stadiaRawBtFw
stadiaRawBtFw copied to clipboard
Published
20 hours ago •
Scyne
Scyne
USB descriptors
Some dumps of SP Blank RT Family device mode (VID:1fc9 PID:0135) used for firmware update (second stage after you press the option, assistant, A, and Y buttons):
DEVICE DESCRIPTOR
bLength: 18
bDescriptorType: 0x01 (DEVICE)
bcdUSB: 0x0200
bDeviceClass: Device (0x00)
bDeviceSubClass: 0
bDeviceProtocol: 0 (Use class code info from Interface Descriptors)
bMaxPacketSize0: 64
idVendor: NXP Semiconductors (0x1fc9)
idProduct: Unknown (0x0135)
bcdDevice: 0x0101
iManufacturer: 1
iProduct: 2
iSerialNumber: 0
bNumConfigurations: 1
CONFIGURATION DESCRIPTOR
bLength: 9
bDescriptorType: 0x02 (CONFIGURATION)
wTotalLength: 34
bNumInterfaces: 1
bConfigurationValue: 1
iConfiguration: 0
Configuration bmAttributes: 0xc0 SELF-POWERED NO REMOTE-WAKEUP
bMaxPower: 50 (100mA)
INTERFACE DESCRIPTOR (0.0): class HID
bLength: 9
bDescriptorType: 0x04 (INTERFACE)
bInterfaceNumber: 0
bAlternateSetting: 0
bNumEndpoints: 1
bInterfaceClass: HID (0x03)
bInterfaceSubClass: No Subclass (0x00)
bInterfaceProtocol: 0x00
iInterface: 0
HID DESCRIPTOR
bLength: 9
bDescriptorType: 0x21 (HID)
bcdHID: 0x0100
bCountryCode: Not Supported (0x00)
bNumDescriptors: 1
bDescriptorType: HID Report (0x22)
wDescriptorLength: 76
ENDPOINT DESCRIPTOR
bLength: 7
bDescriptorType: 0x05 (ENDPOINT)
bEndpointAddress: 0x81 IN Endpoint:1
bmAttributes: 0x03
wMaxPacketSize: 64
bInterval: 4
STRING DESCRIPTOR
bLength: 40
bDescriptorType: 0x03 (STRING)
bString: SP Blank RT Family
HID Report descriptor:
0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00)
0x09, 0x01, // Usage (0x01)
0xA1, 0x01, // Collection (Application)
0x85, 0x01, // Report ID (1)
0x19, 0x01, // Usage Minimum (0x01)
0x29, 0x01, // Usage Maximum (0x01)
0x15, 0x00, // Logical Minimum (0)
0x26, 0xFF, 0x00, // Logical Maximum (255)
0x75, 0x08, // Report Size (8)
0x95, 0x10, // Report Count (16)
0x91, 0x02, // Output (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x02, // Report ID (2)
0x19, 0x01, // Usage Minimum (0x01)
0x29, 0x01, // Usage Maximum (0x01)
0x15, 0x00, // Logical Minimum (0)
0x26, 0xFF, 0x00, // Logical Maximum (255)
0x75, 0x80, // Report Size (-128)
0x95, 0x40, // Report Count (64)
0x91, 0x02, // Output (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x03, // Report ID (3)
0x19, 0x01, // Usage Minimum (0x01)
0x29, 0x01, // Usage Maximum (0x01)
0x15, 0x00, // Logical Minimum (0)
0x26, 0xFF, 0x00, // Logical Maximum (255)
0x75, 0x08, // Report Size (8)
0x95, 0x04, // Report Count (4)
0x81, 0x02, // Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
0x85, 0x04, // Report ID (4)
0x19, 0x01, // Usage Minimum (0x01)
0x29, 0x01, // Usage Maximum (0x01)
0x15, 0x00, // Logical Minimum (0)
0x26, 0xFF, 0x00, // Logical Maximum (255)
0x75, 0x08, // Report Size (8)
0x95, 0x40, // Report Count (64)
0x81, 0x02, // Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
0xC0, // End Collection
// 76 bytes
Bootloader device mode (VID:18d1 PID:946b) - after press of option (three dots) button on the controller while you connect the controller to a computer:
DEVICE DESCRIPTOR
bLength: 18
bDescriptorType: 0x01 (DEVICE)
bcdUSB: 0x0200
bDeviceClass: Miscellaneous (0xef)
bDeviceSubClass: 2
bDeviceProtocol: 1 (Interface Association Descriptor)
bMaxPacketSize0: 64
idVendor: Google Inc. (0x18d1)
idProduct: Unknown (0x946b)
bcdDevice: 0x0001
iManufacturer: 1
iProduct: 2
iSerialNumber: 3
bNumConfigurations: 1
CONFIGURATION DESCRIPTOR
bLength: 9
bDescriptorType: 0x02 (CONFIGURATION)
wTotalLength: 80
bNumInterfaces: 2
bConfigurationValue: 1
iConfiguration: 0
Configuration bmAttributes: 0x80 NOT SELF-POWERED NO REMOTE-WAKEUP
bMaxPower: 250 (500mA)
INTERFACE ASSOCIATION DESCRIPTOR
bLength: 8
bDescriptorType: 0x0b (INTERFACE ASSOCIATION)
bFirstInterface: 0
bInterfaceCount: 1
bFunctionClass: Vendor Specific (0xff)
bFunctionSubClass: 0x00
bFunctionProtocol: 0x00
iFunction: 0
INTERFACE DESCRIPTOR (0.0): class Vendor Specific
bLength: 9
bDescriptorType: 0x04 (INTERFACE)
bInterfaceNumber: 0
bAlternateSetting: 0
bNumEndpoints: 2
bInterfaceClass: Vendor Specific (0xff)
bInterfaceSubClass: 0x00
bInterfaceProtocol: 0x00
iInterface: 0
ENDPOINT DESCRIPTOR
bLength: 7
bDescriptorType: 0x05 (ENDPOINT)
bEndpointAddress: 0x87 IN Endpoint:7
bmAttributes: 0x02
wMaxPacketSize: 512
bInterval: 0
ENDPOINT DESCRIPTOR
bLength: 7
bDescriptorType: 0x05 (ENDPOINT)
bEndpointAddress: 0x07 OUT Endpoint:7
bmAttributes: 0x02
wMaxPacketSize: 512
bInterval: 0
INTERFACE ASSOCIATION DESCRIPTOR
bLength: 8
bDescriptorType: 0x0b (INTERFACE ASSOCIATION)
bFirstInterface: 1
bInterfaceCount: 1
bFunctionClass: HID (0x03)
bFunctionSubClass: 0x00
bFunctionProtocol: 0x00
iFunction: 0
INTERFACE DESCRIPTOR (1.0): class HID
bLength: 9
bDescriptorType: 0x04 (INTERFACE)
bInterfaceNumber: 1
bAlternateSetting: 0
bNumEndpoints: 2
bInterfaceClass: HID (0x03)
bInterfaceSubClass: No Subclass (0x00)
bInterfaceProtocol: 0x00
iInterface: 0
HID DESCRIPTOR
bLength: 9
bDescriptorType: 0x21 (HID)
bcdHID: 0x0111
bCountryCode: Not Supported (0x00)
bNumDescriptors: 1
bDescriptorType: HID Report (0x22)
wDescriptorLength: 156
ENDPOINT DESCRIPTOR
bLength: 7
bDescriptorType: 0x05 (ENDPOINT)
bEndpointAddress: 0x83 IN Endpoint:3
bmAttributes: 0x03
wMaxPacketSize: 64
bInterval: 6
ENDPOINT DESCRIPTOR
bLength: 7
bDescriptorType: 0x05 (ENDPOINT)
bEndpointAddress: 0x03 OUT Endpoint:3
bmAttributes: 0x03
wMaxPacketSize: 64
bInterval: 6
STRING DESCRIPTOR
Descriptor Index: 0x02
bLength: 22
bDescriptorType: 0x03 (STRING)
bString: Bootloader
HID Report Descriptor (looks wrong and cannot be parsed):
810600220100dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01600208c910020000000000100000020450020983d8160a95e8060395b80606016002000000000395b806060160020010000007751806020160020010000005951806020160020000000000000000000000000000000003951806020160020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Usual USB connection device mode (VID:18d1 PID:9400). Product string was changed to Stadia Controller rev. A after firmware update:
DEVICE DESCRIPTOR
bLength: 18
bDescriptorType: 0x01 (DEVICE)
bcdUSB: 0x0201
bDeviceClass: Miscellaneous (0xef)
bDeviceSubClass: 2
bDeviceProtocol: 1 (Interface Association Descriptor)
bMaxPacketSize0: 64
idVendor: Google Inc. (0x18d1)
idProduct: Unknown (0x9400)
bcdDevice: 0x0100
iManufacturer: 1
iProduct: 2
iSerialNumber: 3
bNumConfigurations: 1
CONFIGURATION DESCRIPTOR
bLength: 9
bDescriptorType: 0x02 (CONFIGURATION)
wTotalLength: 80
bNumInterfaces: 2
bConfigurationValue: 1
iConfiguration: 0
Configuration bmAttributes: 0x80 NOT SELF-POWERED NO REMOTE-WAKEUP
bMaxPower: 250 (500mA)
INTERFACE ASSOCIATION DESCRIPTOR
bLength: 8
bDescriptorType: 0x0b (INTERFACE ASSOCIATION)
bFirstInterface: 0
bInterfaceCount: 1
bFunctionClass: Vendor Specific (0xff)
bFunctionSubClass: 0x00
bFunctionProtocol: 0x00
iFunction: 0
INTERFACE DESCRIPTOR (0.0): class Vendor Specific
bLength: 9
bDescriptorType: 0x04 (INTERFACE)
bInterfaceNumber: 0
bAlternateSetting: 0
bNumEndpoints: 2
bInterfaceClass: Vendor Specific (0xff)
bInterfaceSubClass: 0x00
bInterfaceProtocol: 0x00
iInterface: 0
ENDPOINT DESCRIPTOR
bLength: 7
bDescriptorType: 0x05 (ENDPOINT)
bEndpointAddress: 0x87 IN Endpoint:7
bmAttributes: 0x02
wMaxPacketSize: 512
bInterval: 0
ENDPOINT DESCRIPTOR
bLength: 7
bDescriptorType: 0x05 (ENDPOINT)
bEndpointAddress: 0x07 OUT Endpoint:7
bmAttributes: 0x02
wMaxPacketSize: 512
bInterval: 0
INTERFACE ASSOCIATION DESCRIPTOR
bLength: 8
bDescriptorType: 0x0b (INTERFACE ASSOCIATION)
bFirstInterface: 1
bInterfaceCount: 1
bFunctionClass: HID (0x03)
bFunctionSubClass: 0x00
bFunctionProtocol: 0x00
iFunction: 0
INTERFACE DESCRIPTOR (1.0): class HID
bLength: 9
bDescriptorType: 0x04 (INTERFACE)
bInterfaceNumber: 1
bAlternateSetting: 0
bNumEndpoints: 2
bInterfaceClass: HID (0x03)
bInterfaceSubClass: No Subclass (0x00)
bInterfaceProtocol: 0x00
iInterface: 0
HID DESCRIPTOR
bLength: 9
bDescriptorType: 0x21 (HID)
bcdHID: 0x0111
bCountryCode: Not Supported (0x00)
bNumDescriptors: 1
bDescriptorType: HID Report (0x22)
wDescriptorLength: 156
ENDPOINT DESCRIPTOR
bLength: 7
bDescriptorType: 0x05 (ENDPOINT)
bEndpointAddress: 0x83 IN Endpoint:3
bmAttributes: 0x03
wMaxPacketSize: 64
bInterval: 6
ENDPOINT DESCRIPTOR
bLength: 7
bDescriptorType: 0x05 (ENDPOINT)
bEndpointAddress: 0x03 OUT Endpoint:3
bmAttributes: 0x03
wMaxPacketSize: 64
bInterval: 6
STRING DESCRIPTOR
Descriptor Index: 0x02
bLength: 50
bDescriptorType: 0x03 (STRING)
bString: Stadia Controller rev. A
STRING DESCRIPTOR
Descriptor Index: 0x03
bLength: 30
bDescriptorType: 0x03 (STRING)
bString: 9B300YCAC6WMGT
New HID Report Descriptor after firmware update (added Volume Increment/Volume Decrement and Play/Pause buttons):
0x05, 0x01, // Usage Page (Generic Desktop Ctrls)
0x09, 0x05, // Usage (Game Pad)
0xA1, 0x01, // Collection (Application)
0x85, 0x03, // Report ID (3)
0x05, 0x01, // Usage Page (Generic Desktop Ctrls)
0x75, 0x04, // Report Size (4)
0x95, 0x01, // Report Count (1)
0x25, 0x07, // Logical Maximum (7)
0x46, 0x3B, 0x01, // Physical Maximum (315)
0x65, 0x14, // Unit (System: English Rotation, Length: Centimeter)
0x09, 0x39, // Usage (Hat switch)
0x81, 0x42, // Input (Data,Var,Abs,No Wrap,Linear,Preferred State,Null State)
0x45, 0x00, // Physical Maximum (0)
0x65, 0x00, // Unit (None)
0x75, 0x01, // Report Size (1)
0x95, 0x04, // Report Count (4)
0x81, 0x01, // Input (Const,Array,Abs,No Wrap,Linear,Preferred State,No Null Position)
0x05, 0x09, // Usage Page (Button)
0x15, 0x00, // Logical Minimum (0)
0x25, 0x01, // Logical Maximum (1)
0x75, 0x01, // Report Size (1)
0x95, 0x0F, // Report Count (15)
0x09, 0x12, // Usage (0x12)
0x09, 0x11, // Usage (0x11)
0x09, 0x14, // Usage (0x14)
0x09, 0x13, // Usage (0x13)
0x09, 0x0D, // Usage (0x0D)
0x09, 0x0C, // Usage (0x0C)
0x09, 0x0B, // Usage (0x0B)
0x09, 0x0F, // Usage (0x0F)
0x09, 0x0E, // Usage (0x0E)
0x09, 0x08, // Usage (0x08)
0x09, 0x07, // Usage (0x07)
0x09, 0x05, // Usage (0x05)
0x09, 0x04, // Usage (0x04)
0x09, 0x02, // Usage (0x02)
0x09, 0x01, // Usage (0x01)
0x81, 0x02, // Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
0x75, 0x01, // Report Size (1)
0x95, 0x01, // Report Count (1)
0x81, 0x01, // Input (Const,Array,Abs,No Wrap,Linear,Preferred State,No Null Position)
0x05, 0x01, // Usage Page (Generic Desktop Ctrls)
0x15, 0x01, // Logical Minimum (1)
0x26, 0xFF, 0x00, // Logical Maximum (255)
0x09, 0x01, // Usage (Pointer)
0xA1, 0x00, // Collection (Physical)
0x09, 0x30, // Usage (X)
0x09, 0x31, // Usage (Y)
0x75, 0x08, // Report Size (8)
0x95, 0x02, // Report Count (2)
0x81, 0x02, // Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
0xC0, // End Collection
0x09, 0x01, // Usage (Pointer)
0xA1, 0x00, // Collection (Physical)
0x09, 0x32, // Usage (Z)
0x09, 0x35, // Usage (Rz)
0x75, 0x08, // Report Size (8)
0x95, 0x02, // Report Count (2)
0x81, 0x02, // Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
0xC0, // End Collection
0x05, 0x02, // Usage Page (Sim Ctrls)
0x75, 0x08, // Report Size (8)
0x95, 0x02, // Report Count (2)
0x15, 0x00, // Logical Minimum (0)
0x26, 0xFF, 0x00, // Logical Maximum (255)
0x09, 0xC5, // Usage (Brake)
0x09, 0xC4, // Usage (Accelerator)
0x81, 0x02, // Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
0x05, 0x0C, // Usage Page (Consumer)
0x15, 0x00, // Logical Minimum (0)
0x25, 0x01, // Logical Maximum (1)
0x09, 0xE9, // Usage (Volume Increment)
0x09, 0xEA, // Usage (Volume Decrement)
0x75, 0x01, // Report Size (1)
0x95, 0x02, // Report Count (2)
0x81, 0x02, // Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
0x09, 0xCD, // Usage (Play/Pause)
0x95, 0x01, // Report Count (1)
0x81, 0x02, // Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
0x95, 0x05, // Report Count (5)
0x81, 0x01, // Input (Const,Array,Abs,No Wrap,Linear,Preferred State,No Null Position)
0x85, 0x05, // Report ID (5)
0x06, 0x0F, 0x00, // Usage Page (PID Page)
0x09, 0x97, // Usage (0x97)
0x75, 0x10, // Report Size (16)
0x95, 0x02, // Report Count (2)
0x27, 0xFF, 0xFF, 0x00, 0x00, // Logical Maximum (65534)
0x91, 0x02, // Output (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0xC0, // End Collection
// 182 bytes
Same report descriptor is used for Bluetooth HID over GATT connection.
USB COMPOSITE DEVICE device mode (VID:15a2 PID:0073) - after first stage of firmware update:
DEVICE DESCRIPTOR
bLength: 18
bDescriptorType: 0x01 (DEVICE)
bcdUSB: 0x0200
bDeviceClass: Device (0x00)
bDeviceSubClass: 0
bDeviceProtocol: 0 (Use class code info from Interface Descriptors)
bMaxPacketSize0: 64
idVendor: Freescale Semiconductor, Inc. (0x15a2)
idProduct: Unknown (0x0073)
bcdDevice: 0x0002
iManufacturer: 1
iProduct: 2
iSerialNumber: 0
bNumConfigurations: 1
CONFIGURATION DESCRIPTOR
bLength: 9
bDescriptorType: 0x02 (CONFIGURATION)
wTotalLength: 41
bNumInterfaces: 1
bConfigurationValue: 1
iConfiguration: 0
Configuration bmAttributes: 0xc0 SELF-POWERED NO REMOTE-WAKEUP
bMaxPower: 50 (100mA)
CONFIGURATION DESCRIPTOR
bLength: 9
bDescriptorType: 0x02 (CONFIGURATION)
wTotalLength: 41
bNumInterfaces: 1
bConfigurationValue: 1
iConfiguration: 0
Configuration bmAttributes: 0xc0 SELF-POWERED NO REMOTE-WAKEUP
bMaxPower: 50 (100mA)
INTERFACE DESCRIPTOR (0.0): class HID
bLength: 9
bDescriptorType: 0x04 (INTERFACE)
bInterfaceNumber: 0
bAlternateSetting: 0
bNumEndpoints: 2
bInterfaceClass: HID (0x03)
bInterfaceSubClass: No Subclass (0x00)
bInterfaceProtocol: 0x00
iInterface: 3
HID DESCRIPTOR
bLength: 9
bDescriptorType: 0x21 (HID)
bcdHID: 0x0100
bCountryCode: Not Supported (0x00)
bNumDescriptors: 1
bDescriptorType: HID Report (0x22)
wDescriptorLength: 76
ENDPOINT DESCRIPTOR
bLength: 7
bDescriptorType: 0x05 (ENDPOINT)
bEndpointAddress: 0x81 IN Endpoint:1
bmAttributes: 0x03
wMaxPacketSize: 1016
bInterval: 3
ENDPOINT DESCRIPTOR
bLength: 7
bDescriptorType: 0x05 (ENDPOINT)
bEndpointAddress: 0x02 OUT Endpoint:2
bmAttributes: 0x03
wMaxPacketSize: 1016
bInterval: 3
STRING DESCRIPTOR
Descriptor Index: 0x02
bLength: 42
bDescriptorType: 0x03 (STRING)
bString: USB COMPOSITE DEVICE
HID Report Descriptor:
0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00)
0x09, 0x01, // Usage (0x01)
0xA1, 0x01, // Collection (Application)
0x85, 0x01, // Report ID (1)
0x19, 0x01, // Usage Minimum (0x01)
0x29, 0x01, // Usage Maximum (0x01)
0x15, 0x00, // Logical Minimum (0)
0x26, 0xFF, 0x00, // Logical Maximum (255)
0x75, 0x28, // Report Size (40)
0x95, 0xCB, // Report Count (-53)
0x91, 0x02, // Output (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x02, // Report ID (2)
0x19, 0x01, // Usage Minimum (0x01)
0x29, 0x01, // Usage Maximum (0x01)
0x15, 0x00, // Logical Minimum (0)
0x26, 0xFF, 0x00, // Logical Maximum (255)
0x75, 0x28, // Report Size (40)
0x95, 0xCB, // Report Count (-53)
0x91, 0x02, // Output (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position,Non-volatile)
0x85, 0x03, // Report ID (3)
0x19, 0x01, // Usage Minimum (0x01)
0x29, 0x01, // Usage Maximum (0x01)
0x15, 0x00, // Logical Minimum (0)
0x26, 0xFF, 0x00, // Logical Maximum (255)
0x75, 0x28, // Report Size (40)
0x95, 0xCB, // Report Count (-53)
0x81, 0x02, // Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
0x85, 0x04, // Report ID (4)
0x19, 0x01, // Usage Minimum (0x01)
0x29, 0x01, // Usage Maximum (0x01)
0x15, 0x00, // Logical Minimum (0)
0x26, 0xFF, 0x00, // Logical Maximum (255)
0x75, 0x28, // Report Size (40)
0x95, 0xCB, // Report Count (-53)
0x81, 0x02, // Input (Data,Var,Abs,No Wrap,Linear,Preferred State,No Null Position)
0xC0, // End Collection
// 76 bytes