Extensions
From Wiimote Wiki
Contents |
Memory Map
From a software standpoint, extensions are accessed through register addresses 0xA40000 - 0xA400FF. These registers are mirrored every 0x100 bytes up to 0xA5FFFF. For official extensions, the layout of this address range is:
| Register Memory Map | |
| 0xA40000 | Unknown/Not Used |
| 0xA40007 | |
| 0xA40008 | Input Data |
| 0xA4000D | |
| 0xA4000E | Unknown |
| 0xA4001F | |
| 0xA40020 | Calibration |
| 0xA4002F | |
| 0xA40030 | Calibration (Backup) |
| 0xA4003F | |
| 0xA40040 | Encryption Key |
| 0xA400F0 | Unknown |
| 0xA400FD | |
| 0xA400FE | Identifier |
| 0xA400FF | |
Known Identifiers
| 00 00 | Nunchuck |
| 01 01 | Classic Controller |
| 01 03 | Guitar |
Encryption
Official extensions encrypt their output, using a single-byte key written to 0xA40040. The general algorithm used for this encryption is unknown. However, when the key is 0x00, the output bytes can be decrypted using the following formula:
P = ((C ⨁ 0x17) + 0x17) mod 0x100
In C-like languages, this can be implemented as:
out = ((in ^ 0x17) + 0x17) & 0xFF
Further research into this encryption algorithm, while welcome, is not encouraged. There are other unknowns of much greater significance that could be worked on instead.
Communication Protocol
| The following section or page relates to parts of the Wii Remote that are poorly understood. Research and contribution in these areas is encouraged. |
The extension is connected to the Wii Remote via an I²C bus with a nominal bit rate of 400kbit/sec. Commands are sent to device ID 0x52.
When handling a write to the extension address range ???
When handling a read from the extension address range ???
When filling in a User Input report, the Wii Remote writes a single byte, 0x00, and then issues 1 - 3 reads to fill the report field with all but the last read being 8 bytes.
