* bmRequestType: 0xC1
* bRequest: 6
* wValue: 0x4200
* wIndex: Interface number
* wLength: <length of respective report; typically 16>

Actual length is truncated to size of descriptor or wLength. Whichever is smaller.

<pre>
typedef struct XIDDescriptor {
uint8_t bLength;
uint8_t bDescriptorType;
uint16_t bcdXid;
uint8_t bType;
uint8_t bSubType;
uint8_t bMaxInputReportSize;
uint8_t bMaxOutputReportSize;
uint16_t wAlternateProductIds[4];
};
</pre>

bDescriptorType is probably always 0x42.

====== bType = 1: Xbox game controller ======

* bSubType:
** 0x01 = Gamepad (Duke)
** 0x02 = Gamepad (Controller-S)
** 0x10 = Steering wheel
** 0x20 = Arcade Stick
** 0x50 = Light gun

====== bType = 3: Xbox DVD Movie Playback IR Dongle======

* bSubType:
** 0x00

====== bType = 128: Steel Battalion ======

* bSubType:
** 0x01

====== Example XID reports ======

This is an example XID descriptor taken from a Controller-S (VID 0x045E / PID 0x0289).
<pre>
bLength 0x10 (16 bytes)
bDescriptorType 0x42
bcdXid 0x0100 (USB 1.0)
bType 0x01
bSubType 0x02
bMaxInputReportSize 0x14 (20 bytes)
bMaxOutputReportSize 0x06 (6 bytes)
wAlternateProductIds 4 x 0xFFFF
</pre>

This is an example XID descriptor taken from a Steel Battalion controller.
<pre>
bLength 0x10 (16 bytes)
bDescriptorType 0x42
bcdXid 0x0100 (USB 1.0)
bType 0x80
bSubType 0x01
bMaxInputReportSize 0x1A (26 bytes)
bMaxOutputReportSize 0x16 (22 bytes)
wAlternateProductIds 4 x 0xFFFF
</pre>

This is an example XID descriptor taken from an official Microsoft DVD Movie Playback IR dongle.
<pre>
bLength 0x08 (8 bytes)
bDescriptorType 0x42
bcdXid 0x0100 (USB 1.0)
bType 0x03
bSubType 0x00
bMaxInputReportSize 0x06 (6 bytes)
bMaxOutputReportSize 0x00 (0 bytes)
</pre>

===== GET_CAPABILITIES =====

* bmRequestType: 0xC1
* bRequest: 1
* wValue:
** 0x0100 for input
** 0x0200 for output
* wIndex: Interface number
* wLength: <length of respective report>

* STALL if wValue not supported.

Actual length is truncated to size of report or wLength. Whichever is smaller.

<pre>typedef struct XIDGamepadCapabilities {
uint8_t bReportId;
uint8_t bLength;
<Data>
}</pre>

The data will be similar to the GET_REPORT, but instead of storing actual values, it will have bits set (1) where the bit is valid in the respective report.
If the bit is auto-generated, it will be cleared (0).

===== SET_REPORT =====

* bmRequestType: 0x21
* bRequest: 9
* wValue: 0x0200
* wIndex: Interface number
* wLength: <length of report; typically 6>

* STALL if wValue not supported.

====== Typical report ======

<pre>typedef struct XIDGamepadReport {
uint8_t bReportId;
uint8_t bLength;
<Data>
}</pre>

===== GET_REPORT =====

* bmRequestType: 0xA1
* bRequest: 1
* wValue: 0x0100
* wIndex: Interface number
* wLength: <length of report; typically 20>

* STALL if wValue not supported or if wLength is greater than report size.
* ACK if supported.

====== Typical report ======

<pre>typedef struct XIDGamepadOutputReport {
uint8_t report_id; //FIXME: is this correct?
uint8_t length;
<Data>
}</pre>

==== Interrupt transfers ====

Alternatively interrupt-in and interrupt-out transfers can be used for GET_REPORT and SET_REPORT respectively.

In case of the interrupt-in, there is another status which can occur now:

* NAK if supported but no changes since last ACK.

== Standard Gamepads ==

=== Microsoft Hardware Variants ===

There are a few hardware re-designs of the Microsoft Gamepad.

{| class="wikitable"
!Controller Name
!Part Number
!Board Model
!Notes
!Datasheets
|-
|Xbox Game Controller (AKA "Duke")
|X08-17160
|23-0819B
|Earliest known model{{FIXME|Reason=Small sample size (5), can't confirm}}. 3 IC's: Dedicated ST 92163/JFL Micro Controller, dedicated AT43USB401 USB Controller, 4 Channel Analog Mux LW052A.
|[https://archive.org/details/ST92163 ST 92163/JFL], AT43USB401{{FIXME|Reason=Can't find datasheet}}, [https://web.archive.org/web/20191230174412/https://www.rockbox.org/wiki/pub/Main/DataSheets/TexasInstrumentsLW052ADataSheet.pdf LW052A]
|-
|Xbox Game Controller (AKA "Duke")
|X08-17160
|K023B121
|Same as 23-0819B, but manufactured in China. Only Board Model that does not follow naming conventions. Hardware identical. Easily identified by a serial number that starts with "KD".
|[https://archive.org/details/ST92163 ST 92163/JFL], AT43USB401{{FIXME|Reason=Can't find datasheet}}, [https://web.archive.org/web/20191230174412/https://www.rockbox.org/wiki/pub/Main/DataSheets/TexasInstrumentsLW052ADataSheet.pdf LW052A]
|-
|Xbox Game Controller (AKA "Duke")
|X08-17160
|23-0819C
|Last known Duke model.{{FIXME|Reason=Small sample size (5), can't confirm}}. Identical to 23-0819B in hardware, new silkscreen markings show this model is [https://en.wikipedia.org/wiki/UL_94 UL-94 V-0 compliant]. All boards after this are V-0 compliant.
|[https://archive.org/details/ST92163 ST 92163/JFL], AT43USB401{{FIXME|Reason=Can't find datasheet}}, [https://web.archive.org/web/20191230174412/https://www.rockbox.org/wiki/pub/Main/DataSheets/TexasInstrumentsLW052ADataSheet.pdf LW052A]
|-
|Xbox Game Controller (Looks like an S, with green Xbox jewel)
|X08-19383
|23-0923A
|Japan and Australia exclusive model{{FIXME|Reason=Speculation, no hard source for this}}.Minification of "Duke" PCB Design. Has exact same IC's as the Duke, only in an S controller design.
|[https://archive.org/details/ST92163 ST 92163/JFL], AT43USB401{{FIXME|Reason=Can't find datasheet}}, [https://web.archive.org/web/20191230174412/https://www.rockbox.org/wiki/pub/Main/DataSheets/TexasInstrumentsLW052ADataSheet.pdf LW052A]
|-
|Xbox Controller S
|X08-69873
|23-0923B
|Minification of "Duke" PCB Design. Has exact same IC's as the Duke, only in an S controller design
|[https://archive.org/details/ST92163 ST 92163/JFL], AT43USB401{{FIXME|Reason=Can't find datasheet}}, [https://web.archive.org/web/20191230174412/https://www.rockbox.org/wiki/pub/Main/DataSheets/TexasInstrumentsLW052ADataSheet.pdf LW052A]
|-
|Xbox Controller S
|X08-69873
|23-0923H
|Entirely new PCB design. Single IC on the board, AT43USB355M-AC
|[https://archive.org/details/AT43USB355 AT43USB355M-AC]
|-
|Xbox Controller S
|X08-69873
|23-0923I
|PCB Design almost exactly the same as H revision. Only difference is the IC is smaller: AT43USB353M-AC
|[https://archive.org/details/AT43USB353M-AC AT43USB353M-AC]
|}

There are also dedicated Part Numbers for color variants:
{| class="wikitable"
!Controller Part Number
!Controller Description
!Board Model
|-
|X02332-001
|Crystal S Controller
|23-0923I
|-
|X09-64240-01
|Transparent Green Controller
|23-0923I
|-
|X800679-100
|Black S With Halo Jewel
|23-0923I
|}

=== USB Descriptors ===

See https://github.com/xboxdrv/xboxdrv/blob/stable/src/xpad_device.cpp for a list of devices.

==== 23-0819B ====

<pre>
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x045e Microsoft Corp.
idProduct 0x0202 Xbox Controller
bcdDevice 1.00
iManufacturer 0
iProduct 0
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 88 Xbox
bInterfaceSubClass 66 Controller
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
</pre>

==== K023B121 ====

Identical to 23-0819B {{FIXME|Reason=Confirm with xid-dumper tool}}

==== 23-0819C ====

Identical to 23-0819B {{FIXME|Reason=Confirm with xid-dumper tool}}

==== 23-0923A ====

Changes from 23-0819B

<pre>
Device Descriptor:
idProduct: 0x0285
</pre>

==== 23-0923B ====

{{FIXME|Reason=No Descriptor Dump}}

==== 23-0923H ====

Changes from 23-0819B

<pre>
Device Descriptor
bMaxPacketSize0: 8
idProduct: 0x0289
bcdDevice: 1.20
Configuration Descriptor
Interface Descriptor
Endpoint Descriptor
bEndpointAddress: 0x81
</pre>

==== 23-0923I ====

Changes from 23-0923H

<pre>
Device Descriptor
bcdDevice: 1.21
</pre>

=== Controller to Xbox ===

20 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|{{input-dy+}}
|2
|0x01
|
|-
|{{input-dy-}}
|2
|0x02
|
|-
|{{input-dx-}}
|2
|0x04
|
|-
|{{input-dx+}}
|2
|0x08
|
|-
|{{input-start}}
|2
|0x10
|
|-
|{{input-back}}
|2
|0x20
|
|-
|{{input-ls}}
|2
|0x40
|
|-
|{{input-rs}}
|2
|0x80
|
|-
|{{input-a}}
|4
|0xFF
|Button is analog
|-
|{{input-b}}
|5
|0xFF
|Button is analog
|-
|{{input-x}}
|6
|0xFF
|Button is analog
|-
|{{input-y}}
|7
|0xFF
|Button is analog
|-
|{{input-black}}
|8
|0xFF
|Button is analog
|-
|{{input-white}}
|9
|0xFF
|Button is analog
|-
|{{input-lt}}
|10
|0xFF
|Trigger is analog
|-
|{{input-rt}}
|11
|0xFF
|Trigger is analog
|-
|{{input-lx}}
|12
|0xFFFF
|Negative = Left; Positive = Right
|-
|{{input-ly}}
|14
|0xFFFF
|Negative = Down; Positive = Up
|-
|{{input-rx}}
|16
|0xFFFF
|Negative = Left; Positive = Right
|-
|{{input-ry}}
|18
|0xFFFF
|Negative = Down; Positive = Up
|}

=== Xbox to Controller ===

6 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|Left actuator strength
|2
|0xFFFF
|
|-
|Right actuator strength
|4
|0xFFFF
|
|}

The Microsoft Controller S will not react to packets which don't have a value of 6 in the <code>length</code> field of the header.
The Fanatec Speedster 3 ForceShock will still react to those. Further testing is necessary with other gamepads.

== Steering wheels ==

=== MadCatz Wheel ===

{{FIXME}}

=== Fanatec Speedster 3 ForceShock ===

==== Pedals ====

The Pedals are ''not'' a USB device.

Note that the cable going to the pedals is also ''not'' a USB port despite using the Xbox controller breakaway plug.
Likewise, plugging the pedals to a PC / Xbox won't provide a USB / XID (it is detected as garbage):

<pre>
new full-speed USB device number 14 using xhci_hcd
device descriptor read/64, error -71
device descriptor read/64, error -71
new full-speed USB device number 15 using xhci_hcd
device descriptor read/64, error -71
device descriptor read/64, error -71
new full-speed USB device number 16 using xhci_hcd
Device not responding to setup address.
Device not responding to setup address.
device not accepting address 16, error -71
new full-speed USB device number 17 using xhci_hcd
Device not responding to setup address.
Device not responding to setup address.
device not accepting address 17, error -71
unable to enumerate USB device
</pre>

==== Internal HUB ====

===== USB Descriptors =====

Power not connected, pedals not connected, not in Tuning mode:

<pre>
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 9 Hub
bDeviceSubClass 0
bDeviceProtocol 0 Full speed (or root) hub
bMaxPacketSize0 8
idVendor 0x3767
idProduct 0x0102
bcdDevice 0.01
iManufacturer 0
iProduct 1 End
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 25
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xa0
(Bus Powered)
Remote Wakeup
MaxPower 64mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 9 Hub
bInterfaceSubClass 0
bInterfaceProtocol 0 Full speed (or root) hub
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0001 1x 1 bytes
bInterval 255
Hub Descriptor:
bLength 9
bDescriptorType 41
nNbrPorts 3
wHubCharacteristic 0x000d
Per-port power switching
Compound device
Per-port overcurrent protection
bPwrOn2PwrGood 50 * 2 milli seconds
bHubContrCurrent 64 milli Ampere
DeviceRemovable 0x02
PortPwrCtrlMask 0xff
Hub Port Status:
Port 1: 0000.0103 power enable connect
Port 2: 0000.0100 power
Port 3: 0000.0100 power
can't get debug descriptor: Resource temporarily unavailable
Device Status: 0x0003
Self Powered
Remote Wakeup Enabled
</pre>

==== Steering wheel (and Pedals) ====

Always connected to port 1 of the internal HUB

===== USB Descriptors =====

<pre>
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 8
idVendor 0x3767
idProduct 0x0101
bcdDevice 2.80
iManufacturer 0
iProduct 0
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 88 Xbox
bInterfaceSubClass 66 Controller
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
can't get debug descriptor: Resource temporarily unavailable
Device Status: 0x0000
(Bus Powered)
</pre>

== Arcade Sticks ==

=== Xbox TECMO Dead or Alive 3 ARCADE Stick Joystick Controller Japan ===

{{FIXME}}

=== Street Fighter 15th Anniversary Edition Arcade Stick ===

{{FIXME}}

=== Gamester Xbox Arcade Stick ===

{{FIXME}}

=== Nuby Xbox Fighter Arcade Stick ===

{{FIXME}}

=== Nuby Xbox Arcade Super Stick ===

{{FIXME}}

The source image of the box and on device has item<nowiki>#:</nowiki>36020.

=== Naki Ultimate Fighting Stick ===

{{FIXME}}

[https://www.youtube.com/watch?v=4GphUsTzgds YouTube reviewer] report this joystick to have rumble support.

== Light guns ==

Light guns use similar input and output reports to standard gamepads. Their bSubType is set to 0x50. They report where they are aimed in place of the left stick coordinates, and an extra bit at offset 3 in their input reports flags whether the light gun is currently pointed at the screen or not. Light guns may not function properly if they are not supplied with a video sync signal (they may not populate their input reports correctly, or even fail to enumerate as USB devices entirely).

=== Controller to Xbox ===

20 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|{{input-dy+}}
|2
|0x01
|
|-
|{{input-dy-}}
|2
|0x02
|
|-
|{{input-dx-}}
|2
|0x04
|
|-
|{{input-dx+}}
|2
|0x08
|
|-
|{{input-start}}
|2
|0x10
|
|-
|{{input-back}}
|2
|0x20
|
|-
|Light visible
|3
|0x20
|Set to 1 if the gun is pointed to a bright screen, 0 if no light visible.
|-
|Unknown 1
|3
|0x40
|rowspan="2" | Light guns from different manufacturers include these two bits in their GET_CAPABILITIES reports, but they always seem to read back as 0 in GET_REPORT.
|-
|Unknown 2
|3
|0x80
|-
|{{input-a}} Trigger
|4
|0xFF
|rowspan="6" | Digital only, either 0 or 255
|-
|{{input-b}}
|5
|0xFF
|-
|{{input-x}}
|6
|0xFF
|-
|{{input-y}}
|7
|0xFF
|-
|{{input-black}}
|8
|0xFF
|-
|{{input-white}}
|9
|0xFF
|-
|{{input-lx}}
|12
|0xFFFF
|rowspan="2" | Absolute position using the full stick range.
(0, 0) is the center of the screen and is also reported if the light gun is pointed off-screen.
|-
|{{input-ly}}
|14
|0xFFFF
|}

=== Xbox to Controller ===

==== Force feedback: wValue: 0x0200, wLength: 6 ====

6 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|Actuator strength
|2
|0xFFFF
|
|-
|(Unused)
|4
|0x0000
|
|}

The 4Gamers-branded gun (which appears to be sold by a number of different manufacturers) only reports it has the left actuator, however it only responds to force feedback output reports for the ''right'' actuator. Games appear to always enable both actuators, whether the controller reports it has both or not.

==== Calibration: wValue: 0x0201, wLength: 10 ====

10 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|Center calibration X
|2
|0xFFFF
|rowspan="2"|Gun's reported value subtracted from (0,0)
|-
|Center calibration Y
|4
|0xFFFF
|-
|Top left calibration X
|6
|0xFFFF
|rowspan="2"|Gun's reported value subtracted from (-25000,25000)
|-
|Top left calibration Y
|8
|0xFFFF
|}

Light guns are expected to handle their own calibration, i.e. the game will tell the gun the offsets between its reported position and the expected position and then expect the gun to offset and scale its output to compensate. The calibration process runs as follows:

# The game will first send a calibration report with all four offsets reset to (0, 0), (0, 0) to reset any offsets and scaling.
# The game will now display a target in the centre of the screen and ask you to shoot it. This will tell it how "wrong" the gun is when aimed at where it thinks (0, 0) should be on the screen. If the gun normally shoots slightly too high and further to the right, it might report (1000, 3000) for example.
# The game sends a calibration report to the gun to negate the offset, e.g. (-1000, -3000), (0, 0) using our example of (1000, 3000) from before.
# The game will now display a target in at (-25000, 25000) on the screen and ask you to shoot it. This will tell it how "wrong" the gun is when aimed at the top left of the screen.
# The coordinates received from the gun will be subtracted from the expected (-25000, 25000) and sent back to the gun in the second part of the calibration report along with the values previously determined for the centre position. If the first calibration was enough to adjust the screen offset we might have seen the "perfect" coordinates of (-25000, 25000) in which case the report would be (-1000, -3000), (0, 0) again. However, if our gun read the coordinates slightly closer the the middle of the screen at (-20000, 22000) then the report would be (-1000, -3000), (5000, -3000).

If the light gun does not handle the calibration output report then you will not be able to get past the calibration screen in ''The House of the Dead III''.

=== EMS TopGun II ===

''This is an unlicensed / unofficial Xbox accessory.''

The website for this product can be found at http://www.hkems.com/product/xbox/EMSTopGun2.htm

The gun presents itself as a standard Xbox gamepad. It uses a different USB descriptor for Xbox (X) and the other mode (P).
There is no internal hub in this device.

{| class="wikitable"
! EMS TopGun II !! Xbox Gamepad !! Notes
|-
| Stick || {{input-d}} ||
|-
| Trigger || {{input-a}} || rowspan="4" | Digital only, either 0 or 255
|-
| Grip || {{input-b}}
|-
| A || {{input-x}}
|-
| B || {{input-y}}
|-
| START || {{input-start}} ||
|-
| SE/BA || {{input-back}} ||
|-
| Aim Left / Right || {{input-lx}} || rowspan="2" | Absolute position using the full stick range
|-
| Aim Up / Down || {{input-ly}}
|}

There is no right thumbstick, thumbstick presses, black/white button or trigger buttons (All of those read constant zeros).

===== Turbo Mode =====

* Turbo mode 0 keeps {{input-a}} pressed while trigger is held
* Turbo mode 1 toggles {{input-a}} rapidly while trigger is held
* Turbo mode 2 toggles {{input-a}} rapidly and once in a while {{input-b}} while trigger is held

===== Force Feedback =====

The upper part of the gun is moveable and should push back to simulate recoil (possibly hurting your thumb while you are using the stick).
I could not get the force feedback working, but I'm sure I've had it working in the past on PC.{{citation needed}}

==== USB Descriptors ====

This is the descriptor in the Xbox mode (X).

<pre>
Bus 003 Device 016: ID 0b9a:016b
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x0b9a
idProduct 0x016b
bcdDevice 4.57
iManufacturer 1 EMS̖E
iProduct 2 EMS TopGun
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 88 Xbox
bInterfaceSubClass 66 Controller
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0040 1x 64 bytes
bInterval 8
can't get debug descriptor: Resource temporarily unavailable
Device Status: 0x0000
(Bus Powered)
</pre>

=== Joytech Sharp Shooter ===

''This is an unlicensed / unofficial Xbox accessory.''

The third party light gun from Joytech reports itself as 2 devices and mentions pattent [http://www.google.com/patents/US6287198 US6287198]
it came with a detachable viewfinder scope without any magnification. a red dot apears in the viewfinder, its a reflection of a red led, powered by the gun over usb.

model numer: JS-901D

{| class="wikitable"
! Joytech Sharp Shooter !! Xbox Gamepad !! Notes
|-
| Stick || {{input-d}} ||
|-
| Trigger || {{input-a}} || rowspan="6" | Digital only, either 0 or 255 {{citation needed}}
|-
| B (Left side) || rowspan="3" | {{input-b}}
|-
| B (Right side)
|-
| B (Magazine button)
|-
| x || {{input-x}}
|-
| y || {{input-y}}
|-
| START || {{input-start}} ||
|-
| BACK || {{input-back}} ||
|-
| Aim Left / Right || {{input-lx}} || {{citation needed}}
|-
| Aim Up / Down || {{input-ly}} || {{citation needed}}
|}

There is no right thumbstick, thumbstick presses, black/white button or trigger buttons {{citation needed}}

===== Fire/Reload Mode =====

* Normal mode does nothing, normal operation
* Auto reload mode toggles {{input-b}} rapidly to rappidly reload {{citation needed}}
* Auto fire+reload mode toggles {{input-a}} + {{input-b}} rapidly {{citation needed}}

==== USB Descriptors ====

<pre>

Bus 003 Device 025: ID 1292:3006 Innomedia
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 8
idVendor 0x1292 Innomedia
idProduct 0x3006
bcdDevice 1.50
iManufacturer 0
iProduct 0
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 1 (error)
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 88 Xbox
bInterfaceSubClass 66 Controller
bInterfaceProtocol 0
iInterface 2 (error)
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x02 EP 2 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4

Bus 003 Device 024: ID 1292:3006 Innomedia
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 9 Hub
bDeviceSubClass 0
bDeviceProtocol 0 Full speed (or root) hub
bMaxPacketSize0 8
idVendor 0x1292 Innomedia
idProduct 0x3006
bcdDevice 1.50
iManufacturer 1 (c) 2004 R0R3 Inc.
iProduct 2 US Patent 6,287,198
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 25
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 4 (c) R0R3 Devices Inc. US Patent 6,287,19Ē
bmAttributes 0xa0
(Bus Powered)
Remote Wakeup
MaxPower 64mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 9 Hub
bInterfaceSubClass 0
bInterfaceProtocol 0 Full speed (or root) hub
iInterface 5 (error)
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0001 1x 1 bytes
bInterval 255
Hub Descriptor:
bLength 9
bDescriptorType 41
nNbrPorts 3
wHubCharacteristic 0x000d
Per-port power switching
Compound device
Per-port overcurrent protection
bPwrOn2PwrGood 32 * 2 milli seconds
bHubContrCurrent 64 milli Ampere
DeviceRemovable 0x02
PortPwrCtrlMask 0x0e
Hub Port Status:
Port 1: 0000.0103 power enable connect
Port 2: 0000.0100 power
Port 3: 0100.0100 power
Device Status: 0x0000
(Bus Powered)
</pre>

== Microphones ==

=== Xbox Communicator ===

==== USB Descriptor ====

<pre>
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 8
idVendor 0x045e Microsoft Corp.
idProduct 0x0283 Xbox Communicator
bcdDevice 1.58
iManufacturer 0
iProduct 0
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x002d
bNumInterfaces 2
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 120
bInterfaceSubClass 0
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 9
bDescriptorType 5
bEndpointAddress 0x04 EP 4 OUT
bmAttributes 5
Transfer Type Isochronous
Synch Type Asynchronous
Usage Type Data
wMaxPacketSize 0x0030 1x 48 bytes
bInterval 1
bRefresh 0
bSynchAddress 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 120
bInterfaceSubClass 0
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 9
bDescriptorType 5
bEndpointAddress 0x85 EP 5 IN
bmAttributes 5
Transfer Type Isochronous
Synch Type Asynchronous
Usage Type Data
wMaxPacketSize 0x0030 1x 48 bytes
bInterval 1
bRefresh 0
bSynchAddress 0
</pre>

=== Xbox Karaoke ===

==== USB Descriptor ====

<pre>
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 8
idVendor 0x045e Microsoft Corp.
idProduct 0x0501
bcdDevice 1.00
iManufacturer 1 Licensed 3PP Vendor
iProduct 2 Karaoke Microphone Module
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x001b
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 100mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 121
bInterfaceSubClass 1
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 9
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 5
Transfer Type Isochronous
Synch Type Asynchronous
Usage Type Data
wMaxPacketSize 0x0060 1x 96 bytes
bInterval 1
bRefresh 0
bSynchAddress 0
</pre>

== Steel Battalion Controller ==

[[File:SBC.jpg|thumb|200px|Steel Battalion Controller Layout]]

=== USB Descriptors ===

<pre>
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 8
idVendor 0x0a7b
idProduct 0xd000
bcdDevice 1.00
iManufacturer 0
iProduct 0
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 32
bNumInterfaces 1
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x80
(Bus Powered)
MaxPower 500mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 88 Xbox
bInterfaceSubClass 66 Controller
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x82 EP 2 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x01 EP 1 OUT
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0020 1x 32 bytes
bInterval 4
</pre>

=== Controller to Xbox ===

From http://steelbattalionnet.codeplex.com/SourceControl/latest#SBC/SteelBattalionController.cs

26 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|RightJoyMainWeapon
|2
|0x01
|
|-
|RightJoyFire
|2
|0x02
|
|-
|RightJoyLockOn
|2
|0x04
|
|-
|Eject
|2
|0x08
|
|-
|CockpitHatch
|2
|0x10
|
|-
|Ignition
|2
|0x20
|
|-
|Start
|2
|0x40
|
|-
|MultiMonOpenClose
|2
|0x80
|
|-
|MultiMonMapZoomInOut
|3
|0x01
|
|-
|MultiMonModeSelect
|3
|0x02
|
|-
|MultiMonSubMonitor
|3
|0x04
|
|-
|MainMonZoomIn
|3
|0x08
|
|-
|MainMonZoomOut
|3
|0x10
|
|-
|FunctionFSS
|3
|0x20
|
|-
|FunctionManipulator
|3
|0x40
|
|-
|FunctionLineColorChange
|3
|0x80
|
|-
|Washing
|4
|0x01
|
|-
|Extinguisher
|4
|0x02
|
|-
|Chaff
|4
|0x04
|
|-
|FunctionTankDetach
|4
|0x08
|
|-
|FunctionOverride
|4
|0x10
|
|-
|FunctionNightScope
|4
|0x20
|
|-
|FunctionF1
|4
|0x40
|
|-
|FunctionF2
|4
|0x80
|
|-
|FunctionF3
|5
|0x01
|
|-
|WeaponConMain
|5
|0x02
|
|-
|WeaponConSub
|5
|0x04
|
|-
|WeaponConMagazine
|5
|0x08
|
|-
|Comm1
|5
|0x10
|
|-
|Comm2
|5
|0x20
|
|-
|Comm3
|5
|0x40
|
|-
|Comm4
|5
|0x80
|
|-
|Comm5
|6
|0x01
|
|-
|LeftJoySightChange
|6
|0x02
|
|-
|ToggleFilterControl
|6
|0x04
|
|-
|ToggleOxygenSupply
|6
|0x08
|
|-
|ToggleFuelFlowRate
|6
|0x10
|
|-
|ToggleBuffreMaterial
|6
|0x20
|
|-
|ToggleVTLocation
|6
|0x40
|
|-
|
|6
|0x80
|
|-
|
|7
|0xFF
|
|-
|
|8
|0xFF
|
|-
|AimingX
|9
|0xFFFF
|"Aiming Lever" joystick on the right. Unsigned X Axis value: 0 (Left) to 0xFFFF (Right).
|-
|AimingY
|11
|0xFFFF
|"Aiming Lever" joystick on the right. Unsigned Y Axis value: 0 (Top) to 0xFFFF (Bottom).
|-
|RotationLever
|13
|0xFFFF
|"Rotation Lever" joystick on the left. Signed X Axis value: -0x7FFF (Left) to 0x7FFF (Right)
|-
|SightChangeX
|15
|0xFFFF
|"Sight Change" analog stick on the "Rotation Lever" joystick. Signed X Axis value: -0x7FFF (Left) to 0x7FFF (Right)
|-
|SightChangeY
|17
|0xFFFF
|"Sight Change" analog stick on the "Rotation Lever" joystick. Signed Y Axis value: -0x7FFF (Top) to 0x7FFF (Bottom)
|-
|LeftPedal
|19
|0xFFFF
|
|-
|MiddlePedal
|21
|0xFFFF
|
|-
|RightPedal
|23
|0xFFFF
|
|-
|TunerDial
|24
|0x0F
|The 9 o'clock postion is 0, and the 6 o'clock position is 12. The blank area between the 6 and 9 o'clock positions is 13, 14, and 15 clockwise.
|-
|
|24
|0xF0
|
|-
|GearLever
|25
|0xFF
|The gear lever on the left block. R = -2, N = -1, 1st = 1, 2nd = 2, 3rd = 3, 4th = 4, 5th = 5. If the shifter is between two gears this value will be 0.
|}

=== Xbox to Controller ===

From http://steelbattalionnet.codeplex.com/SourceControl/latest#SBC/SteelBattalionController.cs

22 bytes

{| class="wikitable"
!Field
!Offset (Bytes)
!Mask
!Notes
|-
|Start
|0
|0x00
|This will always be 0x00
|-
|bLen
|1
|0x16
|This will always be 0x16 (22 bytes)
|-
|EmergencyEject
|2
|0x0F
|
|-
|CockpitHatch
|2
|0xF0
|
|-
|Ignition
|3
|0x0F
|
|-
|Start
|3
|0xF0
|
|-
|OpenClose
|4
|0x0F
|
|-
|MapZoomInOut
|4
|0xF0
|
|-
|ModeSelect
|5
|0x0F
|
|-
|SubMonitorModeSelect
|5
|0xF0
|
|-
|MainMonitorZoomIn
|6
|0x0F
|
|-
|MainMonitorZoomOut
|6
|0xF0
|
|-
|ForecastShootingSystem
|7
|0x0F
|
|-
|Manipulator
|7
|0xF0
|
|-
|LineColorChange
|8
|0x0F
|
|-
|Washing
|8
|0xF0
|
|-
|Extinguisher
|9
|0x0F
|
|-
|Chaff
|9
|0xF0
|
|-
|TankDetach
|10
|0x0F
|
|-
|Override
|10
|0xF0
|
|-
|NightScope
|11
|0x0F
|
|-
|F1
|11
|0xF0
|
|-
|F2
|12
|0x0F
|
|-
|F3
|12
|0xF0
|
|-
|MainWeaponControl
|13
|0x0F
|
|-
|SubWeaponControl
|13
|0xF0
|
|-
|MagazineChange
|14
|0x0F
|
|-
|Comm1
|14
|0xF0
|
|-
|Comm2
|15
|0x0F
|
|-
|Comm3
|15
|0xF0
|
|-
|Comm4
|16
|0x0F
|
|-
|Comm5
|16
|0xF0
|
|-
|
|17
|0x0F
|
|-
|GearR
|17
|0xF0
|
|-
|GearN
|18
|0x0F
|
|-
|Gear1
|18
|0xF0
|
|-
|Gear2
|19
|0x0F
|
|-
|Gear3
|19
|0xF0
|
|-
|Gear4
|20
|0x0F
|
|-
|Gear5
|20
|0xF0
|
|-
|Unused?
|21
|
|-
|}

== SEGA Chihiro Baseboard ==

Contains 2 USB devices which directly attach to USB ports 3 & 4 (player 0, 1)

=== USB Descriptors ===

<pre>
[Device Descriptor]
----------------------------------------------
Length = 18
DescriptorType = 0x01
USB version = 1.00
Vendor:Product = 0ca3:0003
MaxPacketSize0 = 64
NumConfigurations = 1
Device version = 1.03
Device Class:SubClass:Protocol = 60:01:00

[Configuration Descriptor]
----------------------------------------------
Length = 9
DescriptorType = 02
wTotalLength = 60
bNumInterfaces = 1
bConfigurationValue = 1
iConfiguration = 0
bmAttributes = 0x80
MaxPower = 150

[Interface Descriptor]
----------------------------------------------
Length = 9
DescriptorType = 04
bInterfaceNumber = 0
bAlternateSetting = 0
bNumEndpoints = 6
bInterfaceClass = 0xff
bInterfaceSubClass = 0x00
bInterfaceProtocol = 0x00
iInterface = 0

[Endpoint Descriptor]
----------------------------------------------
Length = 7
DescriptorType = 05
bEndpointAddress = 0x01
bmAttributes = 0x02
wMaxPacketSize = 64
bInterval = 0
bRefresh = 7
bSynchAddress = 5

[Endpoint Descriptor]
----------------------------------------------
Length = 7
DescriptorType = 05
bEndpointAddress = 0x02
bmAttributes = 0x02
wMaxPacketSize = 64
bInterval = 0
bRefresh = 7
bSynchAddress = 5

[Endpoint Descriptor]
----------------------------------------------
Length = 7
DescriptorType = 05
bEndpointAddress = 0x03
bmAttributes = 0x02
wMaxPacketSize = 64
bInterval = 0
bRefresh = 7
bSynchAddress = 5

[Endpoint Descriptor]
----------------------------------------------
Length = 7
DescriptorType = 05
bEndpointAddress = 0x81
bmAttributes = 0x02
wMaxPacketSize = 64
bInterval = 0
bRefresh = 7
bSynchAddress = 5

[Endpoint Descriptor]
----------------------------------------------
Length = 7
DescriptorType = 05
bEndpointAddress = 0x82
bmAttributes = 0x02
wMaxPacketSize = 64
bInterval = 0
bRefresh = 7
bSynchAddress = 5

[Endpoint Descriptor]
----------------------------------------------
Length = 7
DescriptorType = 05
bEndpointAddress = 0x83
bmAttributes = 0x02
wMaxPacketSize = 64
bInterval = 0
bRefresh = 0
bSynchAddress = 0
</pre>
<pre>
[Device Descriptor]
----------------------------------------------
Length = 18
DescriptorType = 0x01
USB version = 1.00
Vendor:Product = 0ca3:0002
MaxPacketSize0 = 64
NumConfigurations = 1
Device version = 1.03
Device Class:SubClass:Protocol = 60:00:00

[Configuration Descriptor]
----------------------------------------------
Length = 9
DescriptorType = 02
wTotalLength = 88
bNumInterfaces = 1
bConfigurationValue = 1
iConfiguration = 0
bmAttributes = 0x80
MaxPower = 150

[Interface Descriptor]
----------------------------------------------
Length = 9
DescriptorType = 04
bInterfaceNumber = 0
bAlternateSetting = 0
bNumEndpoints = 10
bInterfaceClass = 0xff
bInterfaceSubClass = 0x00
bInterfaceProtocol = 0x00
iInterface = 0

[Endpoint Descriptor]
----------------------------------------------
Length = 7
DescriptorType = 05
bEndpointAddress = 0x01
bmAttributes = 0x02
wMaxPacketSize = 64
bInterval = 0
bRefresh = 7
bSynchAddress = 5

[Endpoint Descriptor]
----------------------------------------------
Length = 7
DescriptorType = 05
bEndpointAddress = 0x02
bmAttributes = 0x02
wMaxPacketSize = 64
bInterval = 0
bRefresh = 7
bSynchAddress = 5

[Endpoint Descriptor]
----------------------------------------------
Length = 7
DescriptorType = 05
bEndpointAddress = 0x03
bmAttributes = 0x02
wMaxPacketSize = 64
bInterval = 0
bRefresh = 7
bSynchAddress = 5

[Endpoint Descriptor]
----------------------------------------------
Length = 7
DescriptorType = 05
bEndpointAddress = 0x04
bmAttributes = 0x02
wMaxPacketSize = 64
bInterval = 0
bRefresh = 7
bSynchAddress = 5

[Endpoint Descriptor]
----------------------------------------------
Length = 7
DescriptorType = 05
bEndpointAddress = 0x05
bmAttributes = 0x02
wMaxPacketSize = 64
bInterval = 0
bRefresh = 7
bSynchAddress = 5

[Endpoint Descriptor]
----------------------------------------------
Length = 7
DescriptorType = 05
bEndpointAddress = 0x81
bmAttributes = 0x02
wMaxPacketSize = 64
bInterval = 0
bRefresh = 7
bSynchAddress = 5

[Endpoint Descriptor]
----------------------------------------------
Length = 7
DescriptorType = 05
bEndpointAddress = 0x82
bmAttributes = 0x02
wMaxPacketSize = 64
bInterval = 0
bRefresh = 7
bSynchAddress = 5

[Endpoint Descriptor]
----------------------------------------------
Length = 7
DescriptorType = 05
bEndpointAddress = 0x83
bmAttributes = 0x02
wMaxPacketSize = 64
bInterval = 0
bRefresh = 7
bSynchAddress = 5

[Endpoint Descriptor]
----------------------------------------------
Length = 7
DescriptorType = 05
bEndpointAddress = 0x84
bmAttributes = 0x02
wMaxPacketSize = 64
bInterval = 0
bRefresh = 7
bSynchAddress = 5

[Endpoint Descriptor]
----------------------------------------------
Length = 7
DescriptorType = 05
bEndpointAddress = 0x85
bmAttributes = 0x02
wMaxPacketSize = 64
bInterval = 0
bRefresh = 0
bSynchAddress = 0
</pre>

== Related links ==
[https://github.com/xqemu/xqemu/blob/xbox/hw/xbox/xid.c XID emulation in XQEMU]

[https://docs.google.com/spreadsheets/d/1-c1tXfOMvaWuno3ixQyI_rPCQVAZA24N4v9OPZUSrCk/edit?usp=sharing Compilation of Xbox Controller Hardware Research]

Talk:Xbox DVD Movie Playback Kit

2022-01-31T09:35:55Z

JohnVeness: Created page with "== Roms == I have an X08-25387 from which I could probably dump the ROM. Is there a repository somewhere to upload/store them? Also, what is the "Version" in the wiki table (a..."

== Roms ==
I have an X08-25387 from which I could probably dump the ROM. Is there a repository somewhere to upload/store them? Also, what is the "Version" in the wiki table (always seems to be 1.1)? --[[User:JohnVeness|JohnVeness]] ([[User talk:JohnVeness|talk]]) 09:35, 31 January 2022 (UTC)

Xbox DVD Movie Playback Kit

2022-01-26T16:42:20Z

JohnVeness: /* References */ Added MS link

[[File:Xbox-Remote-and-Receiver.jpg|thumb|200px|Remote and Receiver]]
==Introduction==

The DVD Movie Playback Kit contains 2 parts: A remote and a dongle for the Xbox{{FIXME|reason=One of these parts, or both, seem to have a model number PG8012?}}.

== Remote Control ==

=== Infrared interface ===

{{FIXME|reason=Missing info about light frequency, timing, possible preamble and more}}

{{FIXME|reason=The following information has been derived from http://lirc.sourceforge.net/remotes/microsoft/Xbox and all logic was extrapolated; it's entirely unconfirmed}}

<pre>
struct {
uint8_t check_high; // 8 bit check
uint8_t check_low__data_high; // 4 bit check, 4 bit data
uint8_t data_low; // 8 bit data
};
</pre>

The first part of the transfer consists of the negated data signal (<code>check</code>).

The data integrity can be confirmed by XOR-ing both parts:

<pre>
check = (check_high << 4) | check_low
data = (data_high << 8) | data_low
check ^ data = 0xFFF
</pre>

The <code>check</code>, which marks the start of the transfer{{FIXME|reason=There might be a preamble}}, always starts with 0b0101, therefore the <code>data</code> always starts with 0b1010.

== Dongle ==

The dongle contains a ROM with an XBE which provides some functions for the DVD playback application. However, the XBE is not standalone.

Why would they not just put this little < 512kiB library on the harddisk? Why another ROM which contains the program?
One could think it is to allow them to upgrade the application easily, but the real reason seems to be different: licensing. As the label on the back notes: "Made under license from Dolby Laboratories". By including the software in the DVD Remote kit, they didn't have to pay the [[wikipedia:DVD Forum|DVD Forum]] (and apparently also Dolby) for every Xbox sold, but just for every DVD Remote kit sold[https://www.youtube.com/watch?v=gquAV8f7OAY&t=2059]. This allowed them to keep the cost of the Xbox down.

Additionally the dongle contains an IR receiver to receive commands from the Remote control.

=== Known versions ===

{| class="wikitable" 
! Part No. !! Manufactured in !! Version !! DVD Region !! ROM Size !! ROM SHA1 !! Notes
|-
| X08-25402 || Indonesia || 1.1 || 2 || 229790 Bytes || <code>70d4b5f8e073b05610fba9e9617d7356196b61ff</code> ||
|-
| X08-25402-002 || Indonesia || 1.1 ||2 || 229790 Bytes || <code>70d4b5f8e073b05610fba9e9617d7356196b61ff</code> ||
|-
| X08-25387 || Indonesia || || || || ||
|-
| X08-25387-002 || Indonesia || 1.1 || 1 || 229790 Bytes || <code>73814aa736d83d636380f5c6b1c291441b35354d</code> || Sticker: "2341P" on PCB
|-
| X08-25597 || Indonesia || 1.1 || 4 || 229790 Bytes || <code>1E6D7F4F526B56527447AA09EDA41FFF05665A16</code> ||
|-
| X08-96288-002 || Indonesia || 1.1 || 3 || 229790 Bytes || <code>0447373BF9326DFF95808CD028ED19FACD54C759</code> ||
|}

=== USB Protocol ===

==== USB Descriptor ====

<pre>

Bus 001 Device 002: ID 045e:0284 Microsoft Corp. Xbox DVD Playback Kit
Couldn't open device, some information will be missing
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 1.10
bDeviceClass 0
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x045e Microsoft Corp.
idProduct 0x0284 Xbox DVD Playback Kit
bcdDevice 0.0a
iManufacturer 0
iProduct 0
iSerial 0
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 0x0022
bNumInterfaces 2
bConfigurationValue 1
iConfiguration 0
bmAttributes 0x00
(Missing must-be-set bit!)
(Bus Powered)
MaxPower 0mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 1
bInterfaceClass 88 Xbox
bInterfaceSubClass 66 Controller
bInterfaceProtocol 0
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x81 EP 1 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x0008 1x 8 bytes
bInterval 16
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 0
bNumEndpoints 0
bInterfaceClass 89
bInterfaceSubClass 0
bInterfaceProtocol 0
iInterface 0
</pre>

==== Infrared signals ====



When infrared signals are received from the Remote Control, they can be read using an interrupt transfer {{FIXME|reason=What interface etc?}}. Each USB payload is 6 bytes long:

<pre>
struct {
uint8_t unk; // always 0x00 (These could be length high bits?)
uint8_t length_low; // always 0x06
uint8_t data_low;
uint8_t data_high; // only lower 4 bit are used (Always 0x0A with offical Microsoft remote)
// Milliseconds since last press (will clamp to 0xFFFF when no button was pressed in a long time).
// A value close to 0x0040 is returned for continously holding a button.
// When holding, the value often goes back and forth between 0x0040 / 0x0041.
// It is unknown if the receiver / remote intentionally does this.
uint8_t timer_low;
uint8_t timer_high;
};
</pre>

When holding two or more buttons at once on the remote the IR receiver stops sending interrupt transfers. The last transfer will be the first button pressed.

The keycodes read from an official Microsoft IR remote are as follows:
{| class="wikitable"
!Button
!data_low
!data_high
|-
|INFO
|0xC3
|0x0A
|-
|9
|0xC6
|0x0A
|-
|8
|0xC7
|0x0A
|-
|7
|0xC8
|0x0A
|-
|6
|0xC9
|0x0A
|-
|5
|0xCA
|0x0A
|-
|4
|0xCB
|0x0A
|-
|3
|0xCC
|0x0A
|-
|2
|0xCD
|0x0A
|-
|1
|0xCE
|0x0A
|-
|0
|0xCF
|0x0A
|-
|SELECT
|0x0B
|0x0A
|-
|UP
|0xA6
|0x0A
|-
|DOWN
|0xA7
|0x0A
|-
|RIGHT
|0xA8
|0x0A
|-
|LEFT
|0xA9
|0x0A
|-
|STOP
|0xE0
|0x0A
|-
|REVERSE
|0xE2
|0x0A
|-
|FORWARD
|0xE3
|0x0A
|-
|TITLE
|0xE5
|0x0A
|-
|PAUSE
|0xE6
|0x0A
|-
|PLAY
|0xEA
|0x0A
|-
|POWER
|0xD5
|0x0A
|-
|BACK
|0xD8
|0x0A
|-
|SKIP-
|0xDD
|0x0A
|-
|SKIP+
|0xDF
|0x0A
|-
|MENU
|0xF7
|0x0A
|-
|}

==== Firmware download ====

See https://github.com/XboxDev/dump-dvd-kit (PC Python based) or https://github.com/Ryzee119/Dongle_Dumper (Xbox homebrew).

The firmware locatedn on the DVD dongle is accessed over USB by a vendor specific control request.

The setup packet for the control transfer should have the below format:

{| class="wikitable" 
! Field !! Value !! Notes
|-
| bmRequestType || 0xC1 || Device-to-host / Vendor / Interface.
|-
| bRequest || 1 or 2 || 1 = Request ROM info, 2 = Request ROM data.
|-
| wValue || What 1024 byte chunk || 0 = the first 1024 bytes, 1 = Second 1024 bytes etc.
|-
| wIndex || 1 (Normally) || Should point to the bInterfaceNumber that has a bInterfaceClass of 0x59. That happens to be 1 on most DVD Playback dongles.
|-
| wLength || Up to 1024 || Number of bytes to read from chunk set by wValue. Note the max value here is 1024. To read the next chunk, issue another setup packet with a new wValue.
|-
|}

bRequest = 1 can be used to obtain the header of the ROM. This is a 6 byte header in the form:
<pre>
typedef struct
{
uint16_t version; //The version of the embedded ROM
uint32_t rom_size; //In bytes
} xremote_info_t;
</pre>

The rom size can then be used with bRequest = 2 to obtain the entire ROM contents. It should be noted that the ROM header obtained with bRequest = 2 is also present at the first 6 bytes of the full ROM image. So it is possible to obtain the ROM header info with bRequest = 2 requesting the first 6 bytes.

=== Components ===

Different versions of the dongle seem to use different hardware internally.

==== X08-25387-002 (PCB: "X01469-100") ====

* U1 ATMEL AT43USB352M-AC{{FIXME|reason=Can't find datasheet.. only for AT43USB351M-AC and AT43USB353M-AC; both of which have various differences}}
* U2 TSOP-1556
* U3 X393121C{{FIXME|reason=What is this? a ROM? how large?}}

==== X08-25387 (PCB: "IR DONGLE REV B") ====
[[File:X08-25387-Sticker.jpeg|thumb|200px|X08-25387 Rev B Sticker]]
[[File:IR_DONGLEREVB-FRNT.jpeg|thumb|200px|Front PCB of X08-25387]]

* U3 MX23C4000TC-10

{{FIXME|reason=Didn't get rear components photographed yet}}73814aa736d83d636380f5c6b1c291441b35354d

==== Unknown version (PCB: "REV C.") ====

[[File:Xbox-linux-dvd-dongle-front.jpg|thumb|200px|Frontside]]
[[File:Xbox-linux-dvd-dongle-back.jpg|thumb|200px|Backside]]

* U1 92163 [https://web.archive.org/web/20100617020513/http://www.st.com/ STMicroelectronics] <[https://web.archive.org/web/20100617020513/http://www.st.com/stonline/books/pdf/docs/5521.pdf Datasheet]>
: This big square IC on the backside is the microcontroller. STMicroelectronics describes it as "8/16-BIT FULL SPEED USB MCU FOR COMPOSITE DEVICES WITH 16 ENDPOINTS, 20K ROM, 2K RAM, I 2 C, SCI, & MFT". Since the program resides inside in its ROM, it is almost impossible to extract the program from inside.

* U2 TSOP-1556 [https://web.archive.org/web/20100617020513/http://www.vishay.com/ Vishay Telefunken] <[https://web.archive.org/web/20100617020513/http://www.vishay.com/docs/82029/82029.pdf Datasheet]>
: This black box on the middle of the frontside is an integrated IR receiver. It filters the received infrared pulses and demodulates them. Its filter frequency is 56kHz, while 38kHz is standard for most remote controls. Therefore, chances are few other remotes will work with the Xbox receiver.

* U3 MX23C4000TC-10 [https://web.archive.org/web/20100617020513/http://www.macronix.com/ Macronix] <[https://web.archive.org/web/20100617020513/http://www.macronix.com/QuickPlace/hq/PageLibrary48256D9D002BA613.nsf/h_6057FA6682A90C3948256DCE0052D2D3/67DCB124F1BE4E7D48256DC50039AC31/$File/MX23C4000-4.2.pdf/?OpenElement Datasheet]>
: This wide TSOP IC on the frontside could be the most interesting of all. It is a 4MBit mask ROM.

* U4 HC574 [https://web.archive.org/web/20100617020513/http://www.ti.com/ Texas Instruments] <[https://web.archive.org/web/20100617020513/http://focus.ti.com/lit/ds/symlink/sn74hc574.pdf Datasheet]>
: This 20-pin standard logic IC is an octal D-flipflop, which splits the databus from the 92163 to 8 adress bits. This technique is very well known from the 8051 and other microcontrollers.

== References ==

* [https://ibb.co/album/cmr5rF Pictures of X08-25387-002 including internals]
* [https://web.archive.org/web/20100617020513/http://www.xbox-linux.org/wiki/DVD-IR_Internals DVD-IR Internals]
* [https://www.betaarchive.com/wiki/index.php/Microsoft_KB_Archive/817041 Microsoft KB817041 document "Xbox: Description of the DVD Movie Playback Kit"]