CTCaer

It's now doable.

@mslmanni It's not as simple as that. Everything is encoded to currently unknown formats. I tried once to make sense of the main configuration sent to the IR camera, and...

I looked at the Wiimote protocol. If it was that easy.... :/ A configuration command is actually 2 x21 subcmd packets. The arguments for the x21 subcmds look like this:...

Well I had some progress REing the MCU image transfer protocol thanks to packets I got from testing with libnx and REing the Switch services. I'll do a write up...

You had a pic here, why you removed it? It was valuable. It is indeed a redesign. Antenna is now at the bottom instead at top protruding. - The antenna...

I found sth familiar (process_cmd()): ``` int __fastcall sub_21B2A8(int a1, int a2, int a3, _BYTE *a4, int a5) { int v5; // r7@1 int v6; // r9@1 _BYTE *v7; //...

I'll try to find how they are used (found a function with hardcoded read to SPI @x10000, maybe it's around there). The good thing with the ram dumps, is that...

@shuffle2 [Here](https://mega.nz/#!oQESWIrD!yun8sdLamyjZRJFYD9NV5V9kJcGCQFQEfYzn-7FkCX8) are some more dumps from the right joy-con. It includes RAM and some memory regions I found in the code (0x260000, 0x310000-0x360000,0x600000, 0x640000, 0x650000, 0xE0001000-0xE0042000). Some are missing....

@shuffle2 sorry to pester you again, but I need some help. I couldn't wait for my programmer to arrive, so I went ahead and changed only one specific byte in...

Hmm, strange. I've used many times the ROM protocol to change only one byte from the magic for DS location and worked every time. The firmware was always loading the...