Converting an Xbox 360 wireless controller to wired?

Damn, so is it like a custom chip made to have like three chips on one???

 

It's probably just a single chip, but has the functions that were previously contained in 3 separate chips. Consider that the design for the 360 must have started > 10 years ago, and back then making chips that mixed digital, RF and high-endurance non-volatile memory on the same die would have been a huge challenge, so they used a 3-chip solution - later on, when they were looking for ways to reduce the manufacturing cost it was practical to put it all on the same die, so they did.

If you look at the RF board in the console, it's the same - the original ones had 3 chips (Serial EEPROM, MCU and radio) and the later one merged the MCU and radio into a single chip - they still had a separate EEPROM chip though.

 

Yes, that was precisely what I was meaning, they should've done this in the beginning

So, if I am correct, the recognizing of the controller and it's functions are all embedded in the wireless receiver and not in the actual controller itself??

 

I also forgot to mention, what about that white connector on the actual PCB that's also viewable when you open the battery pack? On the wired one it has the actual wire leading from it, where as the wireless one doesnt (but appears upside down?)

 

That sounds like the connector for the rechargeable battery pack, if it's the one you can see when you remove the battery box. The connections are just +/- and serial (I2C) link used for monitoring the battery state. They connect to the middle 4 contacts on the battery pack (the two outside ones are an auxiliary supply and a temperature monitor that are used by the MS fast charger).

 

Ahhh okay then, I suppose tat makes sense then!

So, if I am correct, the recognizing of the controller and it's functions are all embedded in the wireless receiver and not in the actual controller itself?? Please correct me if I am wrong, I'm trying to find out where all these functions are layed.

 

It's hard to say without either doing a low-level analysis of the communications protocol or reverse engineering the hardware. I assume that the information that describes the controller is sent over the radio link when you first connect, and the receiver just reformats it into a form that's acceptable for USB. The alternative (that the receiver itself has all the descriptors in it) seems unlikely since that would require it to have firmware that could support every possible type of controller that might be used - even the ones that hadn't been designed when the console was originally released.

What I do know is that the receiver only generates connect events when the controller is linked with it - but that doesn't really tell you anything, since the most obvious way to handle communications loss would be to map it to a virtual disconnect of the USB cable - and once it was disconnected it clearly wouldn't be able to send descriptors even if they were stored locally in the receiver.

 

Okay, this is a really good start, so it is still most likely that the functions and data are made in its native form within the controller and then relayed to the wireless receiver (am I getting this correct yes? )

Hsn't anyone (after 10 years since the Xbox 360's release) ever tried reverse engineered the hardware or the controllers by any chance? Do you think anyone else might know elsewhere (like AcidMods or BenHeck?)

 

That's my guess - but it's only a guess. Basically, it's what I would do if I had been the person designing it.

Someone obviously did reverse engineer the receiver, because you can buy cloned ones - but they don't have any interest in revealing their results, for obvious reasons. I'm not aware of any publicly available reverse engineering efforts, but it's certainly worth asking around.

I suspect the ready availability of RF modules from old RRoD consoles is part of the reason nobody seems to have put much effort into this.

 

With that said I am pretty sure that the controller has been reverse engineered since there are clones of it too, there are pleeenty of them around Alibaba (and I even own the Chinese wired controller too)!

I can probably ask around, but was I asking in the right thread/forum here? Maybe a specific category I should've posted in??

 

Honestly, this is probably the right board to ask, and this is the correct forum.

Yeah, the controllers were also reversed, but that took a bit longer because of the security chip. The problem is that normally the people doing this stuff commercially are either working for the company that makes the clones or were contractors working under NDA. In both cases they have a strong incentive to keep their mouths shut - especially given the somewhat dodgy legal position of this stuff post about 2000.

 

The Play And Charge cable can also be used to sync the controller with the console (or PC).

If you have the USB RF accessory and the driver installed on your PC, by connecting the P&C cable and the controller the PC will automatically sync the controller to it's RF antenna.

So you *CAN* use it wired (no batteries) with a P&C cable, but you won't get away with it without getting the wireless antenna.

 

Hey guys, sorry for the late reply!

I've been looking around and there has been some attempts at reverse engineering the controller, particularly at acidmods.com and I think they came close:

http://www.acidmods.com/forum/index.php?topic=35417.0

Also an ex-army man had a crack at it too!:

http://www.theregister.co.uk/2010/02/17/infineon_tpm_crack/

I mean all we need is just the functions of button pressing to be relayed over a USB cable and for it to recognize on a PC like a wired controller itself

 

Just get a wired controller or the RF receiver. Like I said, you can use it with the play and charge cable + the RF receiver without need to place batteries in it.

Whatever these people manage to reverse engineer, they won't be able to change a wireless controller into wired due to them using different main chips.

 

Sorry for the late reply., but to be honest it's not just about simply getting a wired one (I already have a wired controller and one of the Chinese clones of it too)!

To TriMesh, do you know about these reverse engineering works news that was happening?

 

Had no idea of them news TriMesh?

Also, I thought I would ask something relevant whilst I'm here, although we have been discussing of taking a Wireless controller to being Wired, do any of you know if it's possible to take a Wired and make it Wireless??

 

Using a wireless controller without the RF antenna won't happen due to the simple fact that the main controller chip is different on wired and wireless controllers.

The wireless one will only connect to the host through the wireless interface and the USB port in it is used only to sync to the host without using the sync button and control the charge circuitry for the battery.

Trimesh: Now, it might be shocking news for you but if you wire any XBOX360 "argon board" (that's how they call the RF/lights board) to a PC and install the controllers driver the XBOX360 "argon board" will operate exactly the same as a RF receiver. Some guy even made a PIC micro code for a 8 pin PIC so it can sync to controllers using a button.

 

It wouldn't come as a surprise to me at all - have a look at post #2 in this thread

 

TriMesh, what would you need exactly if you want to dissect the wireless controller?

 

It depends on what your aims are.

Most of the time, the commercial cloners just want to make something that works in the same way as the original - and you can do that simply by observing what comes in and goes out, and designing something to produce the same results. You dont' really care about the internals, since they don't matter.

But I suspect your interest is in finding hidden behavior - which is a lot harder. In that case, you basically have to extract the code from inside the chip, and then go through it and find out what it does, and look for bits that don't match with any publicly known features. Before you can even start doing this, there are a bunch of things you need to do:

1) Find out exactly what the chip is - for a custom part, this normally means decapping it and examining the die for clues - maybe you will get lucky and find it has a name or part number on the die and you can find a data sheet.
2) Extract the code from it. The method of doing this varies - with some very old masked devices you can see the ROM pattern in the top metal and can directly extract the bits from a micrograph. On more modern devices it can be harder - so you might end up having to mount the chip up, rebond it, and then use a microprobing station to get at the internal signals.
3) Once you dump the code, you have to figure out what the machine architecture is - which is again, something that can be more or less difficult depending on what you are dealing with.
4) Finally, you can pull the code apart and figure out what it's doing.

If this sounds like a nightmare job, well, yes it is. That's precisely why people who are making clones will generally not bother with it.