Wiimote Hacking: Plan of Attack
(Update: Totally missed the boat on this one. See this post for more information.)
In the previous post, I discovered that none of the easy options for pairing the Wiimote with a computer will work. Now we need to stop and review what we know:
- The Wiimote so far appears to be a standard Bluetooth device.
- The Wiimote and the Wii can be paired by pressing nothing more than the sync button on both devices.
- Empty PIN, no PIN, and obvious 4-digit fixed pins (0000, 1111, 1234, 8888) also do not work.
Based on this we can guess at a few scenarios:
- The Wiimote does use a fixed PIN, but it is some difficult to guess number, either randomly chosen or selected to have some significance to a Nintendo engineer.
- The Wiimote may or may not use a fixed PIN, but has been designed to only pair with a device that “looks like” a Wii. Before pairing, it is possible for both devices to get the name and service description of the device at the other end. So it is possible that if a device does not report itself to be a Wii with specific services, the Wiimote will refuse to pair, no matter what PIN is used.
- The Wiimote generates the link key with the Wii in some custom way that we cannot easily duplicate with standard Bluetooth drivers.
These scenarios are listed in ascending levels of hopelessness. Even gathering information about scenario 2 and 3 will require me to get near a Wii base unit to observe how it interacts with the controller. Since that is not possible for now, I will focus on scenario 1.
Of course, scenario 1 is not necessarily easy either. While traditionally devices only use 4-decimal digit PINs, a Bluetooth PIN can be anywhere from 8 to 128 bits in length (3 to 39 decimal digits). With a hardcoded PIN on controller and base, Nintendo would not have much reason to limit itself to the traditional 4 digit PIN and could easily use all 128 bits if they wanted. All of the Bluetooth PIN attack methods I can find or imagine are variants of a brute force attack, which becomes effectively impossible if Nintendo used anywhere near the maximum number of bits in the PIN.
Without any evidence of Nintendo’s paranoia level, we can only barge ahead and try the easy things first, and hope we get lucky.