8 ms·

A Dump of the Raw Stadia Controller BT Firmware

173 points by bmaupin 4y ago

kvathupo 4y ago
Although I'm unfamiliar with bluetooth drivers, how would you go about making binary files portable? I'd imagine one would decompile the binaries, and modify the source code for redistribution as some portable library supporting whatever build target a user has. Of course, I assume (1) the decompiler can't detect compile-time macros detecting architecture and (2) you'd be screwed if you need shared libraries. P.S. Interestingly, the first link when one googles "firmware decompiler" is to CIA code on Wikileaks lol
- pifm_guy 4y ago
  For any substantial changes, it's probably easier to just rewrite the firmware from scratch. Nearly every chip that supports Bluetooth has demo code available to make a Bluetooth HID device. All you'd need to do is run that and fix up the button mappings.
- ghostpepper 4y ago
  Just to be pedantic, firmware and drivers are not the same thing. I'm not familiar with Stadia but when I saw 'Dump of controller BT firmware' I assumed that this is the code that runs on the actual bluetooth controller chip inside the controller. Presumably this handles at least the lower layers of comms between the controller and the host PC. Maybe there's another application processor in the controller that handles higher-level communications or maybe the BT chip has a small general-purpose CPU core inside it, but regardless I don't see why this firmware would need to be modified to make the controller work on a windows PC. Drivers, on the other hand, would run on the host PC side and would likely need to be rewritten for each platform that you want the controller to work with (although hopefully at least some of the lower-level bluetooth layers are already handled in windows/linux/etc. and the actual code required might not be too extensive)
  - kvathupo 4y ago
    Definitely not pedantry: I admittedly conflated the two!
- rolenthedeep 4y ago
  As a person who develops Bluetooth game controllers, there's nothing particularly interesting or valuable here. There's a few layers of firmware in a device like this, and none of them are interesting. The device itself has firmware which reads button presses, talks to the wireless chipset, and drives the vibration motors. The wireless chipset has firmware, too, but most of it is code provided by the chip manufacturer for free (this is actually the driver). There's a layer on top of the driver that acts to handle things like setting the device name, choosing wifi vs Bluetooth, managing connections. The controller takes button presses and puts that data on a serial port over Bluetooth. Or in this case, feeds it to some web api over wifi. As to the rest of your question, these images are not and really can't be very portable. Firmware is highly dependent on hardware. For example, a chip might have four SPI ports that can talk to the Bluetooth chipset. If this controller uses port 0, and another uses port 2, it will just fundamentally not work. Firmware images just aren't really that useful outside of their target hardware. Decompiling won't tell you very much. If you're interested in the wireless chipset, the thing to do is get a device and open it up to see what chip is there. Then you can just download the SDK from the manufacturer. On the developer side, you can build a firmware to target multiple devices. As you said, preprocessor directives can select code based on hardware at compile time. That's pretty much how you do it. And yeah, the main tool for decompiling firmware is Ghidra, which was developed by the US government. IDA is another one to look at, but I'm not sure if it's relevant anymore
  - heyoni 4y ago
    I knew people were leaning hard into Ghidra because it was free but are you implying that it’s surpassed IDA in terms of functionality?
    - jhart99 4y ago
      One way in which Ghidra excells is that it comes with a TON of processor definitions. IDA charges extra for those and the quality of the Ghidra definitions tends to be higher IMO. It makes Ghidra a better tool for embedded processors.
      - 4y ago
flatiron 4y ago
Stadia controller is by far my favorite. Glad they kept mine alive.
haunter 4y ago
This is also good for the future because Google will take down the update site on December 31
- josteink 4y ago
  Because of course they will. I mean, it might cost them $10 annually to keep it up? There’s also something awfully meta about Google discontinuing a support-page for their discontinued product…
  - sangnoir 4y ago
    > Because of course they will. I mean, it might cost them $10 annually to keep it up? For large tech companies, it's most likely due to organizational reasons. Someone (likely some team) has to own any component/subsystem and be responsible for its maintenance. This obviously comes at a cost of the teams' other projects (read bonus OKRs), a direct consequence is that it becomes hard to permanently rehome a dead-end project like the Stadia controller, best you can hope is a temporary reprieve from a sympathetic team.
    - mdaniel 4y ago
      OT1H, I hear you and that was my suspicion too: they tossed the site into some nginx pod on some k8s cluster and those things don't live forever But, for a discontinued product, isn't the information static and thus the GCS "turn this bucket into a webserver and don't bother me anymore" ( https://cloud.google.com/storage/docs/static-website#examples https://cloud.google.com/storage/docs/static-website#example... ) seems like even less than the cited $10/yr. If the next question is "to which Project does the GCS bucket get billed?" then I'm pretty sure GCP gives away tiny storage to anyone with an email
      - pram 4y ago
        Are Google teams even allowed to use GCS?
    - derefr 4y ago
sigmar 4y ago
Wondering if this is firmware is signed, hoping they removed signing or it was never signed. I've used the controller a bit this week to play games on my android phone and quite like it.
- detaro 4y ago
  from what I've read (sorry, can't find the link again right now) they didn't change the update mechanism at all, still requiring signatures.
- obnauticus 4y ago
  Often times signature checking is fused in during provisioning. That is to say, if they had it enabled before there is a good chance they’re unable to disable it. You’ll probably need to find a vulnerability in the iMX8 bootROM which checks these fuse bits to bypass it. You’d need to read the iMX8 docs to know for sure, but it does support full secure boot IIRC. Edit: Yup this appears to be true. “The public key is included in the final binary and a hash of the public key is programmed in the SoC, in One-Time Programmable e-fuses, for establishing the root of trust.” See https://www.variscite.com/blog/i-mx8-secure-boot-made-easy-code-signing-using-yocto/ https://www.variscite.com/blog/i-mx8-secure-boot-made-easy-c...
  - deleted 4y ago
    [deleted]
  - solarkraft 4y ago
    I love it when e-waste is created through this type of security theater. They may not be able to disable signature checking, but they can and should publish the private key.
    - sgtnoodle 4y ago
      They could potentially develop a shim bootloader, unless the ROM bootloader validates the entire flash range.
  - 4y ago
hanniabu 4y ago
Have they renabled the controller mic yet?
- vageli 4y ago
  Not sure why this is downvoted, the stadia controller does indeed contain a microphone. https://support.google.com/stadia/answer/9565956?hl=en&ref_topic=12788208 https://support.google.com/stadia/answer/9565956?hl=en&ref_t...
- ThatPlayer 4y ago
  I think it's more an issue with Bluetooth as a protocol. Even Xbox controllers don't do audio over Bluetooth; you need their custom 2.4ghz adapter for audio. Bluetooth hand-free profile, the one for both input and output audio, is extremely outdated and still downgrades audio to something like mono 16Khz. Even modern Apple Airpods will have this issue. It's fine for voice calls, but with music and all, it's not a good experience.
jeanofthedead 4y ago
Would love to know why mine needs to be forgotten and re-paired to my Nvidia Shield every time I use it now.
AceJohnny2 4y ago
The Stadia controller runs on a NXP i.MX RT1061 MCU [1], and a Broadcom BCM43458 wireless chip. http://en.techinfodepot.shoutwiki.com/wiki/Google_Stadia_(H2B) http://en.techinfodepot.shoutwiki.com/wiki/Google_Stadia_(H2... Broadcom are $#&@ for documentation and licensing, so I'm not super optimistic. [1] https://www.nxp.com/products/processors-and-microcontrollers/arm-microcontrollers/i-mx-rt-crossover-mcus/i-mx-rt1060-crossover-mcu-with-arm-cortex-m7-core:i.MX-RT1060 https://www.nxp.com/products/processors-and-microcontrollers...
wccrawford 4y ago
I did this update on one of my controllers, and the lag most of the time was barely tolerable. The rest of the time was lag spikes that made games unplayable. I thought maybe it was the fault of my BT chip in my computer, so I turned it off and plugged it in instead, and the lag was most gone, but still worse than my Razer Wolverine. I just threw mine in a box and gave up on it. I probably won't even bother flashing my other 2.
- rOOb85 4y ago
  Wanna sell one to me?
- arglebargle123 4y ago
  Really? Are you in a particularly noisy 2.4GHz environment? I've only updated one of mine so far but it's been perfectly serviceable after.
  - jyxent 4y ago
    I haven't noticed any latency issues either, compared to an Xbox One or GuliKit controller. I have had the issue where the controller will connect but no button / axis events actually are produced. Disconnecting and reconnecting fixes it for me. This seems to be a common issue from other comments I've seen online.
  - Gigachad 4y ago
    It’s quite possible it’s a problem with the desktop side. I had terrible lag with my Xbox controller and found that it’s a known issue where the controller doesn’t send the ideal connection settings and it ends up with lag but it can be fixed.
    - rincebrain 4y ago
      Got a pointer? I've been having some annoyances which seem to stem from somehow any BT use in this laptop causing it to lag sometimes like it's competing in the latency olympics, and strange interactions like it not allowing me to pair any bluetooth game controller if I have a wireless headset paired (it just errors out every time), but the reverse not being true, so I can pair them if I do it in the right order, but have to unpair both if the game controller disconnects for some reason. :/
SUPERVOLO 4y ago
[flagged]

173 points by bmaupin 4y ago

Although I'm unfamiliar with bluetooth drivers, how would you go about making binary files portable? I'd imagine one would decompile the binaries, and modify the source code for redistribution as some portable library supporting whatever build target a user has. Of course, I assume (1) the decompiler can't detect compile-time macros detecting architecture and (2) you'd be screwed if you need shared libraries. P.S. Interestingly, the first link when one googles "firmware decompiler" is to CIA code on Wikileaks lol

pifm_guy 4y ago
For any substantial changes, it's probably easier to just rewrite the firmware from scratch. Nearly every chip that supports Bluetooth has demo code available to make a Bluetooth HID device. All you'd need to do is run that and fix up the button mappings.
ghostpepper 4y ago
Just to be pedantic, firmware and drivers are not the same thing. I'm not familiar with Stadia but when I saw 'Dump of controller BT firmware' I assumed that this is the code that runs on the actual bluetooth controller chip inside the controller. Presumably this handles at least the lower layers of comms between the controller and the host PC. Maybe there's another application processor in the controller that handles higher-level communications or maybe the BT chip has a small general-purpose CPU core inside it, but regardless I don't see why this firmware would need to be modified to make the controller work on a windows PC. Drivers, on the other hand, would run on the host PC side and would likely need to be rewritten for each platform that you want the controller to work with (although hopefully at least some of the lower-level bluetooth layers are already handled in windows/linux/etc. and the actual code required might not be too extensive)
- kvathupo 4y ago
  Definitely not pedantry: I admittedly conflated the two!
rolenthedeep 4y ago
As a person who develops Bluetooth game controllers, there's nothing particularly interesting or valuable here. There's a few layers of firmware in a device like this, and none of them are interesting. The device itself has firmware which reads button presses, talks to the wireless chipset, and drives the vibration motors. The wireless chipset has firmware, too, but most of it is code provided by the chip manufacturer for free (this is actually the driver). There's a layer on top of the driver that acts to handle things like setting the device name, choosing wifi vs Bluetooth, managing connections. The controller takes button presses and puts that data on a serial port over Bluetooth. Or in this case, feeds it to some web api over wifi. As to the rest of your question, these images are not and really can't be very portable. Firmware is highly dependent on hardware. For example, a chip might have four SPI ports that can talk to the Bluetooth chipset. If this controller uses port 0, and another uses port 2, it will just fundamentally not work. Firmware images just aren't really that useful outside of their target hardware. Decompiling won't tell you very much. If you're interested in the wireless chipset, the thing to do is get a device and open it up to see what chip is there. Then you can just download the SDK from the manufacturer. On the developer side, you can build a firmware to target multiple devices. As you said, preprocessor directives can select code based on hardware at compile time. That's pretty much how you do it. And yeah, the main tool for decompiling firmware is Ghidra, which was developed by the US government. IDA is another one to look at, but I'm not sure if it's relevant anymore
- heyoni 4y ago
  I knew people were leaning hard into Ghidra because it was free but are you implying that it’s surpassed IDA in terms of functionality?
  - jhart99 4y ago
    One way in which Ghidra excells is that it comes with a TON of processor definitions. IDA charges extra for those and the quality of the Ghidra definitions tends to be higher IMO. It makes Ghidra a better tool for embedded processors.
    - 4y ago

flatiron 4y ago

Stadia controller is by far my favorite. Glad they kept mine alive.

haunter 4y ago

This is also good for the future because Google will take down the update site on December 31

josteink 4y ago
Because of course they will. I mean, it might cost them $10 annually to keep it up? There’s also something awfully meta about Google discontinuing a support-page for their discontinued product…
- sangnoir 4y ago
  > Because of course they will. I mean, it might cost them $10 annually to keep it up? For large tech companies, it's most likely due to organizational reasons. Someone (likely some team) has to own any component/subsystem and be responsible for its maintenance. This obviously comes at a cost of the teams' other projects (read bonus OKRs), a direct consequence is that it becomes hard to permanently rehome a dead-end project like the Stadia controller, best you can hope is a temporary reprieve from a sympathetic team.
  - mdaniel 4y ago
    OT1H, I hear you and that was my suspicion too: they tossed the site into some nginx pod on some k8s cluster and those things don't live forever But, for a discontinued product, isn't the information static and thus the GCS "turn this bucket into a webserver and don't bother me anymore" ( https://cloud.google.com/storage/docs/static-website#examples https://cloud.google.com/storage/docs/static-website#example... ) seems like even less than the cited $10/yr. If the next question is "to which Project does the GCS bucket get billed?" then I'm pretty sure GCP gives away tiny storage to anyone with an email
    - pram 4y ago
      Are Google teams even allowed to use GCS?
  - derefr 4y ago

sigmar 4y ago

Wondering if this is firmware is signed, hoping they removed signing or it was never signed. I've used the controller a bit this week to play games on my android phone and quite like it.

detaro 4y ago
from what I've read (sorry, can't find the link again right now) they didn't change the update mechanism at all, still requiring signatures.
obnauticus 4y ago
Often times signature checking is fused in during provisioning. That is to say, if they had it enabled before there is a good chance they’re unable to disable it. You’ll probably need to find a vulnerability in the iMX8 bootROM which checks these fuse bits to bypass it. You’d need to read the iMX8 docs to know for sure, but it does support full secure boot IIRC. Edit: Yup this appears to be true. “The public key is included in the final binary and a hash of the public key is programmed in the SoC, in One-Time Programmable e-fuses, for establishing the root of trust.” See https://www.variscite.com/blog/i-mx8-secure-boot-made-easy-code-signing-using-yocto/ https://www.variscite.com/blog/i-mx8-secure-boot-made-easy-c...
- deleted 4y ago
  [deleted]
- solarkraft 4y ago
  I love it when e-waste is created through this type of security theater. They may not be able to disable signature checking, but they can and should publish the private key.
  - sgtnoodle 4y ago
    They could potentially develop a shim bootloader, unless the ROM bootloader validates the entire flash range.
- 4y ago

hanniabu 4y ago

Have they renabled the controller mic yet?

vageli 4y ago
Not sure why this is downvoted, the stadia controller does indeed contain a microphone. https://support.google.com/stadia/answer/9565956?hl=en&ref_topic=12788208 https://support.google.com/stadia/answer/9565956?hl=en&ref_t...
ThatPlayer 4y ago
I think it's more an issue with Bluetooth as a protocol. Even Xbox controllers don't do audio over Bluetooth; you need their custom 2.4ghz adapter for audio. Bluetooth hand-free profile, the one for both input and output audio, is extremely outdated and still downgrades audio to something like mono 16Khz. Even modern Apple Airpods will have this issue. It's fine for voice calls, but with music and all, it's not a good experience.

jeanofthedead 4y ago

Would love to know why mine needs to be forgotten and re-paired to my Nvidia Shield every time I use it now.

AceJohnny2 4y ago

The Stadia controller runs on a NXP i.MX RT1061 MCU [1], and a Broadcom BCM43458 wireless chip. http://en.techinfodepot.shoutwiki.com/wiki/Google_Stadia_(H2B) http://en.techinfodepot.shoutwiki.com/wiki/Google_Stadia_(H2... Broadcom are $#&@ for documentation and licensing, so I'm not super optimistic. [1] https://www.nxp.com/products/processors-and-microcontrollers/arm-microcontrollers/i-mx-rt-crossover-mcus/i-mx-rt1060-crossover-mcu-with-arm-cortex-m7-core:i.MX-RT1060 https://www.nxp.com/products/processors-and-microcontrollers...

wccrawford 4y ago

I did this update on one of my controllers, and the lag most of the time was barely tolerable. The rest of the time was lag spikes that made games unplayable. I thought maybe it was the fault of my BT chip in my computer, so I turned it off and plugged it in instead, and the lag was most gone, but still worse than my Razer Wolverine. I just threw mine in a box and gave up on it. I probably won't even bother flashing my other 2.

rOOb85 4y ago
Wanna sell one to me?
arglebargle123 4y ago
Really? Are you in a particularly noisy 2.4GHz environment? I've only updated one of mine so far but it's been perfectly serviceable after.
- jyxent 4y ago
  I haven't noticed any latency issues either, compared to an Xbox One or GuliKit controller. I have had the issue where the controller will connect but no button / axis events actually are produced. Disconnecting and reconnecting fixes it for me. This seems to be a common issue from other comments I've seen online.
- Gigachad 4y ago
  It’s quite possible it’s a problem with the desktop side. I had terrible lag with my Xbox controller and found that it’s a known issue where the controller doesn’t send the ideal connection settings and it ends up with lag but it can be fixed.
  - rincebrain 4y ago
    Got a pointer? I've been having some annoyances which seem to stem from somehow any BT use in this laptop causing it to lag sometimes like it's competing in the latency olympics, and strange interactions like it not allowing me to pair any bluetooth game controller if I have a wireless headset paired (it just errors out every time), but the reverse not being true, so I can pair them if I do it in the right order, but have to unpair both if the game controller disconnects for some reason. :/

SUPERVOLO 4y ago

[flagged]