Figuring out error detection scheme for custom protocol - Page 1
Forum section: electronics / general

author: m.elsayed
author_rank: Contributor
timestamp: October 14, 2025, 01:18:53 am
content: Background:I have a cheap game controller that uses some kind of custom communication protocol, the closest I have found similar to it is MicroWire or half-duplex SPIThere are two controllers, one is the primary which connects to a computer over USB, and poll the secondary using what I think a custom protocol.Of course the two chips are black blobs, so there is no way to get any information about how do they work.1. There are two wires, clock and data2. clock and data are idle high3. primary controller generate the clock (25kHz)4. when the clock ticks, second controller will take control of the bus and send 8 bytes, sampled on the falling edge5. then the primary controller takes control and send 2 bytes (mostly to control the rumble motor and perhaps acknowledgment)6. primary controller will tick twice, so a total of 90 clock cycles7. idle for 10-13 microsecond, then repeat.I have successfully mapped all the buttons to individual bits like this:Code:struct ControllerData {uint8_t x;uint8_t y;uint8_t rx;uint8_t ry;uint8_t Key1 : 1;uint8_t Key2 : 1;uint8_t Key3 : 1;uint8_t Key4 : 1;uint8_t L1 : 1;uint8_t R1 : 1;uint8_t L2 : 1;uint8_t R2 : 1;uint8_t Start : 1;uint8_t Select : 1;uint8_t LThumb : 1;uint8_t RThumb : 1;uint8_t Up : 1;uint8_t Down : 1;uint8_t Left : 1;uint8_t Right : 1;uint8_t _pad0 : 4;uint8_t curr_mode : 1; // LED on/offuint8_t _pad1 : 8; // error detection?uint8_t _pad2 : 3; // // error detection?};Can anyone recognize what kind of error detection is this?my only problem is figuring out what kind of error detection/CRC it uses.my guess is that the last 8-11 bits are used for that.I have tried to focus on cases where all the bits are 0 except for a single bit and observe the change, and what I have noticed is that the last 11 bits will change drastically.mainly these cases:Code:00 00 00 00 00 00 5A 6B00 00 00 00 00 00 6A CB00 00 00 00 00 01 4A 1F00 00 00 00 00 10 2A 0B00 00 00 00 00 20 8A 0B00 00 00 00 00 40 CA 0A00 00 00 00 00 80 4A 0800 00 00 00 01 00 4A 7300 00 00 00 02 00 4A FB00 00 00 00 04 00 2A AB00 00 00 00 08 00 EA 0B00 00 00 00 10 00 0A 0Athis is all the patterns that I have gathered, it includes almost all possible combinations (single button, multiple buttons, analog sticks, ...etc)Code:00 00 00 00 00 00 5A 6B00 00 00 00 00 00 6A CB00 00 00 00 00 01 4A 1F00 00 00 00 00 10 2A 0B00 00 00 00 00 20 8A 0B00 00 00 00 00 40 CA 0A00 00 00 00 00 80 4A 0800 00 00 00 01 00 4A 7300 00 00 00 02 00 4A FB00 00 00 00 04 00 2A AB00 00 00 00 08 00 EA 0B00 00 00 00 10 00 0A 0A00 00 7C 00 00 00 8A 7000 00 CC 00 00 00 AA 0B00 00 EC 00 00 00 8A E900 00 FC 50 00 00 2A 2100 00 FC 7C 00 00 2A EC00 0C FC 00 00 00 2A 1200 10 FC 00 00 00 8A 9E00 84 00 48 00 00 8A 3F00 FC 00 48 00 00 EA 7E34 84 7C 80 00 64 5A FD70 84 7C 80 00 00 8A C874 00 00 00 00 00 4A F374 00 00 68 00 00 AA 2174 00 00 80 00 00 6A 0F74 00 7C 80 00 00 8A B474 84 00 00 00 00 6A 1A74 84 00 04 00 00 AA DB74 84 00 10 00 00 CA DD74 84 00 50 00 00 EA 0374 84 00 80 00 00 4A E674 84 00 FC 00 00 CA 3274 84 60 80 00 03 4A BC74 84 68 80 00 02 CA A074 84 7C 00 04 00 CA C174 84 7C 80 00 00 9A FD74 84 7C 80 00 00 AA 5D74 84 7C 80 00 01 8A 8974 84 7C 80 00 04 8A CD74 84 7C 80 00 08 8A 3D74 84 7C 80 00 10 EA 9D74 84 7C 80 00 14 CA 0D74 84 7C 80 00 20 4A 9D74 84 7C 80 00 30 0A 5D74 84 7C 80 00 40 0A 9C74 84 7C 80 00 50 4A 5C74 84 7C 80 00 60 EA 5C74 84 7C 80 00 80 8A 9E74 84 7C 80 00 90 CA 5E74 84 7C 80 00 98 DA 9E74 84 7C 80 00 C0 2A 5F74 84 7C 80 00 F0 8A 5F74 84 7C 80 01 00 8A E574 84 7C 80 01 00 BA 4574 84 7C 80 01 08 AA 8574 84 7C 80 02 00 8A 6D74 84 7C 80 02 08 AA 0D74 84 7C 80 02 40 2A AC74 84 7C 80 02 50 6A 6C74 84 7C 80 02 70 8A AC74 84 7C 80 03 00 AA D574 84 7C 80 03 08 BA 1574 84 7C 80 04 00 EA 3D74 84 7C 80 04 08 CA 5D74 84 7C 80 05 00 CA 8574 84 7C 80 06 00 CA 0D74 84 7C 80 06 A0 0A 0E74 84 7C 80 07 00 EA B574 84 7C 80 08 00 2A 9D74 84 7C 80 08 08 0A FD74 84 7C 80 09 00 0A 2574 84 7C 80 09 90 6A 2674 84 7C 80 0A 00 0A AD74 84 7C 80 0C 08 7A 3D74 84 7C 80 0C 90 0A FE74 84 7C 80 0F 00 6A 7574 84 7C 80 10 00 CA 9C74 84 7C FC 00 00 2A 8974 84 C8 FC 00 00 6A 3674 84 FC 00 00 00 AA E974 84 FC 80 00 00 8A 1574 84 FC FC 00 00 0A C174 FC 7C FC 00 00 4A C87C 84 7C 80 00 0C 8A C780 FC 7C 80 08 00 4A 87C8 00 00 FC 00 00 6A 7BCC 84 00 80 00 00 EA D3FC 00 00 00 00 00 4A FAFC 00 00 78 00 00 0A EFFC 00 00 7C 00 00 CA 2EFC 00 00 80 00 00 6A 06FC 00 7C FC 00 00 0A 69FC 00 84 00 00 00 0A 76FC 00 FC 00 00 00 8A 09FC 00 FC 8C 00 00 8A F7FC 84 00 80 00 00 4A EFFC 84 7C 80 00 00 AA 54FC 84 7C 80 00 01 8A 80FC 84 FC FC 00 00 0A C8FC FC 00 48 00 00 CA 4FFC FC 00 FC 00 00 AA 7AFC FC 7C 80 00 00 CA 15

author: darkspr1te
author_rank: Frequent Contributor
timestamp: October 14, 2025, 09:02:03 am
content: There are two possibles I can think of. it's either sony DS2 protocol or nintendo protcol,see these siteshttps://circuitcellar.com/research-design-hub/projects/interfacing-with-video-game-controllers/https://learn.adafruit.com/super-nintendo-usb-controller/how-it-workshttps://gamefaqs.gamespot.com/snes/916396-super-nintendo/faqs/5395darkspr1te

author: m.elsayed
author_rank: Contributor
timestamp: October 14, 2025, 07:36:12 pm
content: Quote from: darkspr1te on October 14, 2025, 09:02:03 amThank you so much for your reply, unfortunately it's neither of these protocols.It's not as complex as PS2(half-duplex) and slightly more complex(2-way communication) than Nintendo NES protocol.To be honest I have given up on finding out which protocol it is, and I only need to figure out the error detection scheme.

author: DavidAlfa
author_rank: Super Contributor
timestamp: October 14, 2025, 07:54:18 pm
content: The first 4 bytes look like 8-bit signed integers for the joysticks:Code:[74 84 7C FC] 00 00 2A 89The last byte doesn't seem to be a checksum, it repeats for different data.It might be other flags for the buttons, indicating timing, previous states...I sorted the list by "checksum":Code:74 84 00 50 00 00 EA 03FC 00 00 80 00 00 6A 0600 00 00 00 00 80 4A 08FC 00 FC 00 00 00 8A 0900 00 00 00 00 40 CA 0A00 00 00 00 10 00 0A 0A00 00 00 00 00 10 2A 0B00 00 00 00 00 20 8A 0B00 00 00 00 08 00 EA 0B00 00 CC 00 00 00 AA 0B74 84 7C 80 00 14 CA 0D74 84 7C 80 02 08 AA 0D74 84 7C 80 06 00 CA 0D74 84 7C 80 06 A0 0A 0E74 00 00 80 00 00 6A 0F00 0C FC 00 00 00 2A 1274 84 7C 80 03 08 BA 1574 84 FC 80 00 00 8A 1574 84 00 00 00 00 6A 1A00 00 00 00 00 01 4A 1F00 00 FC 50 00 00 2A 2174 00 00 68 00 00 AA 2174 84 7C 80 09 00 0A 2574 84 7C 80 09 90 6A 26FC 00 00 7C 00 00 CA 2E74 84 00 FC 00 00 CA 3274 84 C8 FC 00 00 6A 3674 84 7C 80 00 08 8A 3D74 84 7C 80 04 00 EA 3D74 84 7C 80 0C 08 7A 3D00 84 00 48 00 00 8A 3F74 84 7C 80 01 00 BA 4574 84 7C 80 00 50 4A 5C74 84 7C 80 00 60 EA 5C74 84 7C 80 00 00 AA 5D74 84 7C 80 00 30 0A 5D74 84 7C 80 04 08 CA 5D74 84 7C 80 00 90 CA 5E74 84 7C 80 00 C0 2A 5F74 84 7C 80 00 F0 8A 5FFC 00 7C FC 00 00 0A 6900 00 00 00 00 00 5A 6B74 84 7C 80 02 50 6A 6C74 84 7C 80 02 00 8A 6D00 00 7C 00 00 00 8A 7000 00 00 00 01 00 4A 7374 84 7C 80 0F 00 6A 75FC 00 84 00 00 00 0A 76C8 00 00 FC 00 00 6A 7B00 FC 00 48 00 00 EA 7E74 84 7C 80 01 08 AA 8574 84 7C 80 05 00 CA 8580 FC 7C 80 08 00 4A 8774 84 7C 80 00 01 8A 8974 84 7C FC 00 00 2A 8974 84 7C 80 00 40 0A 9C74 84 7C 80 10 00 CA 9C74 84 7C 80 00 10 EA 9D74 84 7C 80 00 20 4A 9D74 84 7C 80 08 00 2A 9D00 10 FC 00 00 00 8A 9E74 84 7C 80 00 80 8A 9E74 84 7C 80 00 98 DA 9E74 84 68 80 00 02 CA A000 00 00 00 04 00 2A AB74 84 7C 80 02 40 2A AC74 84 7C 80 02 70 8A AC74 84 7C 80 0A 00 0A AD74 00 7C 80 00 00 8A B474 84 7C 80 07 00 EA B574 84 60 80 00 03 4A BC74 84 7C 00 04 00 CA C174 84 FC FC 00 00 0A C17C 84 7C 80 00 0C 8A C770 84 7C 80 00 00 8A C874 FC 7C FC 00 00 4A C800 00 00 00 00 00 6A CB74 84 7C 80 00 04 8A CDCC 84 00 80 00 00 EA D374 84 7C 80 03 00 AA D574 84 00 04 00 00 AA DB74 84 00 10 00 00 CA DD74 84 7C 80 01 00 8A E574 84 00 80 00 00 4A E600 00 EC 00 00 00 8A E974 84 FC 00 00 00 AA E900 00 FC 7C 00 00 2A ECFC 00 00 78 00 00 0A EF74 00 00 00 00 00 4A F3FC 00 FC 8C 00 00 8A F7FC 00 00 00 00 00 4A FA00 00 00 00 02 00 4A FB34 84 7C 80 00 64 5A FD74 84 7C 80 00 00 8A FD74 84 7C 80 08 08 0A FD74 84 7C 80 0C 90 0A FE

author: cunningfellow
author_rank: Regular Contributor
timestamp: October 14, 2025, 08:09:47 pm
content: Quote from: m.elsayed on October 14, 2025, 01:18:53 amis that above bit correct? If so then the checksum bytes have different output for the same input. Maybe they also have a count of packets in them.If it is a cheap chinese product then it could well be something dumb like vertical parity

author: m.elsayed
author_rank: Contributor
timestamp: October 14, 2025, 09:04:24 pm
content: Quote from: DavidAlfa on October 14, 2025, 07:54:18 pmI though about that as well, that maybe this is some kind of a map to indicate which group of buttons are pressed, but the last 11 bits still do not make any sense.changing a single bit will usually change 3 bits on average --I think--so my best guess so far is that this is probably some kind of CRC

author: m.elsayed
author_rank: Contributor
timestamp: October 14, 2025, 09:11:38 pm
content: Quote from: cunningfellow on October 14, 2025, 08:09:47 pmThanks, I will read more about vertical parityYes, this is correct, this is the LED(mode button)This is the mapping for the last 2 bytes:uint8_t _pad0 : 4; // no idea!uint8_t curr_mode : 1; // LED on/offuint8_t _pad1 : 8; // error detection?uint8_t _pad2 : 3; // // error detection?

author: __greg__
author_rank: Newbie
timestamp: October 15, 2025, 08:55:25 am
content: reveng finds:Quote

author: m.elsayed
author_rank: Contributor
timestamp: October 15, 2025, 09:20:53 am
content: Quote from: __greg__ on October 15, 2025, 08:55:25 amThank you so much, this is it!I have tested with all the patterns I have and they all matchOf course there is a tool for this, but I haven't thought about that at all.So thank you for letting me know that such tool exist.