PlayStation 3 Bluetooth Remote

[gechu]

2013-02-10 Added a couple of widcomm source files which for example is useful for understanding how to call the sniff function.
2013-02-07 Now I┬┤m quite certain I have something that works. The issue was that I added the wrong bluetooth address. How to locate the correct one is now available in this guide.
2013-02-04, Sorry for the confusion. Even though I can trace the API calls the remote still doesn┬┤t seem to go into sleep. Need more time to test.
UPDATE (again!) Turned out the latest 4.0.4 version seems to have a working power saving implementation - just as peterm write in May 2010. I used API Monitor to verify that the plugin accessed the functions SetSniffMode and CancelSniffMode available in WidcommSdk.dll.

-----------------------------------------------------

Target OS: Windows8 x64

Bluetooth in Windows XP compared to Windows8
In Windows8 Microsoft provides the base for the BT implementation, and third party vendors can extend it ÔÇô but the BT foundation is still Microsoft. So Widcomm/Broadcom no longer ship a full stack instead they have a profile pack which extends the functionality of the Microsoft stack. Therefore when working with your own profiles you use the standard Microsoft APIs. Whereas in Windows XP, you could choose either Microsoft or some other BT stack provider for the entire BT implementation.


Notes about Widcomm 5.1.0.1100 BT stack

• Released in 2006
• The 5.1.0.1100 version is known to be the last version that supports BT hardware from other manufactures than Widcomm.
• Support the BT Stereo Audio profile, and some less interesting BT profiles.
• Is initially locked down to only support certain hardware but can be unlocked by using a license patcher. I┬┤ve found four different versions of the license patcher: 1.7, 1.8, 1.9 and 2.0. Note that only patchers prior to version 2 support x64 based systems.
• The SetSniffMode function provided by the Widcomm 5.x API which the PS3 Remote can use via the EG plugin was removed from the first version of the SDK that officially supported Vista, which was version 6.0.

Installation instructions

1. Get hold of & modify the Widcomm 5.1.x driver package to suit your USB dongle. Hint: Google: +"Widcomm 5.1.0.1100" +guide
2. Disable the Microsoft Bluetooth Stack (See guide in #1..)
3. Get hold of 32bit editions of two files... Look in this cab archive available in the driver package Widcomm.Bluetooth.Software.Drivers.5.1.0.1100\Win32\Data1.cab for WidcommSdk.dll
   and F54515_wbtapi.dll. Rename the later mentioned file to wbtapi.dll. Place both files in the C:\Windows\SysWOW64 folder. It may seem weird that 32bit drivers are located in a folder with ÔÇ£64ÔÇØ in the name but it is correct.
4. Install BT stack & pair remote. These drivers are not signed from the start so we need to disable ÔÇ£Driver Signature EnforcementÔÇØ to be able to install it:
   1. Mouse over the lower-left corner, then select: Settings > Change PC Settings > General > Advanced startup > Restart now .. > Troubleshoot > Advanced Options > Startup Options > Restart > Disable Driver Signature Enforcement.
   2. Now install the drivers according the guides mentioned earlier. Windows will prompt you about the lack of signatures, just click yes. It might even prompt you about ÔÇ£a digitally signed driver is requiredÔÇØ, but even though I got that message the drivers got installed properly.
   3. Apply license patch
   4. When done, you might have to reboot into the same disabled ÔÇ£Driver Signature EnforcementÔÇØ mode again, and then right-click the Bluetooth icon in the tray and select something in line with ÔÇ£start use BluetoothÔÇØ. This will load yet some more drivers.
   5. Now pair your PS3 remote.
5. Enable "test signing" & self-sign some drivers. In the ÔÇ£Disabled Driver Signature EnforcementÔÇØ mode you can load your drivers as well, but the problem is that you manually have to do some clicking each time you want to enter this less restricted mode. A more permanent solution is to enable ÔÇ£Test SigningÔÇØ, and self-sign some drivers.
   1. Load Driver Signature Enforcement Overrider 1.3b (DSEO) with admin permissions, and self-sign the drivers listed below:
      • Bluetooth USB dongle driver provided by the Widcomm 5.1.x package C:\windows\system32\drivers\btwusb.sys
      • Bluetooth Bus Enumerator c:\windows\system32\drivers\btkrnl.sys
      • Bluetooth Hands-free Audio & Bluetooth Stereo Audio C:\windows\system32\drivers\btaudio.sys
      • Bluetooth LAN Access Server Driver C:\windows\system32\drivers\btwdndis.sys
      • Bluetooth Virtual HID Keyboard Properties - required to load HID-compliant game controller C:\windows\system32\drivers\btwhid.sys
      • Bluetooth Communications Port COM3 & COM4 C:\windows\system32\drivers\btport.sys
   2. In an elevated command prompt run: bcdedit.exe /set TESTSIGNING ON, and reboot
   3. You probably want to remove the watermarks on your desktop using a tool like i.e. Water Mark removal tool: My WCP Watermark Editor
6. Configuring EG
   1. Install the latest version of the PS3 plugin available in this thread. To date version 4.0.4.
   2. Launch RegEdit, and browse to this location (note that "1&30ee4ad&0&201ffffffffff" might be something else in your case):

      Code: Select all

      [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\{95C7A0A0-3094-11D7-A202-00508B9D7D5A}\HID_KEYBOARD\1&30ee4ad&0&201ffffffffff\Device Parameters]
      

      Look for REG_BINARY value BdAddr. Write down the string shown in the "data column". It should be something like: "34 C7 31 00 7C B5". And add ":" to it so you get this kind of format: "34:C7:31:00:7C:B5". In file EventGhost\plugins\PS3\__init__.py, replace the bluetooth address listed at row: "BD_ADDR = "00:21:4f5a:85" # XXX: auto detect" with the one you just built.
   3. Add these three macros to your configuration

      Code: Select all

      <?xml version="1.0" encoding="UTF-8" ?>
      <EventGhost Version="1610">
          <Folder Name="PS3 remote" Expanded="True">
              <Macro Name="Get battery level" Expanded="True">
                  <Action>
                      HIDPS32.GetBatteryLevel()
                  </Action>
                  <Action Name="Show OSD: battery level: {int(eg.result)}">
                      EventGhost.ShowOSD(u'battery level: {int(eg.result)}', u'0;-37;0;0;0;700;0;0;0;0;3;2;1;34;Arial', (128, 255, 128), (0, 0, 0), 0, (0, 0), 0, 3.0, True)
                  </Action>
              </Macro>
              <Macro Name='Set "Save power" sleep timer' Expanded="True">
                  <Event Name="PS3.Button.*" />
                  <Action>
                      Timer.TimerAction(u'trigger PS3 remote sleep', 0, 1, 5.0, u'PS3.hibernate', False, True, 1, u'00:00:00')
                  </Action>
              </Macro>
              <Macro Name="Save power" Expanded="True">
                  <Event Name="Timer.PS3.hibernate" />
                  <Action>
                      HIDPS32.SavePower()
                  </Action>
              </Macro>
          </Folder>
      </EventGhost>
      

7. That should be it

[miljbee]

Ok, so Widcomm is required.

So, why not just bought a bluetooth dongle with a broadcom chip ?
Like this one :
http://www.belkin.com/us/support-search ... umentation
or this one :
http://www.belkin.com/us//support-searc ... l&q=F8T016

Ok, it's a bit more expensive than most BT Dongle, but wouldn't it work easily ?

[gechu]

Ok, so Widcomm is required.

So, why not just bought a bluetooth dongle with a broadcom chip ?
Like this one :
http://www.belkin.com/us/support-search ... umentation
or this one :
http://www.belkin.com/us//support-searc ... l&q=F8T016

Ok, it's a bit more expensive than most BT Dongle, but wouldn't it work easily ?

If you want to use anything newer than WindowsXP, and still rely on the "sniff-mode" function to get your remote to save power, then you have to install the hacked widcomm 5.1.x bluetooth stack. Read my previous post for more info.

[miljbee]

I was suggesting this because, the setniffmode, cancel, readlink, ... are still present in the BtWdSdk.dll of the latest 6.x widcomm stack.
I have bought a BT Dongle with a broadcom chip inside to be able to install normally the widcomm files.

I have been able to call the setsniffmode function, but it does nothing.

In fact, it's clearly written in the release Notes of the widcomm 6 sdk, that this function with a few others are non functionnal on Win Vista +.

So, you are right, It seems the only way to call setSniffMode on vista+ is to install the Widcomm 5 stack.

But wait ! that's not my last word !

I have searched another way to get the same result (Remote in low power mode) and I found it.
When browsing msdn, I came accross IOCTL_BTH_DISCONNECT_DEVICE. Calling this will Close the bT connection between the remote and the computer.

After some more digging, I have been able to write some working code in C# with the help of the InTheHand.Net Libraries.
You can get the code on StackOverflow if you want.

The cool part of this is that it should work on any Win Vista+ without the need of any trick, hack, ...
You can get a built version here. It's a console application, you simply launch it Like That : BTDisco2 01:23:45:67:89:AB
The BtAddr doesn't need to be reversed, just write it like it appears in the advanced bluetooth properties dialog box of the remote.
I have coded this for my PS3 BD Remote, but it works for any bluetooth Device, you just need to kwow the Bt Address.

Finally, if someone is skilled enough to port this to python inside eg, it would be really great.

Thanks for reading

[gechu]

Glad to see someone else is trying to get this PS3 remote working!

EDIT: found a refernce to Windows CE in the code. So the BthEnterSniffMode certainly is exclusively for Windows CE (and later editions)
I did a seach for IOCTL_BTH_DISCONNECT_DEVICE and found NativeMethods.cs in the 32feet subversion repo. In there I found a method called: BthEnterSniffMode. A method with the same name is only referenced in Microsofts documentation about Windows CE (Windows Embedded Compact 7 etc..). But so far I┬┤ve found nothing which suggests that the 32feed NativeMethods.cs isn┬┤t targeted for the usual Microsoft stack (and no CE product). Juding by the name of the function it seems to deal with "sniff-mode". Have you tried calling it?

[miljbee]

Glad to see someone else is trying to get this PS3 remote working!

In fact, I don't really know why I am sticking on this, because, even without hibernating, my rechargeable batteries lasts more than a week, which is enough. I have a spare pair, and I will just swap them on Sunday evening without worrying about the battery level !

I really find that this is the best remote I have ever had (and I have used a significant number ...).
Obviously, bluetooth is really the best link for remote controls.
For me the only problem with this remote is lack of Vol+- and Channel+- buttons. It lowers a lot the WAF ...

I have ordered this one http://www.1stincity.com/fr/pc-componen ... c1043.html I'm still waiting it. Let's hope it will be the perfect one.

[miljbee]

There is still one thing to try : The HID Protocol.

I'm not familiar with this, but from what I have understood, HID Devices describe there capabilities to the system on which they connect.
These capabilities might include receive data commands.

From now, I know that data are exchanged between the HID Device and the Computer using HID Reports.
HID Reports are used in both ways : getting data from the device/sending data to the device.
The "Format" of these reports can be obtained by reading the HID Report Descriptor.

I don't know if it's possible to send an hid report to the remote to make it sleep, but my idea is that If I can obtain the HID report format that the remote expects, and if the packet is small enough (8 - 16 bits), It might be possible to send all the possible packets and see if we get a response and/or the remote sleeps.

I won't be able to try this before at least 10 days, I will keep you informed.

[gechu]

So Lenovo solved the bluetooth power saving issue using the MS stack... So it must be possible, somehow.

I don┬┤t know much about HID, but the PS3 remote uses a shared library for handling that stuff. The code was originally a part of the 3.x version of this plugin, but was altered to be more generic, and placed in ..\EventGhost\eg\WinApi\HID.py

Regarding WAF. I┬┤m using the 2011 edition of the remote. It┬┤s really sad that Sony decided to only have IR signal for some of the buttons. However, one pretty consistent way of handling it is to always, regardless of which application preset is active, use the "up" and "down" keys for altering the volume in the current application. And then use the CHAN+ and CHAN- buttons for handling the master volume. Let me know if I should send you a copy of my configuration.

I┬┤ve done some programming before, but Python was new to me. Initially I tried to set up my development environment to debug the entire EG code, but I failed because some strange dependency. But I was able to figure out what is happening in the PS3 remote plugin by using the method described here: viewtopic.php?f=10&t=5296

At the moment am I enjoying Python tutorials available at this site http://www.diveintopython.net/ in case you want to catch some basic Python skills.

[miljbee]

Thank you for the suggestions. I have some basic python Knowledge (I have written the TCPEvents plugin), but basic, is basic ! For now I don't know how to call IOCTL from python. I suspect that it just deals with importing the correct DLL functions with ctypes, but I haven't searched.
Calling DeviceIOControl might be easy, but getting the handle to the bt adapter seems to me a bit harder. Perhaps I will take the time to dig into this one day !

For now, I will try to see if the remote can be hibernated with HID Output reports. I Will use C#, because it seems that the PS3BluMote Code already contains everything that is needed to test this.

I Will keep you informed, but I won't have the time to try anything before at least 10 Days.

[piipes]

I really find that this is the best remote I have ever had (and I have used a significant number ...).
Obviously, bluetooth is really the best link for remote controls.
For me the only problem with this remote is lack of Vol+- and Channel+- buttons. It lowers a lot the WAF ...

I think that old ps3 remote is allmost perfect. I love those three seek buttons, scan, prev and slow step. New ps3 remote is poor, those see buttons are too down, have to move hand... I use cross & square to volume and up & down to switch channel. In fullscreen video left & right are volume too.

[gechu]

It takes one keypress to make the remote wake from sniff mode (low power mode). The key sent from the remote does not correspond to any button, hence nothing shows up in EG. So the remote will drain battery, yet no timer is set to get it back to sniff mode. I┬┤ve added an event for that situation, and an action to test the operation mode (link-mode). If a functional key is detected (two keypresses, or a long press), then no event will be generated. Personally I┬┤ve added a sound to know when my keypress only served the purpose of getting the remote out of sniff mode.

Code: Select all

4.0.5
- Generate event PS3.ResumeFromSleep when the remote wakes from sniff mode
- Added action to retrieve the remote link mode

[miljbee]

Hello,

I have been able to understand that the remote is able to receive feature reports. And I have been able to successfully send a few with pywinusb.hid (python lib).

Now huge problems remains :
- The feature reports the remote accepts have a usage page of 0xff00 which is "vendor specific" features, which means only Sony could provide some directions on how to use them.
- The remotes announce that it accepts six different feature reports (id 1-6)
- The feature reports length is 12 bytes (remove the id and we have 11 bytes left)

So theorically, if the remote can be hibernated with feature reports, I will have to test 6*(256^11) possibilities to find the good one. It won't happen, this number is far too huge.

I looked at the input reports the remote sends when we press or release a key and saw that the first 3 Bytes are only "1bit toggles" (1,2,4,8,16,32,...).
The fourth doesn't seem to have a particular value.
Bytes 5 to 9 are always 255
Byte 10 is 0 or 255
Byte 11 is the battery level (0-5)
Byte 0 is the report ID

So, if I assume that Feature reports are built the same way than input reports (i don't know why, but I had to start somewhere !)
This gives me 6x (8^3)*255*2*255 which is still too huge to brute force !

I have googled a lot to try to find some clue on the sony feature reports, but haven't found anythiong. I thought I could get some usesfull informations by looking at source code of sixaxis related projects but it hasn't helped.

If someone have some ideas ....

[miljbee]

Finally, I got it !

I left the hid feature reports because there were too much doubt, as I have explained in my previous post.

So, I went back to google and searched if it has been done on Linux. The response is Yes, they've done it !
From what I have understood, it seems that they disconnect/reconnect the L2CAP Channel. Which seems effectively to leave the remote in sleep mode.

On Win 7 with the Msft stack, I haven't found anyway to disconnect the L2CAP (It seems it's possible with the stock widcomm stack).

But after digging a bit more I found that HID uses L2CAP for the transport, and since HID is the only service offered by the remote, I thought that perhaps disconnecting the HID Service of the remote will close the underlying L2CAP Channel.

Once again the InTheHand.Net Library was really helpfull as it allowed me to disable the HID Service for the remote very easily.
And best of all, reconnecting it was as easy.

Code: Select all

BluetoothDeviceInfo device = new BluetoothDeviceInfo(BluetoothAddress.Parse("00:1e:3d:0d:ac:31"));
System.Console.WriteLine("Disconnecting");
device.SetServiceState(BluetoothService.HumanInterfaceDevice,false);
System.Console.WriteLine("Connecting");
device.SetServiceState(BluetoothService.HumanInterfaceDevice, true);
System.Console.WriteLine("Done !");
System.Threading.Thread.Sleep(1000);

On my system running Win 7 x64 with the stock Msft Bt Stack, this small program takes about 5s to complete. Once done, the remote is still sleeping (checked with the power meter). A few seconds later The HID Device is available again for any program that might listen to its input reports. Which means that when you will press a button on the remote, it will wake up, and the program that listens for the HID input Reports (EG with ps3 plugin, PS3BluMote) will get that button.
No button is lost (with my previous solution - BTDisco2 - the button that wakes the remote was lost).

To integrate this with eg, it will be quiet easy. I will publish (probably tonight) a working exe. Then we just have to start a 120s timer (or less, or more) on each keypress, and start the exe when the timer ends. I Think that with this setup, the batteries should lasts several months, perhaps even more than a year.

If I am not too lazy, I might try to integrate this into the PS3 Plugin ...

[gechu]

Good news!!

One of the method disussed some time ago was to use devcon.exe (which is a command line interface to Device Manager), to disable, and then enable the remote. This would leave the remote in sleep mode. One drawback I noticed was that the remote could have problems re-pairing after waking up. When it occurred it required about 30 seconds to get back on track. Good thing with that solution was that no keys were lost. Using the Widcom stack always the first key after a resume gets lost. Quite annoing, but with a sound tied to the Wakeup (my latest update to the plugin) I think the user experience was quite OK.

Well, back to my point, the solution you describe look quite similar to the devcon.exe hack. Would be interesting to know if you┬┤re remote has problems re-pairing with your solution as well.

[miljbee]

From now, I have only tested this new method in the VS2010 Debugger, and it works great. The only problem that will remain is that the disconnect/reconnect takes a bit long (about 7s I think). It means that if you press a key while this happens, it won't work.
But if it happens to often, the user will just have to put a longer delay before sleeping the remote.

And no, there shouldn't exist any re-pairing problem since the bluetooth connection isn't closed. It's justs the HID Service for the remote that is restarted. The remote remains associated during the HID Service Restart procedure.