jam1garner

This is a mini-tutorial of sorts for getting started with gdb on the Switch, with the target audience being people who want to mod and/or reverse games, with no prerequisite knowledge of gdb. The goal will be to walk you through some of the basic workflows needed to use a debugger on the Switch, while being brief enough for skimming for when you forget things.

If some part is unclear, your OS doesn't have install instructions, or you feel part of your workflow should be added here, feel free to comment any additions.

(If you only need a quick reference Jump to the Appendix)

Installing GDB

First off you'll need a version of GDB compatible with aarch64. This can be obtained via either a distribution of

stealth-alex

Copy of deleted topic: https://www.reddit.com/r/gamedev/comments/jumvi5/dualsense_haptics_leds_and_more_hid_output_report/

---

outputReport[0]  = 0x02; // report type

outputReport[1]  = 0xff; // flags determiing what changes this packet will perform
    // 0x01 set the main motors (also requires flag 0x02); setting this by itself will allow rumble to gracefully terminate and then re-enable audio haptics, whereas not setting it will kill the rumble instantly and re-enable audio haptics.
    // 0x02 set the main motors (also requires flag 0x01; without bit 0x01 motors are allowed to time out without re-enabling audio haptics)
    // 0x04 set the right trigger motor

Ryochan7

BT

0 Report ID 49 (0x31)
1 Garbage??? (Seems to increment by 16 each poll)
2 LX (0-255)
3 LY (0-255)
4 RX (0-255)
5 RY (0-255)
6 L2 (0-255)
7 R2 (0-255)

shchmue

Updated as of firmware 16.0.0.

All values except firmware versions and floats are hex.
Field names are either official symbols or derived from the name of the accessor/mutator function.
Firmware version information for each field is not indicated but likely maps neatly to the firmware versions in which accessor/mutator functions for the given field were introduced. See: https://switchbrew.org/wiki/Settings_services

PrivateSettings 8000000000000052
offset  size    type/name                                   default
0       10      GAP
10      20      nn::settings::system::InitialLaunchSettings 0

tiehichi

Steam Controller BLE HID Protocol

After connecting the SteamController through BLE, you can see that there are 5 characteristics in the HID Service: three Input Reports, one Output Report, one Feature Report, and Report Map

In lizard mode, the three Input Reports correspond to the following events:

Input Report	event
Input Report 0	Keyboard Input
Input Report 1	Mouse Input

icecr4ck

IDAPython cheatsheet

Important links

• Porting IDAPython plugins to IDA 7.4
• Hex-Rays IDAPython official documentation

Basic commands

Get informations on the binary

nwert

from Crypto.Cipher import AES
from Crypto.Util import Counter
import struct

"""
typedef struct boot_dat_hdr
{
	unsigned char ident[0x10];
	unsigned char sha2_s2[0x20];
	unsigned int s2_dst;

nondebug

0000:006f JessTechColourRumblePad
0001:0329 Sl6566
0005:05ac Mocute
0010:0082 AkishopCustomsPs360Plus
0078:0006 MicrontekUsbJoystick
0079:0006 PcTwinShock
0079:0011 DragonRiseGamepad
0079:1800 MayflashWiiUProAdapter
0079:181a VenomLimitedArcadeJoystick
0079:181b VenomArcadeJoystick