Meant to be Seen

OzOnE2k10 wrote:I'm trying to figure out the protocol between the handset and the base, and thought I might as well post the progress here...
...
Anyway, plenty more fun to be had.
I might try some custom transmit coils soon.

I am very interested in this, so please keep posting your reversing progress. Thanks!

A quick update on the Razer joystick protocol stuff...

My calcs were wrong on the baud rate. It looks like it's actually 125000 baud (makes more sense than 62500).
I also had the data inverted in the analyser software. I forgot with TTL RS232, the signal is often HIGH at idle.

Here's just one capture. Some of the packets had different data, but the checksum calcs still worked fine...

TX (from base)...
FF = Start?
55 = Sync / preamble?
01 = Byte count.
82 = Data byte ("Command").
7D = Checksum (0x82 XOR 0xFF)

RX (from joystick)...
FF = Start?
55 = Sync / preamble?
07 = Byte count.
82
80
00
00
00
00
00
F7 = Checksum ( ( (0x07 + 0x82 + 0x80) & 0xFF -1) XOR 0xFF)


I found that I had to subtract 1 after adding up the joystick packet bytes then doing the XOR 0xFF?
Not sure what the data bytes do yet, but it probably just sets the bits based on the button states, then has other bytes for the joystick position.

I'll have to do another capture when I get time (after Glasto), but it's looking like we can at least spoof the data easily using a simple Arduino sketch.
Then we could build very small custom boxes for doing positional tracking etc. (This would replace the original handsets though.)

Also, it looks like the first byte of the packet (after the byte count) just sends back the "command" byte, then the next six bytes are the actual joystick data.

OzOnE.

Any Progress?
My hydra sits pulsing; i would love to make our own hydra trackers.
Stem seems a high price for me

Does anybody have any info on the base station board (Schematics, and the like)?
Thanks!