PC as SIXAXIS Joystick

Technical discussion on the newly released and hard to find PS3.

Moderators: cheriff, emoon

cssvb94
Posts: 5
Joined: Tue Nov 25, 2008 12:58 am

PC as SIXAXIS Joystick

Post by cssvb94 »

Hi,
I have an idea to use laptop/pc as USB or BT joystick or in other words to turn your PC to SIXAXIS Joystick.
Why?
1. Because aiming in FPS is painful and not accurate. Much easier to use mouse as analog stick and keyboard to move around, scroll weapons ... remap kbd keys to joystick keys.
2. Because existing hardware devices are expensive, more than $120 and because all we have this equipment laying around.
3. Proof of concept =P

I googled for information, but couldn't find anything useful.

How can I do that?
acxie
Posts: 6
Joined: Thu Apr 30, 2009 7:11 am

Post by acxie »

you can reference www.motioninjoy.com
jimparis
Posts: 1145
Joined: Fri Jun 10, 2005 4:21 am
Location: Boston

Post by jimparis »

That site is useless for what he asked.
To answer the original poster (late): yes, it's possible, I've emulated a Sixaxis from a PC via Bluetooth. The key is to:
  • pair a real sixaxis with the PS3 and turn the sixaxis off
  • set your PC bluetooth dongle to have the sixaxis's MAC address
  • set bluetooth dongle in slave mode, piscan, class 0x000508
  • connect to PS3 over L2CAP psm 17 and 19
  • talk as if you're a sixaxis (sniff/intercept real traffic to see details)
someday I'll post my code if there's interest..
Brandon
Posts: 17
Joined: Tue Dec 11, 2007 8:34 pm

Post by Brandon »

please post it if you can, I wanted to do something like that but I know little about bluetooth, something to start with would be nice
jimparis
Posts: 1145
Joined: Fri Jun 10, 2005 4:21 am
Location: Boston

Post by jimparis »

Well, what I posted there is certainly enough to get started :)
The only trick part is setting the MAC address of your bluetooth dongle, which is somewhat specific to the chip you have. Once you do that, you can use a pybluez program like this to test the connection to ps3:

Code: Select all

#!/usr/bin/python
import sys
import bluetooth
import time

ctrl=bluetooth.BluetoothSocket(bluetooth.L2CAP)
intr=bluetooth.BluetoothSocket(bluetooth.L2CAP)

if len&#40;sys.argv&#41; < 2&#58;
    print "usage&#58; btclient.py <addr>"
    sys.exit&#40;2&#41;

bt_addr=sys.argv&#91;1&#93;

port = 17
print "trying to connect to %s on PSM 0x%X &#40;ctrl&#41;" % &#40;bt_addr, port&#41;
ctrl.connect&#40;&#40;bt_addr, port&#41;&#41;
port = 19
print "trying to connect to %s on PSM 0x%X &#40;intr&#41;" % &#40;bt_addr, port&#41;
intr.connect&#40;&#40;bt_addr, port&#41;&#41;

print "connected. sleeping 10"
time.sleep&#40;10&#41;;

ctrl.close&#40;&#41;
intr.close&#40;&#41;
if that works then you're ready to actually start emulating the sixaxis!
Brandon
Posts: 17
Joined: Tue Dec 11, 2007 8:34 pm

Post by Brandon »

thank you very much! I'll try it later
cssvb94
Posts: 5
Joined: Tue Nov 25, 2008 12:58 am

Post by cssvb94 »

@jimparis - Thank you

Is there full guide and software?
How to get PS3SixAxis Joystick BT Address? - NVM I found the post for the address =)

Thanks again
jimparis
Posts: 1145
Joined: Fri Jun 10, 2005 4:21 am
Location: Boston

Post by jimparis »

I haven't posted the software yet, it's still a mess, but you should start with what I posted up there... if you get that much working then I'll be motivated to post the rest...
cssvb94
Posts: 5
Joined: Tue Nov 25, 2008 12:58 am

Post by cssvb94 »

@jimparis:
Hi,

I'll try to do my best to motivate you =)

OK, here is what I've achieved so far:
1. paired sixaxis with Linux(Ubuntu) in USB mode
2. tested joystick device - works fine
3. used sixpair to set master BT (i.e. Ubuntu)
4. paired sixaxis in BT mode with linux, /dev/input/js0 doesn't provide data to joytest app yet.
5. tried to find how to change BT Dongle MAC ADDR, no success so far, it's dongle specific, what tool did you use?
6. need sniffer or better - results for remapping the sixaxis buttons and axis to the computer's keyboard and mouse
7. need somebody or me to build GUI APP to send coresponding codes to PS3 for each mapped key.

I like Python too =)
For the app - in Linux will be much easier to be achieved at first then may be in Windows.

What do you think about connecting PC/Laptop to PS3 in USB mode?
Is it possible and much easier then in BT mode?
Any ideas?

Regards
Brandon
Posts: 17
Joined: Tue Dec 11, 2007 8:34 pm

Post by Brandon »

using that code alone I've managed to power on my ps3, unfortunately I get random kernel panic so I'm slowly going on

to change the bdaddr of your pc I've used this app http://www.siddharthabbineni.com/tech/h ... dress.html

since pybluez exists for windows too it should work fine on windows, the only problem is how to change the bdaddress from windows or maybe trying to register the original one with the ps3

for the gui I would go with pyqt and maybe pygame for the input
cssvb94
Posts: 5
Joined: Tue Nov 25, 2008 12:58 am

Post by cssvb94 »

@Brandon

Agree, pybluez & pygame can be used under win for that purpose.

btw, what did you do to power on your PS3, what code and how?

Thanks for the link =)
Brandon
Posts: 17
Joined: Tue Dec 11, 2007 8:34 pm

Post by Brandon »

I've just used the code posted by jimparis, there isn't any special command to send to power it on
Brandon
Posts: 17
Joined: Tue Dec 11, 2007 8:34 pm

Post by Brandon »

I'm stuck now :p that long string that I send to the ps3 should be like pressing the left d-pad but nothing happens on the ps3, I've compared the dump of a real sixaxis and the fake one and they almost look the same

Code: Select all

#!/usr/bin/python
# -*- coding&#58; utf-8 -*-
import sys
import bluetooth

ctrl=bluetooth.BluetoothSocket&#40;bluetooth.L2CAP&#41;
intr=bluetooth.BluetoothSocket&#40;bluetooth.L2CAP&#41;

if len&#40;sys.argv&#41; < 2&#58;
    print "usage&#58; btclient.py <addr>"
    sys.exit&#40;2&#41;

bt_addr=sys.argv&#91;1&#93;

port = 17
print "trying to connect to %s on PSM 0x%X &#40;ctrl&#41;" % &#40;bt_addr, port&#41;
ctrl.connect&#40;&#40;bt_addr, port&#41;&#41;
port = 19
print "trying to connect to %s on PSM 0x%X &#40;intr&#41;" % &#40;bt_addr, port&#41;
intr.connect&#40;&#40;bt_addr, port&#41;&#41;

state = 0
try&#58;
    while True&#58;
        if not state&#58;
            data = ctrl.recv&#40;1024&#41;
            if len&#40;data&#41;&#58;
                ctrl.send&#40;"00".decode&#40;"hex"&#41;&#41;
                state = 1
        else&#58;
            intr.send&#40;"A10100800000007D807E8000000000000000FF0000000000000000000000030516FFCD0000337F77018002070214019601E8".decode&#40;"hex"&#41;&#41;
finally&#58;
    ctrl.close&#40;&#41;
    intr.close&#40;&#41;

jimparis
Posts: 1145
Joined: Fri Jun 10, 2005 4:21 am
Location: Boston

Post by jimparis »

Ok ok, here you go. Brandon, that's close, except there's some initialization, which is roughly:
  • HID_GET_REPORT for feature 0x01
  • HID_GET_REPORT for feature 0xf2
  • HID_SET_REPORT for feature 0xef
  • HID_GET_REPORT for feature 0xef
  • HID_SET_REPORT for feature 0xef
  • HID_GET_REPORT for feature 0xef
  • HID_DATA for feature 0xef (works like HID_SET_REPORT)
  • HID_GET_REPORT for feature 0xf8
  • HID_SET_REPORT for output 0x01
  • HID_SET_REPORT for feature 0xf4
And the contents of course matter... for feature 0x01, 0xf2, 0xf8 I just send back static data copied from a Sixaxis. For feature 0xef, it's mostly static except for some data that the PS3 changes with the SETs (and you need to reply with the changed data for the PS3 to be happy). Output 0x01 is rumble & LEDs. 0xf4 is how the PS3 enables event reporting, at which point you can start sending the input report 0x01 that you have.

Interestingly, the PS3 never does SDP or asks for the HID report descriptor, or anything else. That explains why the report descriptor is so broken -- the PS3 never even uses it, so it probably was just thrown together without much care.

I started out writing this in python for ease of implementation, but I ran into problems where I think things weren't getting cleaned up properly. After I connected to the PS3 about 2-3 times and then killed the program, the hypervisor would crash (!) (even holding the power button for 15 seconds wouldn't do anything). So I reimplemented it in C, and also split it into a client/server architecture -- the server process "emu" connects to the PS3 and maintains the connection. The client process "emuclient" is a simple SDL app that connects to the server and sends keypress data which gets translated into sixaxis input. The idea for separating these was so that I could have a persistent process connected to the PS3 with a web-based frontend for control, which I haven't gotten around to writing yet.

The code is available via SVN at
https://jim.sh/svn/jim/devl/playstation ... is/bt/emu/

This is still a work in progress! I'm thinking of changing the protocol between client/server to make it a little more robust and standard, but it works well enough to use for now.

I also need to do more research to figure out the proper frequency of reports to send. The sixaxis is roughly 10ms between reports, but they're in sync with the PS3 somehow and I haven't figured that out. In this code, I'm using 20ms delay which seems to work pretty reliably. Getting it to precisely match a Sixaxis would be really useful if you want to make a "man-in-the-middle" type device that would allow a computer to manipulate real Sixaxis input before sending it to the PS3. (Just imagine all the cool tricks you could do with that while playing games...)

edit: fixed URL
Last edited by jimparis on Thu May 21, 2009 6:23 pm, edited 1 time in total.
jonathan
Posts: 23
Joined: Fri Sep 21, 2007 12:18 pm
Location: Tasmania, Australia

Post by jonathan »

jimparis wrote:Getting it to precisely match a Sixaxis would be really useful if you want to make a "man-in-the-middle" type device that would allow a computer to manipulate real Sixaxis input before sending it to the PS3. (Just imagine all the cool tricks you could do with that while playing games...)
Autofire switch! :p
jimparis
Posts: 1145
Joined: Fri Jun 10, 2005 4:21 am
Location: Boston

Post by jimparis »

Doh, wrong url (wrote http instead of https). The correct address is:
https://jim.sh/svn/jim/devl/playstation ... is/bt/emu/
cssvb94
Posts: 5
Joined: Tue Nov 25, 2008 12:58 am

Post by cssvb94 »

@jimparis & @Brandon

Thanks guys, works perfectly.
The last thing is emuclient to read all the settings from config file and to be able to map mouse movement to one of the axis controllers.

Great job
User avatar
hardhat
Posts: 17
Joined: Thu Mar 02, 2006 9:42 am
Contact:

Post by hardhat »

I'll defiantely give this a try. I have been working on making a PC -> serial -> USB gateway hardware device, but this is much more elegant, in my opinion.
Brandon
Posts: 17
Joined: Tue Dec 11, 2007 8:34 pm

Post by Brandon »

hardhat wrote:I'll defiantely give this a try. I have been working on making a PC -> serial -> USB gateway hardware device, but this is much more elegant, in my opinion.
yeah it works very well, the only problem is the mouse->axis mapping, I can't find a way to make it smooth and accurate, if I have time I'll put the code on google code in the next days
Brandon
Posts: 17
Joined: Tue Dec 11, 2007 8:34 pm

Post by Brandon »

I've uploaded the code at http://code.google.com/p/hidemulator/so ... nk/pair.py
it's mostly based on jimparis code
bass
Posts: 1
Joined: Wed Jun 17, 2009 6:19 pm

Post by bass »

Hello!
This project seems really cool.. :)

I have one question and one idea for you..

First off the question, can anyone recommend a BT-adapter with the "right" chipset, that allows the BDADDR change? My dlink/broadcom wont work.


Next up, the problem with the mouse mapping..
Have you checked the XIM project?
http://obsiv.spaces.live.com/
They also link to this page:
http://www.gamesx.com/controldata/psxcont/psxcont.htm

Maybe theres some good info there...
At the moment I dont have the time to research this myself but Ill do my best if I just can get ahold of a damn BT-dongle :P

take care,
bass
Brandon
Posts: 17
Joined: Tue Dec 11, 2007 8:34 pm

Post by Brandon »

Unfortunately I have no idea what adapters works with the bdaddr app, it works for me on the notebook with the integrated bluetooth module, hciconfig says it's from broadcom, but it doesn't work with my dlink broadcom usb dongle

thanks for the links, I'll take a look at them
Brandon
Posts: 17
Joined: Tue Dec 11, 2007 8:34 pm

Post by Brandon »

also I was thinking for a way to use it without changing the bdaddr, the ps3 can be paired with other devices like bluetooth headsets, so maybe we can do a fake pair with the ps3 and then we can connect as a sixaxis even if we paired as something else
jimparis
Posts: 1145
Joined: Fri Jun 10, 2005 4:21 am
Location: Boston

Post by jimparis »

Brandon wrote:also I was thinking for a way to use it without changing the bdaddr, the ps3 can be paired with other devices like bluetooth headsets, so maybe we can do a fake pair with the ps3 and then we can connect as a sixaxis even if we paired as something else
All we need is an app for e.g. the PSP to simulate a Sixaxis controller, then we can pair with any MAC address we choose. The recent work from hnaves should make that easy.
Brandon
Posts: 17
Joined: Tue Dec 11, 2007 8:34 pm

Post by Brandon »

but that would require a psp, wouldn't be easy at that point to use an usb cable to connect the pc with the ps3 and register the mac address like a normal sixaxis?
jimparis
Posts: 1145
Joined: Fri Jun 10, 2005 4:21 am
Location: Boston

Post by jimparis »

A PC is not a USB gadget so that would not work.
Brandon
Posts: 17
Joined: Tue Dec 11, 2007 8:34 pm

Post by Brandon »

unfortunately the XIM project is not open source and the developer is not willing to release the code, at least from what I've read in the forum, but I could try to email him and ask some advice
jimparis
Posts: 1145
Joined: Fri Jun 10, 2005 4:21 am
Location: Boston

Post by jimparis »

The XIM project is not very useful here. It uses a microcontroller to emulate the PS2 protocol which is then adapted to the Xbox with a commercially-available adapter. None of that would allow you to emulate the PS3 pairing protocol; you will need to program a USB gadget device to do that.
Brandon
Posts: 17
Joined: Tue Dec 11, 2007 8:34 pm

Post by Brandon »

yeah but bass suggested it because it seems like it has a good mouse->axis mapping
huanmengQQ
Posts: 7
Joined: Sun Aug 30, 2009 6:01 pm

My question

Post by huanmengQQ »

Hello everyone!

I just also want to use the PC as the joystick to control the PS3.So we studied the sixaxis's HID descriptor and use the format to send the data to the PS3.The data is:
char report_1[50]={
0xA1,0x01,0x00,0x80,0x00,0x00,0x00,0x80,0x80,0x80,
0x80,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x7f,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x03,0x05,0x16,0x00,0x00,0x00,0x00,0x33,0x02,0x77,
0x01,0x9E,0x02,0x08,0x01,0xF2,0x01,0x93,0x00,0x02};
char report_2[50]={
0xA1,0x01,0x00,0x00,0x00,0x00,0x00,0x80,0x80,0x80,
0x80,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x03,0x05,0x16,0x00,0x00,0x00,0x00,0x33,0x02,0x77,
0x01,0x9E,0x02,0x08,0x01,0xF2,0x01,0x93,0x00,0x02};

The report_1 emulate that we press the <-,and the report_2 emulate that we release the button.
But it didn't work.I really don't why,who can help me?

PS:I also downloaded the jimparis's source code ,but it also didn't work!The message is
emu: can't connect to 00:23:06:8A:22:7B psm 17: Host is down
also
emu: can't connect to 00:23:06:8A:22:7B psm 17: Connection timed out

How should i do?

Please help me!Thanks in advance.

Sorry for my poor English.
Everyone is NO.1
Post Reply