Wiimote pairing?

Wiimote pairing?

[Bastien Nocera]

Heya,

I was under the impression that the Wiimote simply didn't use a PIN
code, but it seems there's a way to pair it and associate it with a
particular host by doing:
http://wiibrew.org/wiki/Wiimote#Sync_Button

I looked through my dongles, and couldn't find one that would allow me
to pass the modified host address as a PIN code as they all have "00" as
part of the address.

bluetoothd uses strings everywhere for PIN code handling. It would be
possible to change the RequestPinCode to also allow:
{string,len} RequestPinCode(object device)
without modifying the current behaviour.

What do you think?

Cheers

Reported to me through the RH bugzilla:
PS: https://bugzilla.redhat.com/show_bug.cgi?id=544564

Re: Wiimote pairing?

[Marcel Holtmann]

Hi Bastien,

> I was under the impression that the Wiimote simply didn't use a PIN
> code, but it seems there's a way to pair it and associate it with a
> particular host by doing:
> http://wiibrew.org/wiki/Wiimote#Sync_Button
> 
> I looked through my dongles, and couldn't find one that would allow me
> to pass the modified host address as a PIN code as they all have "00" as
> part of the address.
> 
> bluetoothd uses strings everywhere for PIN code handling. It would be
> possible to change the RequestPinCode to also allow:
> {string,len} RequestPinCode(object device)
> without modifying the current behaviour.

that is no really how D-Bus would handle strings. From a D-Bus point of
view, the only way would be using a Byte array.

Potentially we could allow implementing a passkey agent as a plugin and
then you could implement special handling via a plugin. Problem then
again is how to identify that it is a Wiimote. Or did they actually
added a PnP SDP record to it. It has been so long that I hacked on these
devices.

Regards

Marcel

Re: Wiimote pairing?

[Bastien Nocera]

On Sat, 2009-12-05 at 15:50 +0100, Marcel Holtmann wrote:
> Hi Bastien,
> 
> > I was under the impression that the Wiimote simply didn't use a PIN
> > code, but it seems there's a way to pair it and associate it with a
> > particular host by doing:
> > http://wiibrew.org/wiki/Wiimote#Sync_Button
> > 
> > I looked through my dongles, and couldn't find one that would allow me
> > to pass the modified host address as a PIN code as they all have "00" as
> > part of the address.
> > 
> > bluetoothd uses strings everywhere for PIN code handling. It would be
> > possible to change the RequestPinCode to also allow:
> > {string,len} RequestPinCode(object device)
> > without modifying the current behaviour.
> 
> that is no really how D-Bus would handle strings. From a D-Bus point of
> view, the only way would be using a Byte array.

Yeah, true. so:
ByteArray RequestPinCode(object device)
(in addition to the current one)

I would think it should be pretty easy to fix by passing the length
along with the pin "char *" internally.

> Potentially we could allow implementing a passkey agent as a plugin and
> then you could implement special handling via a plugin. Problem then
> again is how to identify that it is a Wiimote. Or did they actually
> added a PnP SDP record to it. It has been so long that I hacked on these
> devices.

This is the output of sdptool browse on a Wiimote (though I'd rather
have the work-arounds in the front-end):

Browsing 00:1F:C5:5E:B4:EB ...
Service RecHandle: 0x0
Service Class ID List:
  "SDP Server" (0x1000)
Protocol Descriptor List:
  "L2CAP" (0x0100)
    PSM: 1
  "SDP" (0x0001)
Language Base Attr List:
  code_ISO639: 0x656e
  encoding:    0x6a
  base_offset: 0x100
Profile Descriptor List:
  "" (0x0100)
    Version: 0x0100

Service Name: Nintendo RVL-CNT-01
Service Description: Nintendo RVL-CNT-01
Service Provider: Nintendo
Service RecHandle: 0x10000
Service Class ID List:
  "Human Interface Device" (0x1124)
Protocol Descriptor List:
  "L2CAP" (0x0100)
    PSM: 17
  "HIDP" (0x0011)
Language Base Attr List:
  code_ISO639: 0x656e
  encoding:    0x6a
  base_offset: 0x100
Profile Descriptor List:
  "Human Interface Device" (0x1124)
    Version: 0x0100

Service RecHandle: 0x10001
Service Class ID List:
  "PnP Information" (0x1200)
Protocol Descriptor List:
  "L2CAP" (0x0100)
    PSM: 1
  "SDP" (0x0001)
Profile Descriptor List:
  "PnP Information" (0x1200)
    Version: 0x0100

Cheers

Re: Wiimote pairing?

[Marcel Holtmann]

Hi Bastien,

> > > I was under the impression that the Wiimote simply didn't use a PIN
> > > code, but it seems there's a way to pair it and associate it with a
> > > particular host by doing:
> > > http://wiibrew.org/wiki/Wiimote#Sync_Button
> > > 
> > > I looked through my dongles, and couldn't find one that would allow me
> > > to pass the modified host address as a PIN code as they all have "00" as
> > > part of the address.
> > > 
> > > bluetoothd uses strings everywhere for PIN code handling. It would be
> > > possible to change the RequestPinCode to also allow:
> > > {string,len} RequestPinCode(object device)
> > > without modifying the current behaviour.
> > 
> > that is no really how D-Bus would handle strings. From a D-Bus point of
> > view, the only way would be using a Byte array.
> 
> Yeah, true. so:
> ByteArray RequestPinCode(object device)
> (in addition to the current one)
> 
> I would think it should be pretty easy to fix by passing the length
> along with the pin "char *" internally.
> 
> > Potentially we could allow implementing a passkey agent as a plugin and
> > then you could implement special handling via a plugin. Problem then
> > again is how to identify that it is a Wiimote. Or did they actually
> > added a PnP SDP record to it. It has been so long that I hacked on these
> > devices.
> 
> This is the output of sdptool browse on a Wiimote (though I'd rather
> have the work-arounds in the front-end):
> 
> Browsing 00:1F:C5:5E:B4:EB ...
> Service RecHandle: 0x0
> Service Class ID List:
>   "SDP Server" (0x1000)
> Protocol Descriptor List:
>   "L2CAP" (0x0100)
>     PSM: 1
>   "SDP" (0x0001)
> Language Base Attr List:
>   code_ISO639: 0x656e
>   encoding:    0x6a
>   base_offset: 0x100
> Profile Descriptor List:
>   "" (0x0100)
>     Version: 0x0100
> 
> Service Name: Nintendo RVL-CNT-01
> Service Description: Nintendo RVL-CNT-01
> Service Provider: Nintendo
> Service RecHandle: 0x10000
> Service Class ID List:
>   "Human Interface Device" (0x1124)
> Protocol Descriptor List:
>   "L2CAP" (0x0100)
>     PSM: 17
>   "HIDP" (0x0011)
> Language Base Attr List:
>   code_ISO639: 0x656e
>   encoding:    0x6a
>   base_offset: 0x100
> Profile Descriptor List:
>   "Human Interface Device" (0x1124)
>     Version: 0x0100
> 
> Service RecHandle: 0x10001
> Service Class ID List:
>   "PnP Information" (0x1200)
> Protocol Descriptor List:
>   "L2CAP" (0x0100)
>     PSM: 1
>   "SDP" (0x0001)
> Profile Descriptor List:
>   "PnP Information" (0x1200)
>     Version: 0x0100

here is your PnP record and that means you have VID/PID information and
can easily just to automatic pairing inside daemon.

Regards

Marcel

Re: Wiimote pairing?

[Bastien Nocera]

Pascal replied to me off-list and said:
> On Sat, 2009-12-05 at 13:57 +0000, Bastien Nocera wrote:
> > I was under the impression that the Wiimote simply didn't use a PIN
> > code, but it seems there's a way to pair it and associate it with a
> > particular host by doing:
> > http://wiibrew.org/wiki/Wiimote#Sync_Button
> 
> FYI last time I checked, the Wiimote seemed to implement some kind of
> whitelist: even after being successfully paired using that PIN, it
> will not initiate a connection unless the host bluetooth address is
> in a range allocated to Nintendo (not sure about the exact criterion).
> 
> > PS: https://bugzilla.redhat.com/show_bug.cgi?id=544564
> 
> So it is unclear whether the change you are suggesting would help
> this particular user.  You need to be either running Bluez on a Wii,
> or willing to spoof the bd_addr of your bluetooth dongle.
> 
> Pascal

So it looks like it wouldn't help anyway...

Re: Wiimote pairing?

[Hector Martin]

Sorry for the lack of proper thread headers. I subscribed to ask about
this very issue and it turns out it was asked two days ago in the
already, after I checked out the archives :)

Seeing as everything is done using strings everywhere, including the
storage (which is a text file), I think it might be easier to just
define a hex format. Something like $0011deadbeef for raw binary
pincodes expressed as hex. This will let all the existing tools handle a
raw PIN.

The Bluetooth spec talks about numeric and alphanumeric PIN codes, but I
haven't seen mention of special characters. I think the likelihood of
having issues with real PINs with a starting $ sign is fairly low (and
they could always be expressed as hex).

An alternative would be to use a more traditional backslash escape
sequence type format, but that's harder to parse.

-- 
Hector Martin (hector@marcansoft.com)
Public Key: http://www.marcansoft.com/marcan.asc