Skip to content

Instantly share code, notes, and snippets.

@Pokechu22
Last active July 15, 2019 00:41
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Pokechu22/27dfd3bde4bfa1a1fefbb301116057e2 to your computer and use it in GitHub Desktop.
Save Pokechu22/27dfd3bde4bfa1a1fefbb301116057e2 to your computer and use it in GitHub Desktop.
Wii balance board notes, based on Wii Fit (original)

Memory:

  • 80693348 through 8069335f: a bunch of shorts that contain the weight calibration values from 0x24 through 0x3b, as documented on https://wiibrew.org/wiki/Wii_Balance_Board#Calibration_Data.
  • 80693360 through 8069336f: 16 bytes that are used to temporarilly store data extension register stuff.
  • 80693370: the byte at 0x20
  • 80693371: the byte at 0x21
  • 80693372: the byte at 0x60
  • 80693373: the byte at 0x61
  • 80693374: the 4-byte checksum at 0x3c

SDA:

  • HasBBoardCalibration: 32-bit, 80695fb0. XREF: Read10From60Callback:8027439c(W), FUN_802745d8:80274788(W), FUN_802745d8:802747cc(R), FUN_80274a4c:80274a94(W), FUN_80274b40:80274c14(W), FUN_80274dfc:80274e24(W). Name is rough.
  • BBoard_0x21_temp: 1 byte, 80695fb4. XREF: FUN_8027435c:80274360(R), FUN_80274ab0:80274ae8(W), FUN_80274ab0:80274aec(*)
  • BBoard_0x20_temp: 1 byte, 80695fb5. XREF: FUN_80274340:80274344(R), FUN_80274ab0:80274b2c(*), FUN_80274ab0:80274b34(W)

Functions:

  • ReadExtensionByte(int wiimoteNum,byte *data,size_t address,WiimoteRWCallback *callback): 801537dc, eventually jumps to 8015a9e0. Reads a single byte, address must be between 0x20 and 0x23 or between 0xf1 and 0xf5.

  • ReadExtensionData(int wiimote,byte *data,size_t address,size_t size,WiimoteRWCallback *callback): 80153814, also jumps to 8015a9e0. Reads a range of bytes. The whole read range must be between 0x24 and 0x3f, or between 0x50 and 0x6f.

  • CreateRegWriteRequest(wiimotemessagecontainer *messageContainer,byte value,size_t address, WiimoteRWCallback *callback): 80153cbc. Writes a single byte to a register.

  • CreateWriteRequest(wiimotemessagecontainer *messageContainer,byte *data,size_t size, size_t address,WiimoteRWCallback *callback): 80153e70. Writes multiple bytes.

  • CreateReadRequest(wiimotemessagecontainer *messageContainer,byte *data,size_t size, size_t address,WiimoteRWCallback *callback): 80154028

  • ComputeBBoardChecksum: 802741ac. Computes the checksum based on an array of 28 values it takes from throughout memory.

  • ComputeCRC32Table: 802740e0. Helper that computes the table once.

  • whatever is at 802745d8: I have no idea but it does something important. Among other things, it starts a callback chain that reads a lot of values...

  • Read10From24Callback: 802744c8, used as callback to ReadExtensionData from above for reading 0x10 bytes from 0x24. Stores the 0 and 17kg values, and then...

  • Read8From34Callback: 80274428, used as callback for reading 8 bytes from 0x34. Stores the 34kg values, and then...

  • Read4From3CCallback: 802743a4, used as callback for reading 4 bytes from 0x3c. Stores the checksum(?) value, and then...

  • Read10From60Callback: 80274378, used as callback for reading 0x10 bytes from 0x60. Stores only the first 2 bytes read, and sets HasBBoardCalibration to true.

  • 80274ab0: reads the bytes at 0x20 and 0x21. I'm not sure how this is called.

  • 80274340: callback that copies the byte read from 0x20 to the location it actually uses for the checksum

  • 8027435c: callback that copies the byte read from 0x21 to the location it actually uses for the checksum.

Manually transcribed. Taken when not standing on the balance board. These are 256 bytes, starting at 0x04a40000, just with a simple homebrew app that calls wiiuse_read_data(3, buf, 0x4a40000, 256, callback) and prints it on the screen.

07 43 11 a2 06 a8 46 94 19 00 83 00 00 00 00 00
00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff
01 69 00 00 07 bc 11 8b 06 ba 46 52 0e 6e 18 79
0d 5d 4d 4c 15 2e 1f 71 14 07 54 51 a9 06 b4 f0
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
19 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff 00 00 ff ff 00 00 00 00 00 00 a4 20 04 02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment