Reverse engineering the Playstation Move - Hack a Day

Reverse engineering the Playstation Move

posted Mar 13th 2011 9:28am by Mike Nathan
filed under: Microcontrollers, playstation hacks

[Kenn] is working on building a quadrocopter from the ground up for a university project. Currently, his main focus is building an Inertial Measurement Unit, or rather re-purposing a PS3 Move controller as the IMU for his copter. He previously considered using a Wiimote Motion Plus, but the Move has a three-axis magnetometer, which the Wii controller does not.

The ultimate goal for this portion of his project is building custom firmware to run on the Move’s STM32-Cortex microcontroller, allowing him to obtain data from each of the controller’s sensors. Through the course of his research, he has thoroughly documented each sensor on his site, and dumped a full working firmware image from the Cortex chip as well. Recently, he was even able to run arbitrary code on the controller itself, which is a huge step forward.

[Kenn’s] project is coming along very nicely, and will undoubtedly be a great resource to others as he continues to dig through the inner workings of the Move. Be sure to swing by his site if you are looking for information, or if you have something to contribute.

tagged: move, playstation 3, ps3, reverse engineering

Go there...
http://hackaday.com/2011/03/13/reverse-engineering-the-playstation-move/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+hackaday%2FLgoM+%28Hack+a+Day%29&utm_content=Google+Feedfetcher

PS3 Move hacking

Schematic

2011/02/26 02:57 Filed in: schematic

This is the schematic as best I’ve reverse engineered it. There are some additional components that I’ve not included in the eagle file, but they are in the attached scanned notes. If you decide to add them into the eagle file, please let me know and I’ll update this original file.

Resources:
Schematic in pdf format
Schematic in Eagle format
Buttons schematic in pdf format
Buttons schematic in Eagle format

Firmware

2011/02/26 02:45 Filed in: firmware

The goal of my project is develop quadcopter firmware for a university research project. The advantage of the Move is its incredibly low price and its suite of inertial and absolute sensors, all linked together by a reasonably powerful STM32 ARM-Cortex M3 chip. Any new firmware can easily be developed with available tools. Eclipse, Embedded workbench, etc...

This page will be updated with our work, which most likely will be based on the excellent OpenPilot system.

One important facet of the firmware is how to turn on all the various regulators. I’m not sure yet, but it seems that it might be enough to simply enable PD11 (pin 58) on the STM32. This pin is connected to the enable pin on the TI TPS63030 voltage regulator.

Update: Success! Everything went according to theory and plan. I now can run arbitrary code on the Move, and have successfully programmed a small routine that reads all the accelerometer, gyroscope, and magnetometer axes. I will someday try to make a short tutorial showing this, but in the meantime feel free to write me and I’ll send you the project files.

Original firmware
For whatever reason, Sony chose not to lock its firmware. I actually downloaded it by accident when hooking up my STM32Discovery’s ST-Link debugger. In the resources section, I have included the firmware as read from my Move, as the ability to see how the Move communicates with the BC4 might be invaluable. I’m hoping that someone with more knowledge than I could help me figure out what’s going on. I have already erased and reflashed this firmware, so it is known good.

Resources:
Sony PS3 Move firmware

Microcontroller

2011/02/26 02:34 Filed in: microcontroller | STM32

The STM32F103VBT6 is the backbone of the Playstation Move. It combines a 72MHz ARM Cortex-M3 with a boatload of peripherals.

Read More see Pics...
http://www.eissq.com/ps3_move/

Great info!:)

Don