AwesomeREA.org

Learning resource

Nintendo Switch Reverse Engineering

Notes begun by dekuNukem in 2017 and extended by contributors on how the Joy-Con, Pro Controller and parts of the Switch console and dock work, worked out from teardowns, logic-analyzer captures and packet logs. Markdown files cover the Joy-Con board test points and rail-connector pinout, the wired serial handshake with its CRC-8 checksum, Bluetooth HID input and output reports with 32 documented subcommands, the USB HID commands of the Pro Controller and charging grip, the SPI flash memory map with stick and 6-axis calibration, IMU conversion formulas and rumble encoding tables. The repository also keeps STM32 test firmware that plays the console or a Joy-Con on the rail, a Wireshark dissector for the Bluetooth traffic, and the captures behind the notes.

Requirements & limits

  • Reviewed at commit b354f21 (2026-08-21). Of 277 commits, 228 date from 2017 and most others from 2018–2021; the 2026 changes document the console's sanity checks on stick calibration. The notes describe the original Joy-Con and Pro Controller, listing controller firmware 3.89 as the latest, and several fields remain marked unknown, so newer firmware and controllers need separate checking.
  • Following the notes needs one's own controller. The wired-protocol work involves opening a Joy-Con and connecting its rail connector, which uses 1.8 V logic, to a logic analyzer or microcontroller; the Bluetooth and USB notes assume a host that can exchange raw HID reports, and their sample C code uses hidapi-style calls. No controller or dock firmware is included: the README says a dock firmware dump was made but is not posted.
  • The joycon_reader and joycon_spoofer projects target an STM32F072 and were generated with STM32CubeMX for Keil MDK-ARM; their build outputs are committed alongside the sources. The nxbt dissector has to be compiled as a plugin within a Wireshark source build, a Lua script dissects Bluetooth traffic captured over USB, and small Python scripts parse captures and compute the serial checksum. The .logicdata captures need logic-analyzer software that reads that format.
  • The Bluetooth notes also document SPI flash write and sector-erase and firmware-update commands, with warnings about erasing whole sectors; the field meanings come from the contributors' own captures and tests, which this collection did not repeat.
  • GitHub detects no license and the repository has no license file, so the notes state no reuse terms; a datasheets folder holds copies of third-party chip datasheets, and the Lua dissector says it is provided with no license. The README credits the many contributors. Nothing in the reviewed files mentions AI or REA.

About this entry

Type
Learning resource
Category
Learning resources
Relationship
Learning resource
Targets
Firmware · Protocol

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · dekuNukem/Nintendo_Switch_Reverse_Engineering · Revision b354f21
  2. bluetooth_hid_notes.md GitHub · dekuNukem/Nintendo_Switch_Reverse_Engineering · Revision b354f21
  3. bluetooth_hid_subcommands_notes.md GitHub · dekuNukem/Nintendo_Switch_Reverse_Engineering · Revision b354f21
  4. spi_flash_notes.md GitHub · dekuNukem/Nintendo_Switch_Reverse_Engineering · Revision b354f21
  5. USB-HID-Notes.md GitHub · dekuNukem/Nintendo_Switch_Reverse_Engineering · Revision b354f21
  6. imu_sensor_notes.md GitHub · dekuNukem/Nintendo_Switch_Reverse_Engineering · Revision b354f21
  7. rumble_data_table.md GitHub · dekuNukem/Nintendo_Switch_Reverse_Engineering · Revision b354f21
  8. joycon_reader/README.md GitHub · dekuNukem/Nintendo_Switch_Reverse_Engineering · Revision b354f21
  9. packet_parse/nxbt/README.md GitHub · dekuNukem/Nintendo_Switch_Reverse_Engineering · Revision b354f21

More in References and learning

All 43 entries in References and learning