Wiimote Hacking: Barking up the wrong PIN
I’m happy (though slightly contrite) to report that some of my previous posts have been totally misguided. While a nice motivation to immerse myself in the Bluetooth documentation, I have since learned at the WiiLi wiki that the Wiimote is in fact a normal HID device that requires no authentication at all.
I discovered that page on the Wiimote while booted into the most excellent Mactel Linux Live CD (based off a dev version of Ubuntu). I was finally able to diddle around with the bluez-utils and got no further than I did in OS X until I ran the magic hidd --search command. This discovered the Wiimote while it was in sync mode, and suddenly I had some communication. The Wiimote now stayed in the state with all four player LEDs blinking indefinitely. Pressing buttons (and the D-pad) now resulted in actual packets, which I could see with hcidump. The power button is special, and did not appear to send a standard packet, though I didn’t investigate that much. Shaking the remote and aiming the IR sensor at light bulbs did not generate any packets, so those features (along with the speaker) must require some sort of query by the host. I was just about to run some test code using libhid to see if I could read the events out of the HID interface, when the bluetooth driver fell over somehow and I could no longer see the local Bluetooth device.
After the reboot, I’ve been trying to understand why I cannot get a similar response from the Bluetooth drivers in OS X. The only possible initial steps seem to be:
- Open System Preferences
- Select Bluetooth
- Click Devices tab and and Setup New Device button
- Pick Any Device option and click Continue
- Click Passkey Options button and select “Do not use a passkey with this device”.
- Press 1 and 2 button on Wiimote
- Nintendo RVL-CNT-01 shows up in Device listing. Double click to select and continue.
- There is a short pause while information is gathered about the device.
- Click Continue.
- You are told “Congratulations! Your computer is now setup to use your Bluetooth device.”
But then when you Quit the Setup Assistant, you see no devices in the list. I interpreted this to mean the device really was not setup and I should investigate the other options. After playing with Linux, though, it looks more like the problem is that the HID Manager was not activated while the Wiimote was in discoverable mode. In Linux, you activate it with the hidd command, but I can’t see what the equivalent is for OS X.
Once I can figure out how to do that, the Wiimote should also lock on like it did in Linux, and I can finally start doing something interesting with this hardware.
It’s good to know that Nintendo did not go all crazy with the Wiimote communication and actually followed several standards (even if I was too paranoid to notice).