******

My translation of http://kako.com/neta/2008-009/2008-009.html:
Suneth Attygalle

1.
Make a shield for the Arduino and house the sensor

DIAGRAM

The components are the wii remote ir sensor and I2C voltage converting shield and an Arduiono
Diecemilia. You have convert 5V of the microcontroller to 3.3 for the sensor. He used the same
circuitry as the prior post and the schematic is posted.

The LTC4301L was used for voltage conversion, the LTC4301 works as well. This chip powers
the I2C bus.

2. software
The Arduino source code was prepared.

3. how to use the wii remote ir sensor.

I try to explain a simple way to connect to the IR sensor.

In the I2C protocol to communicate with a device each device has an address number that has to
be transmitted first. For the wii remote ir sensor, the address is 0x58. In the source code it is
written as 0xB0 but this is because the top(higher?) 7 bit is the address so the lower 1 bit is
shifted as the R/W bit.

Setting up the wii remote ir sensor with Bluetooth is much easier because you didn’t have to deal
with “chip enables” and clock oscillators.

To initialize the sensor, use the following method:

[start condition] [ 0xB0] [register address] [data to be written] [stop condition]
the control/management register address is assigned in 8 bit.
Which address does what is not fuly understood yet.

For now, with certain commands, we can get some actions from the sensor.

Initialization command procedures:

1 register address 0x30, data 0x01
2 register address 0x30, data 0x08
3 register address 0x06, data 0x90
4 register address 0x08, data 0xC0
5 register adddress 0x1a, data 0x40
6 register address 0x33, data 0x33
These will be explained below but it seems to be a way to simplify the sensitivity settings.

About adjusting the Wii remote sensitivity settings:

The above settings are the easy way to do it but if you want to specify the settings, you must
specify four parameters in the following procedure:

(1) register address 0x30 write 0x01

(2) register address 0x00 write 0x02,0x00,0x00,0x71,0x01,0x00,p0 (7 bytes)
(3) register address 0x07 write 0x00,p1 ( 2 bytes)
(4) register address 0x1A write p2,p3 (2 bytes)
(5) register address 0x33 write 0x03
(6) register address 0x30 write 0x08

For the multiple byte writes, the register address automatically increments so you can write the
bytes in succession.

The sensitivity parameters are:

Senisitivity1, p0=0x72 , p1=0x20 , p2=0x1F,p3=0x03
Sensitivity2, p0=0xC8 , p1=0x36 , p2=0x35,p3=0x03
Sensitivity3, p0=0xAA , p1=0x64 , p2=0x63,p3=0x03
Sensitivity4, p0=0x96 , p1=0xB4 , p2=0xB3,p3=0x04
Sensitivity5, p0=0x96 , p1=0xFE , p2=0xFE,p3=0x05

After initializing the sensor, it is possible to return the coordinates of a luminous point detected
by the sensor.

How to read the sensor output:

The [start condition][0xb0][0x36][stop condition] command will return the following output:
[start condition] [0xb1][dataoutput]x16 bytes.

The format of the output:

Data is stored in 3byte packets in the following order:
[leading bit 1 byte][coordinate 1…3 bytes][coordinate2…3bytes][coordinate 3… 3bytes]
[coordinate 4…3bytes]

The 3 byte packets are decoded (if considered as XX,YY,SS) using the following calculation:
X coordinate = (SS & 0x30) <<4 + XX
Y coordinate = (SS & 0xC0) <<2 + YY

If the coordinate value is invalid then 0x3FF is returned.

Assignment of control registers:

Address 0x00~0x08 – sensor parameter setting
Address 0x1A~0x1B – more sensor parameter setting
Address0x30 – sensor behavior mode (?) first written as 0x01 then later as 0x08
Address 0x33 – sensor behavior mode (?)written 0x03 (or sometimes 0x033? )
Establishing sensing parameters
Unknown:
The settings for the in-chip software on the sensor that converts a picture to the coordinates. I
wonder if there are parameters for thresholds for size of luminous points.

*****

Google translation follows

2007-001 small tip

Wii remote control infrared sensors for pointing parts analysis

The infrared remote control from the CMOS sensor board to remove the 8-(4-pin column × 2)
connectors to attach to it.
First, the eight-pin functions on inquiry. Results are as follows.

Photo on the right side of a pin board, which in turn zigzag-shaped pins are lined up.

(2007.1.31 expanded later date is the fourth-信号らしい# CE)

Then, above the IR sensor is whether the move sure to check the circuit to his own writing.

(2007.1.31 fourth pin is expanded later date, # CE signal so, GND should be dropped.)
The photo actually assembled circuit

Wii remote control IR sensor removed from the board of the contents of Vcc, SCL, SDA, GND
of only four out of line, the circuit is connected to him.
In a state of connection with the remote control to operate it, restored to confirm moving in the
IR sensor.

By the way, the Wii remote control also extended I2C port signals that have been found. Classic
or nunchaku controller and I2C communications and using the bus.
I2C is a hot-swap so the application can be used once. UIU.

Expansion Port Pin for Nunchaku / Classic Controller

1 - Vcc
2 - SCL
3 - 1, and continuity (connector connection detection)
4 - nc
5 - SDA
6 - GND
 (The fourth and classical nunchaku controller is not connected, but the remote control is
something like the power to the circuit. Vibration pack for power? KURAKON and between the
Wii remote control relay might be fitted in .)

NUNCHAKUKONTORORA the middle to cut the cable,

(Wii remote control w / o IR sensor) → (Homemade & IR sensor board relay connector) →
(NUNCHAKUKONTORORA)
In the form of, IR port, the sensor board to extend it, Wii remote control sensor is removed from
the IR remote control outside the IR sensor capabilities we were able to work out.

3-pin expansion port has been found in the state of the cable cut by the middle of
NUNCHAKUKONTORORA will not lead the state to freeze the Wii remote control. Do not
freeze the above relay in a manner that can be connected. (2007.1.30 expansion ports, expanding
later date No. 1 and No. 3 pin-up and continuity of the freeze, and then tried to reproduce it
failed. Probably miss working with other signals short of the freeze I think.)

Not just IR sensor, I2C bus, if you can connect devices, Wii remote control port expansion can
be. Wii remote control means you do-it-yourself peripherals to extend it is possible.
 In other words,
1 ... I2C port extended the application of some kind of signal wire I2C devices connected to the
peripherals to operate in a do-it-yourself can be.
Application of two expansion ports ... Connecting to a PC remote control, command and every
other state, I2C signal lines to connect to another master of the remote control from outside the
remote control device of the internal I2C EEPROM and access You can.

Inside the remote control attached to the bus I2C EEPROM is present. Mii's Bluetooth ID
seems to record the data. So far, but unconfirmed reports, EEPROM Wii remote control CPU is
loaded and executed like a binary OBOSHIKI have been recorded, it seems, this is true
EEPROM renewal of arbitrary code with Wii Remote Control On the run might be possible to
hack. EEPROM is the application of the above two ways expansion ports, you can retrieve it is
possible, but is difficult to rewrite. Also via Bluetooth, EEPROM in the back of the address is
unable to read and write in the lock. EEPROM to disassemble the remote control to remove non-
renew a direct way is not so good.

Then, Homemade IR sensor board, Wii remote controls and other devices connected to the I2C
master it.
And write at a conclusion, IR sensors to send and receive commands as well as the Wii remote
control and infrared sensor bar that can detect the source. (2007.1.25)

PC in order to use the I2C bus, DeVaSys's USB-I2CIO the use of peripherals. USB connection
to PC, I2C devices function as a master. In addition to general-purpose I / O functions with.

Wiring, Vcc (3.3V), GND, SCL, SDA as the four connected.

 Pinout

|~~_____~~|

| |

| 6 4 2 |

| ----- |

| 5 3 1 |

\_________/

From the Wiimote side

Pin Cable color Description

1 Red 3.3V

2 Green SDA. I²C Serial Data

3 Red Connected to 3.3V inside attachment connector

4 - Not connected.

5 Yellow SCL. I²C Serial Clock. (400 kHz)

6 White Ground

Notes
Small stories 2008-009

Wii's remote controller connected to microcontroller infrared sensors to try to use the (+ mouse),
 Last year (2007), Wii remote control infrared sensors for analysis pointing to a way to connect
to other devices tried.
Following that, this time, AVR microcontroller using a Arduino experimental kit to connect to
the circuit did. (2008-04-13)

1. Hardware

Arduino board kit is a universal substrate over for trial.

In the case of a white rod-like Wii Remote sensors and pulled from his own circuit has.
Connection, this figure is connected to.

Wii remote control infrared sensor circuit voltage I2C Arduino Diecimila Shield
In more than three parts are organized.
Infrared sensor operates on 3.3V and, 5V microcontrollers in the works to connect to the need
for voltage conversion.

Wii remote control infrared sensor circuit, a circuit before the same thing and then re-compact.

I2C voltage conversion sealed the Prototype Shield for a prototype using a universal substrate.

I2C shield voltage conversion, Aruduino on board to connect to another.

I2C-voltage conversion circuit, LTC4301L made using the IC.
This IC, I2C bus to convert the voltage. LTC4301L not, LTC4301, but should be moving.

2. SOFTWARE

The last time the original source code, Arduino software was created for.
[Wii_remote_ir_sensor_sample.zip - source code (download)]

(2008-09-21 expanded at a later date)

WinAVR rewriting the software I use.
[Wii_remote_ir_sensor_sample2.zip - source code (download)]

Using the Wii remote control infrared sensor

Using simple sensors to try to write the commentary.

I2C bus protocol standards, to communicate with the device, the first device to address the need
to send.
Wii remote control is used to address the infrared sensor, 0x58.
0xB0 to the source code can be written and will address it in the top seven bits, one bit lower R /
W bit to be specified, is to shift.

Initialization of the sensor, Wii remote control to the internal sensor via Bluetooth to access
more easily.
Because the chip enable and control the clock oscillation circuit ON / OFF control is not.

Initialization commands sent to the following format.

[START conditions] [0xB0] [control register address] [Write] [STOP condition]
The address of the control register, 8bit specified.
What is the address of which is functional, but do not know in detail.
First of all, I write in a certain step level and the sensor and to be able to work.

Command initialization procedure (1) control register address 0x30 to 0x01 to write data (2) for
control register address 0x30, 0x08 to write data (3) for control register address 0x06, 0x90 data
to write ( 4) for control register address 0x08, 0xC0 written to a data (5) control 0x1A register
addresses to write data to 0x40 (6) for control register address 0x33, 0x33 to write the data,
described below Sensitivity to a set of simplified procedures such as MONORASHII.

Infrared sensors on the sensitivity of the above, how to set up a simple as setting, but if you want
to set the four parameters p0, p1, p2, p3, specifying the steps to write the following: (1) Register
address control 0x30, 0x01 to write data (2) for control register address 0x00, 0x02, 0x00, 0x00,
0x71, 0x01, 0x00, p0 to write (7-byte write)
(3) for control register address 0x07, 0x00, p1 write a (2-byte write)
(4) for control register address 0x1A, p2, p3 write a (2-byte write)
(5) for control register address 0x33, 0x03 to write data (6) for control register address 0x30,
0x08 to write data at multiple-byte write increment the register address will be automatically be
able write in a row .

The parameters of sensitivity,

If one of sensitivity, p0 = 0x72, p1 = 0x20, p2 = 0x1F, p3 = 0x03
If the two sensitivity, p0 = 0xC8, p1 = 0x36, p2 = 0x35, p3 = 0x03
3 sensitivity of the case, p0 = 0xAA, p1 = 0x64, p2 = 0x63, p3 = 0x03
4 In the case of sensitivity, p0 = 0x96, p1 = 0xB4, p2 = 0xB3, p3 = 0x04
5 sensitivity of the case, p0 = 0x96, p1 = 0xFE, p2 = 0xFE, p3 = 0x05

After the initialization (after the sensitivity setting), a sensor to detect the coordinates of the spot
of light that can be read.

How to read sensor output [START conditions] [0xB0] [0x36] [STOP KONTISHON]
After sending the command, read as follows.
[START conditions] [0xB1] [data readout] x 16bytes

3 bytes of data each read the following format that is stored in the order.
[Back 1byte] [coordinates 1 ... 3bytes] [coordinate 2 ... 3bytes] [coordinate 3 ... 3bytes]
[coordinate 4 ... 3bytes]

This 3-byte, XX, YY, SS, and

X coordinate = (SS & 0x30) <<4 + XX
Y coordinate = (SS & 0xC0) <<2 + YY
By that calculation, the value of coordinates can be obtained.

If an invalid value to coordinate the return 0x3FF.

Address the role of the control register 0x00 ~ 0x08 --- set parameters for detection address
0x1A ~ 0x1B --- set parameters for detection (2)
0x30 --- address the behavior of the sensor mode (?) In the first post 0x01, 0x33 --- address and
then write a 0x08 mode of operation of the sensor (?) 0x03 (or 0x33?) To write

Setting the parameters for the detection of unknown camera and image processing to detect a
spot of light sensor inside the software to set the parameters of the threshold value of two values,
or the size of the spot of light or the parameters of the threshold value I guess there is not.

(2008-10-06 expanded at a later date)

Some of the parameters that have apparently found.
http://wiki.wiimoteproject.com/IR_Sensor many pages that have information.

Wii remote control using infrared sensors use a mouse to give it a try

Previously, Wii remote controls placed on the desk with the built-in remote control using
infrared sensors determine the amount of moving around and can detect whether or not tried.
The sensor bar like the genuine side to side and stood around in two-point light sources (depth)
to detect the direction of the movement of the amount available, but the precision of mouse that
did not used to it.

The optical system to external components, the amount of moving around in the direction of an
accurate and thought about how to detect. (2008-08-05)
Wii remote control will slide easily on a desk to lay a mouse pad.
In the upper left of the mouse pad and a fixed-infrared light-emitting diodes.
On the left than the light-emitting diodes, light emitting diodes in the upper keep a high level.
The Wii remote control infrared sensors to the end of the half-mirror mounted on a slope of 45
degrees. Wii remote control to work together to install.
Half the effect of mirrors, infrared sensors and the left upper light-emitting diodes can be
detected at the same time.
 Remote control to move from side to side and top spot of light-emitting diodes on both sides of
the screen as the movement is detected.
Move back and forth with the remote control, left the spot of light-emitting diodes on the screen,
"influence" as the movement is detected.
In other words, two points on the screen can detect the spot of light, each move from side to
side.
Both the top spot of light on the left or to determine the upper high-emitting diode to the height
of the screen is on the top spot of light on the direction of the light-emitting diodes.
The amount of movement of light spot on the screen of the X-axis movement of the mouse / Y
axis movement to convert the software to process it, Wii's remote control sensor can be used as a
mouse.
However, the necessary software to process, so now the Wii remote-control software on the PC
was created only if you can not use.

Using the half-way mirror last year (2007) was the beginning of 思 ITSUI around, but to get the
half-mirrors to create real time hanging out.
A mouse games with the Wii

In the analysis of the infrared sensor, the coordinates for the remote control to respond to any
signals coming out of the sensors know.
Give the same signal to their own circuits, infrared sensors and other pointing devices output
from the Wii remote to connect to the board, for example, can manipulate with a mouse might be
Wii. (2008-08-05)

Sparkfun site about 3.3V to 5v interface

http://www.sparkfun.com/commerce/tutorial_info.php?tutorials_id=65

From labview code below

The Data Reporting Mode is set by sending a two-byte command to Report 0x12:

(52) 12 TT MM

Bit 2 of TT specifies whether continuous reporting is desired. If bit 2 (0x04) is set, the Wiimote
will send reports whether there has been any change to the data or not. Otherwise, the Wiimote
will only send an output report when the data has changed.

MM specifies the Reporting Mode. Each Mode is specified by the Output Report ID that the data
will be sent to. For example, this will set mode to 0x33:

(52) 12 00 33

Data will then arrive through Input Report 0x33.

0x30: Core Buttons

0x31: Core Buttons and Accelerometer
0x32: Core Buttons with 8 Extension bytes
0x33: Core Buttons and Accelerometer with 12 IR bytes
0x34: Core Buttons with 19 Extension bytes
0x35: Core Buttons and Accelerometer with 16 Extension Bytes
0x36: Core Buttons with 10 IR bytes and 9 Extension Bytes
0x37: Core Buttons and Accelerometer with 10 IR bytes and 6 Extension Bytes
0x3d: 21 Extension Bytes
0x3e / 0x3f: Interleaved Core Buttons and Accelerometer with 36 IR bytes
From Wikipiedia

Register Memory Map

Register Memory Map
0xB00000 UNKNOWN
0xB00001 0x00
0xB00002 0x00
0xB00003 0x71
0xB00004 0x01
0xB00005 0x00
0xB00006 MAXSIZE
0xB00007 0x00
0xB00008 GAIN

0xB0001A GAINLIMIT
0xB0001B MINSIZE

0xB00030 CONTROL

0xB00033 MODE

UNKNOWN: Wii uses values: 2 (standard) and 7 (max sensitivity). No known

function.
MAXSIZE: Maximum blob size. Wii uses values from 0x62 to 0xc8.
GAIN: Sensor Gain. Smaller values = higher gain.
GAINLIMIT: Sensor Gain Limit. Must be less than GAIN for camera to function. No
other effect?
MINSIZE: Minimum blob size. Wii uses values from 3 to 5
CONTROL: Write 1 before configuring camera, 8 when done.
MODE: output format, 1, 3, or 5. See output formats below.
Other values: As used by Wii. Function not known.

These registers are mirrored every 0x100 bytes up to 0xB1FFFF

Wavelengths
The following section or page relates to parts of the Wii Remote that are poorly understood.
Research and contribution in these areas is encouraged.

The sensor is at least 5 times more sensitive to 940nm than 850nm. This disparity
increases slightly with the removal of the filter window. Relative sensitivity to visible
is not known.
 Initialization
Eight commands need to be issued to initialize the camera and request data from it.
After each command, wait for the 0x22 command status report and re-issue the
command if it isn't received in a reasonable time. Note that all writes are to register
addresses (set 0x04 bit in first byte of the write report payload).

1. Enable IR Pixel Clock (report 0x13)

2. Enable Camera (report 0x1A)
3. Configure Camera:
1. Write 0x01 to register 0xb00030
2. Write configuration block 1 to registers 0xb00000-08 (9 bytes)
3. Write configuration block 2 to registers 0xb0001A-1B (2 bytes)
4. Write mode number to register 0xb00033
5. Write 0x08 to register 0xb00030
4. Select output report compatable with mode (report 0x12)

Configuration
The camera configuration is somewhat unknown. Shutter time and frame rate
appear to be directly determined by the pixel clock, which is an external input not
controllable via software. The following settings, however, can be controlled over
bluetooth:

Sensor Gain
The byte labeled GAIN controls the camera gain. Lower values result in higher
sensitivity. Numerical gain is proportional to 1 / 2 ^ (n/16) for n <0x40, but decreases
more linearly after that. Translation: for small values, dropping this value by 0x10
doubles sensitivity. Usable values are from about 15 to 254. Below that results in
noise and streaking becomes significant and the camera doesn't function for a value
of 255.

A configuration byte in the second block, GAINLIMIT, must have a value less than
GAIN for the camera to function. Otherwise it appears to have no effect. This byte
may be related to an automatic gain control feature, but the enable for this feature
has not been found.

Blob Size Range

 The bytes labeled MAXSIZE and MINSIZE controls the range of a blob sizes that
will be reported. The numbers appear to be approximately the number of sensor
pixels in the blob blob can occupy.

For max, the Wii uses values in the range 0x62 to 0xC8, but values as low as 0x20
can be useful in specialized situations. Small values can be useful for controlling
background noise and if point merging when tracking multiple points would have
negative consequences. Large values allow large, unfocused, or diffuse blobs to be
tracked.

For min, very small numbers work best. The Wii uses values from 3 to 5, depending
on sensitivity settings.

Output Formats
Short
Output Mode value: 1

Usable with reports 0x36 and 0x37

BYTE BIT 7 Six Five Four Three Two One BIT 0

0 X0 [7:0]
One Y0 [7:0]
Two Y0 [9:8] X0 [9:8] Y1 [9:8] X1 [9:8]
Three X1 [7:0]
Four Y1 [7:0]
Five X2 [7:0]
Six Y2 [7:0]
Seven Y2 [9:8] X2 [9:8] Y3 [9:8] X3 [9:8]
7 X3 [7:0]
Nine Y3 [7:0]

Medium
Output Mode value: 3

Usable with report 0x33

The following structure is repeated 4 times.

BYTE BIT 7 Six Five Four Three Two One BIT 0

0 X [7:0]
One Y [7:0]
Two Y [9:8] X [9:8] S
Long
Output Mode value: 5

Usable with report 0x3E / F

The following structure is repeated twice in each report.

BYTE BIT 7 Six Five Four Three Two One BIT 0

0 X [7:0]
One Y [7:0]
Two Y [9:8] X [9:8] S
Three 0 XMIN
Four 0 YMIN
Five 0 XMAX
Six 0 YMAX
Seven 0 0 0 0 0 0 0 0
7 INTENSITY

0x33 BTN + XLR + IR

Input Report 0x33
Payload Length: 17th
Purpose: User Input: Buttons, Accelerometer, IR Sensor
BYTE BIT 7 Six Five Four Three Two One BIT 0
0 ? XLRLSB XLRLSB PLUS UP DOWN RIGHT LEFT
One HOME XLRLSB XLRLSB MINUS A B ONE TWO
Two XLR.X
Three XLR.Y
Four XLR.Z
Five IR0

16 - IR11

Values:
XLRLSB: least significant bits of the accelerometer data. Which bits are what has
not been determined.
XLR: Acceleration detected along each axis. See Accelerometer
IR: Data from IR sensor in medium form.

Discussion: See Accelerometer and IR Sensor.

0x34 BTN + 19 EXT

 Input Report 0x34
Payload Length: 21st
Purpose: User Input: Buttons and 19 Extension bytes
BYTE BIT 7 Six Five Four Three Two One BIT 0
0 ? ? ? PLUS UP DOWN RIGHT LEFT
One HOME ? ? MINUS A B ONE TWO
Two EXT0

20 of EXT18

Values:
EXT n: Byte of data from extension controller.

Discussion: See Extensions.

0x35 BTN + XLR + 16 EXT

Input Report 0x35
Payload Length: 21st
Purpose: User Input: Buttons, Accelerometer, 16 Extension Bytes
BYTE BIT 7 Six Five Four Three Two One BIT 0
0 ? XLRLSB XLRLSB PLUS UP DOWN RIGHT LEFT
One HOME XLRLSB XLRLSB MINUS A B ONE TWO
Two XLR.X
Three XLR.Y
Four XLR.Z
Five EXT0

16 - EXT16

Values:
XLRLSB: least significant bits of the accelerometer data. Which bits are what has
not been determined.
XLR: Acceleration detected along each axis. See Accelerometer.
EXT: Data from extension.

Discussion: See Accelerometer and Extensions.

0x36 BTN + IR + 9 EXT

Input Report 0x37
Payload Length: 21st
Purpose: User Input: Buttons, IR Sensor, Extension
BYTE BIT 7 Six Five Four Three Two One BIT 0
0 ? ? ? PLUS UP DOWN RIGHT LEFT
 One HOME ? ? MINUS A B ONE TWO
Two IR0

IR9
November
EXT0
December

20 of EXT9

Values:
IR: Data from IR sensor in short form.
EXT: Data from extension.

Discussion: See IR Sensor and Extensions.

0x37 BTN + XLR + IR + 6 EXT

Input Report 0x37
Payload Length: 21st
Purpose: User Input: Buttons, Accelerometer, IR Sensor, Extension
BYTE BIT 7 Six Five Four Three Two One BIT 0
0 ? XLRLSB XLRLSB PLUS UP DOWN RIGHT LEFT
One HOME XLRLSB XLRLSB MINUS A B ONE TWO
Two XLR.X
Three XLR.Y
Four XLR.Z
Five IR0

14th IR9
Fifteen EXT0

20 of EXT5

Values:
XLRLSB: least significant bits of the accelerometer data. Which bits are what has
not been determined.
XLR: Acceleration detected along each axis. See Accelerometer
IR: Data from IR sensor in short form.
EXT: Data from extension.

Discussion: See Accelerometer, IR Sensor and Extensions.

IR Sensor

During R&D, Nintendo discovered the motion sensors were not accurate enough to use the
remote to control an on-screen cursor. To correct this, they augmented the remote with an
infrared image sensor on the front designed to locate two IR beacons within the controller's field
of view. The beacons are housed within a device misleadingly called the sensor bar. The sensor
bar is powered by the Wii base unit, and contains 2 groups of IR LEDs, spaced 7.5 inches apart.
Each group is composed of 5 LEDs, but homemade sensor bars have been effective with fewer
LEDs, so long as the intensity is sufficient. The cable from the Wii to the sensor bar only carries
power. No information is passed either to or from the sensor bar, and the intensity is not
modulated in any way.

These two sources of IR light are tracked by a PixArt sensor in the front of the Wiimote housing.
By tracking the locations of these two points in the sensors 2D field of view, the system can
derive more accurate pointing information. Not much is known about this feature yet, but
circumstantial evidence from the Nintendo/PixArt press release suggests that Nintendo is using a
PixArt System-on-a-Chip to process the images on-board the Wiimote and sends the minimum
information needed for tracking back to the base unit. Transmitting full 2D images constantly
would require a prohibitive amount of bandwidth, especially when multiple remotes are in use.

Wiimote detects and transfers up to four IR hotspots back to the host. Various amounts of data
can be requested, from position values only, position and size, to position, size and pixel value.
The amount of different configurations are quite numerous, and also ties in with the connected
peripheral device.

[edit]

marcan's info

Here are the reports you need to send to activate IR transmission:

(52) 12 00 33
(52) 13 04
(52) 1A 04
(52) 16 04 B0 00 30 01 08 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00
(52) 16 04 B0 00 06 01 90 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00
(52) 16 04 B0 00 08 01 C0 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00
(52) 16 04 B0 00 1A 01 40 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00
(52) 16 04 B0 00 33 01 33 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00
Output format EXP is three bytes per dot recognized. Bytes 0 and 1 are X and Y, byte 2 is the
LSBs of X and Y and a size value. In binary:

xxxxxxxx yyyyyyyy yyxxssss

No dot is indicated by 0xff data. This means you will not see any change in the output data even
if you did do all the initialization correctly, unless you actually point the Wiimote at a (powered)
sensor bar!

Output format for FULL is unknown, but we know the data is interleaved. Data sent to report
0x3e contains the data for the first two dots recognized, data sent to 0x3f contains the data for the
next two dots recognized, if any.

Note that the original hidd patch has trouble with 0x00 bytes in commands. Make sure you're
sending the right data.

[edit]

Cliff's info

Set the report 0x12 to a report number such as 0x33.

You need to start by setting reports 0x13 and 0x1a to 0x04 to enable transmission.

Then to activate the IR Sensor you need to write to the wiimote's memory. Set 0x04b00030 to 1,
then set the sensitivity, then set 0x04b00033 to 5, then set 0x04b00030 to 8.

The sensitivity data is 9 bytes at 0x04b00000 and 2 bytes at 0x04b0001a. For midrange
sensitivity, it's {0x02, 0x00, 0x00, 0x71, 0x01, 0x00, 0xaa, 0x00, 0x64}, and {0x63, 0x03}.

Memory and Registers

The Wii Remote includes a built-in EEPROM memory, part of which is accessible to
the user to store that. This user part is used to store calibration constants, as well as
the Mii Data. Additionally, many peripherals on the Wii Remote have registers which
are accessible through a portion of the address space.

Both built-in memory and peripheral registers are accessed using the same reports,
where a flag is used to select between the two.

Reading and Writing

To read data, commands are sent to Output Report 0x17:

(52) 17 MM FF FF FF SS SS

FF FF FF is the offset, and SS SS is the size to read in bytes (both in big-endian

format). Bit 2 (0x04) of MM selects the address space. Clearing this bit results in
reading from EEPROM Memory, while setting it results in reading from the control
registers. Setting bit 3 (0x08) also works to access registers, but setting both results
in errors. As with all other reports, it also includes the Rumble flag, which must be
set to the current rumble state to avoid affecting it.

Data read is returned through Input Report 0x21:

(a1) 21 BB BB SE FF FF DD DD DD DD DD DD DD DD DD DD DD DD DD DD
DD DD

BB BB is the state of the buttons on the Wii Remote. During data reads, regular
input reporting is temporarily suspended. Button data is available through the data
input reports, but no other input data can be collected while the transfer lasts. FF FF
is the offset expressed in absolute memory address of the Wii remote memory for
the first byte of data returned (the high byte of the offset is not returned, and neither
is which data memory is being used. Thus, this must be known from the read
request). E (low nybble of SE) is the error flag. Known error values are 0 for no
error, 7 when attempting to read from a write-only register, and 8 when attempting to
read from nonexistant memory. S (high nybble of SE) is the size in bytes, minus
one, for the current data packet. This is 0xf (16 bytes) for all but the last packet,
where it might be less if the requested number of bytes is not a multiple of 16. The
DD bytes are the data, padded with zeroes to 16 bytes. If more than 16 bytes are
requested, multiple packets will be received, with FF FF offsets increasing by 16
each time.

To write data, commands are sent to Output Report 0x16:

(52) 16 MM FF FF FF SS DD DD DD DD DD DD DD DD DD DD DD DD DD DD
DD DD

The meaning of the bytes is the same as during reads, except that size can be a
maximum of 16 bytes (as there is only space for that much data), and the actual
data to write follows (the DD bytes), padded out to 16 bytes.

Some kind of acknowledgement is received on Input Report 0x22. This has not been
investigated yet.
EEPROM Memory
There is a 128kbit (= 16kB) EEPROM chip (Data Sheet / Full EEPROM dump from a
sample Wii Remote) in the Wii Remote. Part of its contents include code for the
built-in microcontroller, and a generic section which can be freely read and written
by the host. This section is 0x1700 bytes long, and part of this memory is used to
store the Mii Data. It can be accessed by reading from/writing to addresses 0x0000-
0x16FF in the Wii Remote's virtual memory space; in the actual EEPROM chip, the
data is located at 0x0070-0x176F.

The BCM2042 microcontroller built into the Wii Remote includes a large 108kb on-
chip ROM section for storing firmware. If the EEPROM chip really contains code for
the BCM2042 then this was probably done to make firmware updates possible, so
there might be a way of accessing the other parts of the EEPROM via Bluetooth as
well. From the BCM2042 Product Brief: "ROM-based design eliminates external
flash memories; Flash option offered to support feature development".

On a virgin Wii Remote, acquired separately (not bundled with a Wii), that has never
communicated with any device (except the PC used to dump the memory contents),
most of the memory is blank (0x00). However, the first few bytes contain some
information:

0000: A1 AA 8B 99 AE 9E 78 30 A7 74 D3 A1 AA 8B 99 AE
0010: 9E 78 30 A7 74 D3 82 82 82 15 9C 9C 9E 38 40 3E
0020: 82 82 82 15 9C 9C 9E 38 40 3E 00 00 00 00 00 00
0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

This can be better visualized as two sequences, each one repeated twice:

0000: A1 AA 8B 99 AE 9E 78 30 A7 74 D3
000B: A1 AA 8B 99 AE 9E 78 30 A7 74 D3
0016: 82 82 82 15 9C 9C 9E 38 40 3E
0020: 82 82 82 15 9C 9C 9E 38 40 3E

It is not yet clear why these sentences are repeated; but since at least the second
one is known to be calibration data, maybe one version contains the calibration data
that is actually being used, while the other version is meant for backup purposes (for
example a "Return to factory settings" option) in case there will be a way of
recalibrating the Wii Remote with future Wii firmware updates.

The three bytes starting at 0x0016 and 0x0020 store the calibrated zero offsets for
the accelerometer. Apparently, the three bytes at 0x001A and 0x24 store the force
of gravity on those axes. The function of other data bytes is not known, and most of
them differ between Wii Remotes. Some or all of these bytes might not be used by
the Wii. However, there has been a case of a Wii Remote where Extension
functionality was lost following a battery change, and restoring these bytes (which
had been previously overwritten) fixed the problem. The Extension controllers did
not work with a PC either (which did not explicitly use these bytes), suggesting some
of these might be used by the Wii Remote itself. This is unconfirmed, but it is
advised that these never be overwritten, and recommended that they be backed up,
just in case.

At 0x16D0, there is some more unknown data:

16D0: 00 00 00 FF 11 EE 00 00 33 CC 44 BB 00 00 66 99
16E0: 77 88 00 00 2B 01 E8 13 00 00 00 00 00 00 00 00
16F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

In contrast to the data at 0x0000, this data seems to differ in only a few bytes
between different Wii Remotes.

Known memory ranges are listed below. Note that the "user data" area is 0x0FA0 =
4000 bytes long, which seems to confirm the 4kB figure that has been mentioned
(meaning 4000 bytes, that is, using the SI prefix meaning instead of the binary
meaning).

Start End Length Initial Value Use

0x0000 0x0029 0x002A See above Calibration values / pre-set data
0x002A 0x0FC9 0x0FA0 Zeroed User data / Unknown uses
0x0FCA 0x12B9 0x02f0 Zeroed Mii Data block 1
0x12BA 0x15A9 0x02f0 Zeroed Mii Data block 2
0x15AA 0x16CF 0x0126 Zeroed Unknown / Unused
0x16D0 0x16FF 0x0030 See above Unknown data

The top byte of the address is unused, which means memory is mirrored every
0x10000 bytes. Reading from unused addresses where the low 16 bits are >=
0x1700 will result in error returns.

Control Registers
The Wii Remote has several memory mapped register spaces corresponding to
different peripherals in it. These include the Speaker, Extension Controllers, and the
IR Camera.
 Reminder
Remember to set bit 2 (0x04) on the first byte of the Output Report, otherwise you'll
overwrite EEPROM memory!

The peripheral to access is selected by the first byte of the address, and the lower
16 bits specify the register to access within that peripheral. The lowest bit of the high
byte is ignored, which means every peripheral is mirrored at its address + 0x10000.
Known peripherals are listed below:

Start End Use

0xA20000 0xA20009 Speaker settings
0xA40000 0xA400FF Extension Controller settings and data
0xB00000 0xB00033 IR Camera settings

Most of these are also mirrored across the high bits of the individual peripheral. For
example, the second byte of the address is ignored in the Extension controller
address, which means any address of the form 0xA4xx00 will work (as will
0xA5xx00).

Input Features
The Wii Remote has two input features that are controlled directly by the Broadcom
chip: a Three-Axis Accelerometer and 11 Buttons. Additionally, it has an IR Camera
with an object tracking processor, and an expansion port that allows for external
input features such as those contained in the Nunchuk and the Classic Controller
(see Extension Controllers.

Buttons
The Wii Remote has 11 buttons on its front face, and one trigger-style button on the
back. Of these, the Power button is special and is treated differently by the Wii
Remote. All the other buttons are independantly accessible through a two-byte
bitmask which is transmitted first in most Input Reports. A button will report a 1-bit if
pressed, or a 0-bit otherwise. By default, these are sent only when the state of any
button changes, in Data Reporting Mode 0x30. However, the Wii Remote may be
configured to report the state of the buttons continuously; see Data Reporting.

Core Buttons
The Wii Remote has 11 buttons that are used as regular input devices: A, B
(trigger), a 4-directional D-Pad, +, -, Home, 1, and 2. These are reported as bits in a
two-byte bitmask. These are the assignments, in big-endian order:

Bit Mask First Byte Second Byte

0 0x01 D-Pad Left Two
1 0x02 D-Pad Right One
2 0x04 D-Pad Down B
3 0x08 D-Pad Up A
4 0x10 Plus Minus
5 0x20 Other uses Other uses
6 0x40 Other uses Other uses
7 0x80 Unknown Home

Power Button
When the Wii Remote is turned off, pressing the Power button will attempt to wake
up the Wii that is synchronized to it. The mechanism for this is unknown, and it is
handled entirely within the Wii's bluetooth module. When the Wii Remote is turned
on and connected to a host, pressing and holding the Power button for a few
seconds will turn the Wii Remote off and request disconnection from the host. The
disconnection reason included with the Baseband (ACL) disconnection request
indicates that the power button was pressed: REMOTE DEVICE TERMINATED
CONNECTION DUE TO POWER OFF (0x15). Another possible value is REMOTE
DEVICE TERMINATED CONNECTION DUE TO LOW RESOURCES (0x14), which
indicates that the Wii Remote performed a controlled shut down due to a low battery
condition.

Accelerometer

Coordinate system used by Wii Remote

The Wii Remote includes a three-axis linear accelerometer located slightly left of the
large A button. The integrated circuit is the ADXL330 (data sheet), manufactured by
Analog Devices. This device is physically rated to measure accelerations over a
range of at least +/- 3g with 10% sensitivity.

Since the accelerometer actually measures the force exerted by a set of small proof
masses inside of it with respect to its enclosure, the accelerometer measures linear
acceleration in a free fall frame of reference. If the Wii Remote is in free fall, it will
report zero acceleration. At rest, it will report an upward acceleration (+Z, when
horizontal) equal to the acceleration due to gravity, g (approximately 9.8 m/s²). This
fact can be used to derive tilt from the acceleration outputs when the Wii Remote is
reasonably still.

Normal Accelerometer Reporting

In all Data Reporting Modes which include Accelerometer data except for mode
0x3e/0x3f, the accelerometer data is reported as three consecutive bytes:

(a1) RR BB BB XX YY ZZ [...]

XX, YY, and ZZ are unsigned bytes representing the acceleration in each of the
three axis, where zero acceleration is approximately 0x80. The coordinate system is
shown in the diagram above. Additionally, the BB BB Buttons bytes also include the
LSBs of the acceleration values in the unused bits, according to the following table:

Bit
Byte 7 6 5 4 3 2 1 0
0 X<1:0>
1 Z<1> Y<1>

Note that X has 10 bits of precision, while Y and Z only have 9. For consistency,
they are assumed all to have a 10-bit range and the LSB is always set to zero for Y
and Z.

Interleaved Accelerometer Reporting

In Data Reporting Mode 0x3e/0x3f, the accelerometer data is spread over two
reports:

(a1) 3e BB BB XX [...]
(a1) 3f BB BB YY [...]
In this mode, the LSBs are not available. Instead, X and Y acceleration is reported
as a single byte, and the Z value is encoded in the unused bits of the BB BB Buttons
data as follows:

Bit
Report ID Byte 7 6 5 4 3 2 1 0
0x3e 0 Z<5:4>
0x3e 1 Z<7:6>
0x3f 0 Z<1:0>
0x3f 1 Z<3:2>

IR Camera
The Wii Remote includes a 128x96 monochrome camera, with an IR-pass filter in
front of it. The camera includes a built-in processor capable of tracking up to 4
moving objects (raw pixel data is not available to the host). 8x subpixel analysis is
used to provide 1024x768 resolution for the tracked points. The Sensor Bar that
comes with the Wii includes two IR LED clusters at each end, which are tracked by
the Wii Remote to provide pointing information. With the IR-pass filter intact, 940nm
sources are detected with approximately twice the intensity of equivalent 850nm
sources, but are not resolved as well at close distances. If the filter is removed, it
can track any bright object.

The IR Camera is enabled by setting bit 2 on output reports 0x13 and 0x1a:

(52) 13 04
(52) 1a 04

The first enables a 24MHz pixel clock on pin 7 of the camera. The second pulls pin 4
low - probably an active-low enable.

Initialization
Reminder
Remember to set bit 2 (0x04) on the first byte of the Output Reports to write to
registers!

The following procedure should be followed to turn on the IR Camera:

1. Enable IR Camera (Send 0x04 to Output Report 0x13)

 2. Enable IR Camera 2 (Send 0x04 to Output Report 0x1a)
3. Write 0x08 to register 0xb00030
4. Write Sensitivity Block 1 to registers at 0xb00000
5. Write Sensitivity Block 2 to registers at 0xb0001a
6. Write Mode Number to register 0xb00033
7. Write 0x08 to register 0xb00030 (again)

After these steps, the Wii Remote will be in one of 3 states: IR camera on but not
taking data, IR camera on and taking data and half sensitivity, IR camera on and
taking data at full sensitivity. Which state you end up in appears to be pretty much
random. Repeat the steps until you're in the desired state. To avoid the random
state put a delay of at least 50ms between every single byte transmission.

The Wii preforms these steps slightly different, differences in bold:

1. Enable IR Pixel Clock (send 0x06 to Output Report 0x13)

2. Enable IR Logic (send 0x06 to Output Report 0x1A)
3. Write 0x01 to register 0xb00030
4. Write Sensitivity Block 1 to registers at 0xb00000
5. Write Sensitivity Block 2 to registers at 0xb0001a
6. Write Mode Number to register 0xb00033
7. Write 0x08 to register 0xb00030 (again)
Sensitivity Settings
Sensitivity is controlled by two configuration blocks, 9 bytes and 2 bytes long. The
following settings are known to work:

Block 1 Block 2 Notes

00 00 00 00 00 00 90 00 C0 40 00 Suggested by Marcan
02 00 00 71 01 00 aa 00 64 63 03 Suggested by Cliff
00 00 00 00 00 00 90 00 41 40 00 Suggested by inio (max sensitivity)
02 00 00 71 01 00 64 00 fe fd 05 Wii level 1
02 00 00 71 01 00 96 00 b4 b3 04 Wii level 2
02 00 00 71 01 00 aa 00 64 63 03 Wii level 3 (also Cliff's suggestion)
02 00 00 71 01 00 c8 00 36 35 03 Wii level 4
07 00 00 71 01 00 72 00 20 1f 03 Wii level 5
The last byte of both blocks determines the intensity sensitivity, with increasing
values reducing the sensitivity. The Wii Remote will return data for the dimmest
objects possible when the last byte of block 1 is 0x41, and second byte of block 2 is
0x00. Setting the sensitivity as high as possible, without unwanted light being
tracked, is recommended to achieve the highest subpixel resolution. As the
sensitivity is reduced, the subpixel resolution also reduces, approaching the true
sensor resolution of 128x96.

Data Formats
The IR Camera can return different sets of data describing the objects it is tracking.
When the IR camera identifies an object, it assigns it to the first available object slot.
If an object moves out of view, its slot is marked as empty (returns 0xFF data), but
other objects retain their slots. For example, if the camera is tracking two objects
and the first moves out of view, the data returned will be [empty, second object,
empty, empty]. With more than four objects visible, the camera is prone to rapidly
switching between some of them. This could allow perception of more than four
objects, at a reduced response speed and reliability.

Mode Mode Number

Basic 1
Extended 3
Full 5

The data format MUST match the number of bytes available in the Reporting Mode
selected. Even choosing a mode with space for more bytes than necessary will not
work, it has to be an exact match.

Basic Mode
In Basic Mode, the IR Camera returns 10 bytes of data corresponding to the X and Y
locations of each of the four dots. Each location is encoded in 10 bits and has a
range of 0-1023 for the X dimension, and 0-767 for the Y dimension. Each pair of
dots is packed into 5 bytes, and two of these are transmitted for a total of 4 dots and
10 bytes.

This is the data format for a pair of objects:

Bit
Byte 7 6 5 4 3 2 1 0
0 X1<7:0>
1 Y1<7:0>
 2 Y1<9:8> X1<9:8> Y2<9:8> X2<9:8>
3 X2<7:0>
4 Y2<7:0>

Extended Mode
In Extended Mode, the IR Camera returns the same data as it does in Basic Mode,
plus a rough size value for each object. The data is returned as 12 bytes, three
bytes per object. Size has a range of 0-15.

This is the data format for each object:

Bit
Byte 7 6 5 4 3 2 1 0
0 X<7:0>
1 Y<7:0>
2 Y<9:8> X<9:8> S<3:0>

Full Mode
In Full Mode, the IR Camera returns even more data, 9 bytes per object for a total of
36 bytes for all four. The data is split up between two input reports of 18 bytes each
(see Data Reporting Mode 0x3e/0x3f). The first three bytes of each object are the
same as the extended mode, and are followed by the bounding box of the pixels
included in the blob along with a deeper intensity value. The data format of each
object is:

Bit
Byte 7 6 5 4 3 2 1 0
0 X<7:0>
1 Y<7:0>
2 Y<9:8> X<9:8> S<3:0>
3 0 X min<6:0>
4 0 Y min<6:0>
5 0 X max<6:0>
6 0 Y max<6:0>
7 0
8 Intensity<7:0>