Dolphin, the GameCube and Wii emulator - Forums

Full Version: Wiimote firmware corruption?
You're currently viewing a stripped down version of our content. View the full version with proper formatting.
Pages: 1 2
Unsure if this belongs in this forum section since it isn't related only to Dolphin, but here we go...

I think I somehow managed to corrupt Wiimote's firmware. Let me explain: I have two genuine Wiimotes, one regular wiimote (without Motion Plus) and one Wii Remote Plus (a non -TR one, from Flingsmash bundle) and about two weeks ago they were working perfectly, without any problem, no random disconnects, all extensions (even some 3rd party) detected, etc. Didn't use them until today, when I noticed that they are working strangely now...

The one without Motion Plus looks like it's completely dead when not connected, pressing any button won't do anything, except for the red sync button on back, that makes it blink and become discoverable, but I remember that when it worked normally, pressing any button would make it blink and try to reconnect to the last paired device. If connected alone, it works in Dolphin and in GlovePIE, but no extensions will work anymore (tested with a genuine Nunchuck and Classic Controller), for Dolphin games it's like nothing is connected, GlovePIE detect that a extension is attached but can't read any data from it. If connected together with the wii Remote Plus, then it'll not respond once connected...

The one with Motion Plus inside doesn't show any strange behavior when not connected, but once connected it doesn't respond, in any app at all. Connecting it alone doesn't change anyhting...

I tried in other computers/laptops, tried in fresh Windows 7/8/8.1 and Ubuntu 12.10/13.10 installs, tried with other BT dongles (even and old one that worked fine), tried Microsoft/Toshiba/Widcomm BT stacks and tried even with some Android apps, in all cases they don't respond once connected anymore...

Using Dolphin builds before wiimote fixes made by Biliard will connect to them just fine and pressing refresh will make them vibrate and Dolphin will assign a LED to them, but once you boot a game the statusbar will say "Wiimote disconnected" and the game will ask to connect a wiimote (pressing Alt+F5/Alt+F6 doesn't reconnect them). Using current Dolphin builds the wiimotes aren't found, and pressing refresh in wiimote settings while they are discoverable will make Dolphin freeze for around 30 secs (but no crash) and then nothing. Continuous scanning option makes Dolphin randomly crash if they're discoverable...

In GlovePIE, when you start a script, the 1st and the 4th LEDs will be lit for around 2 secs and then they'll be defined accordingly to the script (the default is the first LED on and all others off) and both worked like that before this problem, now they'll freeze in the 1st and 4th LED on and nothing more if I connect the two at the same time or if I connect only the Wii Remote Plus. If I connect only the regular wiimote, it'll work but no data can be read from attached extensions...

In Android apps you can set the LEDs, read button presses and make them vibrate, but no accelerometer data/IR tracking/EEPROM reads works...

I would like to know how it would behave in a real Wii in that state but my Wii broke and I can't test anymore...

I also found that if I connect only the wiimote without Motion Plus, they will work fine, but every time that you open Mii Channel, for example, it'll say that the Wiimote memory must be formatted, but it'll always fail. Before this started happening, I could successfully transfer Mii's between my computer/my laptop/real Wii without problems, and now they don't work anymore.

So, a summary: the two wiimotes were working flawlessly but now they'll not respond once connected. The regular Wiimote works if connected alone but it's memory always ask to be formatted in Mii Channel and no extensions are detected anymore. The Wii Remote Plus will not respond once connected in any case...

Googling on WiiBrew I found that Wiimote's EEPROM also contains parts of the firmware, and seen that Mii Channel always complain about it needing to be formatted I suspect that somehow I may have managed to corrupt it. Any clues on what I could do now to get them working again? I'm considering anything, even messing with the Wiimote hardware itself (aka manually editing EEPROM contents) since in the current state they doesn't allow doing anything useful...
Any button making LEDs blink vs. only sync button making LEDs blink is related to whether or not the wiimote is paired with a "wii".
I've also seen wiimotes behave differently based on whether or not they are "paired".
I have encountered problems like this with a -TR. The solution in that case was to pair it to a real wii. In an alternate case where someone had the issue and didn't have a wii, they got it to work via wii pair. Try that.

*MaJoR is too lazy to search the forum and find the links to those threads*
Tried with wiipair, the wiimote gets paired but the same thing, once connected, no app respond. Using this .NET app with the regular Wiimote it can read all data, but when I plug any extension it instantly crashes. Using it with the Wii Remote Plus will trow an exception when you open the app and the log outputs this:
Code:
WiimoteLib.WiimoteException: Error reading data from Wiimote...is it connected?
   at WiimoteLib.Wiimote.ReadData(Int32 address, Int16 size)
   at WiimoteLib.Wiimote.ReadWiimoteCalibration()
   at WiimoteLib.Wiimote.OpenWiimoteDeviceHandle(String devicePath)

Seen that the regular Wiimote always ask to be formatted in Mii Channel, and knowing that calibration data resides in EEPROM, would missing calibration data be the cause of that problems with the Wii Remote Plus?
It sounds like both of them have had more than just their calibration data/save data wiped. The only way to fix them would be to manually reflash with a programmer, since you can't access the firmware portions of the EEPROM over bluetooth.
Any idea what might have caused it?
I don't remember, they were just working the last time I used (around 2-3 weeks ago) and now I noticed this. I also went on vacation, so its possible that someone did something with them while I was traveling... About reflashing the EEPROM manually, my friend have a EEPROM writer that seems to be compatible with the chip used by the remote...

My only concern is about that "calibration data": this differs between remotes or it's always the same? Also, if I flash an EEPROM dump from a regular Wiimote into the Wii Remote Plus (a non -TR one), it'll lost its Motion Plus functionality?
The calibration data is different for every wiimote. You'd have to get the wiimote running properly first, then do tests to find the right values and write them to the EEPROM. But that part at least can be done via software.
For the firmware you'd need to use a source dump from the same type of wiimote. You'd need to fix up the MAC addresses, having multiple wiimotes with the same address wouldn't work out too well. I think the best way to proceed would be to dump the damaged firmware before writing anything and compare it to undamaged firmware to try and figure out exactly what's wrong.
Well, thanks for the info, I'll see what I can do and post any progress here...

EDIT: the thing is getting weird... Installed cwiid and wmgui in Ubuntu 12.10 and managed to connect the regular wiimote and use all features (IR, accelerometer, buttons, EEROM, etc), except extensions. All user-portion from the EEPROM (around 4kb) that can be read while connected through bluetooth can be accessed and from the dump I got, all data that should be there is there and isn't corrupt (two sets of calibration data, working Mii data, etc). Using wmgui with the Wii Remote Plus worked too, and all features were acessible normally, the only weird thing is that a lot of "Invalid packet type" popped in the console while using wmgui with the Wii Remote Plus. So, I think it isn't necessary to use an EEPROM programmer to read the entire 16 kb of data, since that data isn't corrupt (as I wondered in the beggining). Does anyone know if there is something in the EEPROM that controls the packet format that the wiimote will use to communicate and that may have changed?

EDIT 2: the regular Wiimote now tries to recconect the last used device when pressing any button while it's disconnected, like how it worked before these problems...

EDIT 3: after many hours messing with some Linux tools, the regular Wiimote is working fine now. Can't say what I did exactly, but seems that after backing up the EEPROM area that can be accessed through bluetooth in wmgui, zeroing the entire area and restoring only the calibration data (and the misterious sequence of bytes present in the very end) did the trick. Tried the same thing with the Wii Remote Plus, but didn't work: in apps that seems to ignore the packet type (like wmgui and TransferMii -- they just throw an warning in the console) everything works. In Dolphin and GlovePIE it get connected, but after that nothing happens because it's sending the wrong packet type (I assume), and Dolphin/GlovePIE seems to ignore these packets...

EDIT 4: FINALLY got the Wii Remote Plus working again. tueidj was right, something wiped a few bytes of the EEPROM. Accordingly to WiiBrew, EEPROM address range 0x0000 to 0x1700 can be freely read/written by BT device that can communicate with the remotes. On a virgin Wiimote, in the beginning of that area we will have calibration values (unique to each Wiimote) and the rest will be entirely blank, except by a small sequence of bytes at the very end (starts in 16D3). Comparing the EEPROM dump of my regular Wiimote, the sample available at WiiBrew and the full dump done by Sparkfun, this area is always the same in different Wiimotes, and only 3 bytes have unique values:
Code:
16D0: 00 00 00 FF 11 EE 00 00  33 CC 44 BB 00 00 66 99
16E0: 77 88 00 00 xx 01 xx xx  00 00 00 00 00 00 00 00

Despite of the "Invalid packet type" warnings, wmgui still allowed me to freely read/write in the EEPROM of the problematic Wii Remote Plus. The EEPROM of that Wiimote had all data present in a virgin Wiimote (including its unique calibration values) plus some Mii data I saved to them. However, in the sequence of bytes present in the very end, I noticed that 4 bytes were missing (the ones marked with YY), instead of the common values, they were zeroed:
Code:
16D0: 00 00 00 FF 11 EE 00 00  33 CC 44 BB 00 00 yy yy
16E0: yy yy 00 00 xx 01 xx xx  00 00 00 00 00 00 00 00

Since in that sequence of bytes only the XX's are unique to each device, I replaced the zeroed bytes (YY's) with the common data found in the other wiimotes and left the XX's intact. After writing them to the Wii Remote Plus, I disconnected it from the computer, pulled the batteries, put them back and reconnected. This time I didn't get any "Invalid packet type" warnings (YAY!) and now it's working fine in all apps I tested (including Dolphin and GlovePIE, like before this weird issue) Tongue

I really don't have any idea of what caused this wipe, but it isn't too hard to fix at all if this happens to someone else. This info may be useful for some dev too, after all, even in WiiBrew and some other sites the only info I got about this portion of the EEPROM is that it contains "unknown data"...
That is pretty interesting... I might have a play around with those bytes and see if I can recreate the "invalid packet type" errors to try and figure out exactly what the meaning of that data is. I'd assumed the xx bytes were some form of checksum over the whole EEPROM (including the bytes at the beginning which aren't accessible over BT, containing the wiimote's BT addr and the paired wii's BT addr).
So I checked all three of my (perfectly working) wiimotes and they all have zeroes for the yy data...
Pages: 1 2