Spoofing an RN42 into a Wiimote

Question

All, I am attempting to program an RN42 to spoof a nintendo Wiimote. I would like for the RN42 to connect to the Wii just as a Wiimote would. I can not seem to detect the Wii, or connect to it with the code I have so far. I used a Raspi to connect the Wiimote and RN42 in order to capture bluetooth packets. The images are attached above from wireshark. I noticed the RN42 is going into SDP protocol for some reason and not using the HID profile I set it to. I was wondering if anyone could help me fix this RN42 so I can connect it to a Wii console.

Notes: I have utilized the command reference for the RN42 as well as Wiibrew to try and mimic a wiimote, with little success.

#include <SoftwareSerial.h>  

int bluetoothTx = 3;  // TX-O pin of bluetooth mate, Arduino D2
int bluetoothRx = 2;  // RX-I pin of bluetooth mate, Arduino D3

SoftwareSerial bluetooth(bluetoothTx, bluetoothRx);

void setup()
{
  Serial.begin(9600);  // Begin the serial monitor at 9600bps

  bluetooth.begin(115200);  // The Bluetooth Mate defaults to 115200bps
  bluetooth.print("$");  // Print three times individually
  bluetooth.print("$");
  bluetooth.print("$");  // Enter command mode
  delay(100);  // Short delay, wait for the Mate to send back CMD
  bluetooth.println("U,9600,N");  // Temporarily Change the baudrate to 9600, no parity
  // 115200 can be too fast at times for NewSoftSerial to relay the data reliably
  bluetooth.begin(9600);  // Start bluetooth serial at 9600
  bluetooth.print("$");  // Print three times individually
  bluetooth.print("$");
  bluetooth.print("$");  // Enter command mode
  delay(200);  // Short delay
  bluetooth.println("SA,0");  // Set authentication to none
  delay(200);  // Short delay
  bluetooth.println("SM,0");  // Set mode to slave
  delay(200);  // Short delay
  bluetooth.println("SH,0100");  // Set HID flag to Joystick
  delay(200);  // Short delay
  bluetooth.println("S~,6");  // Set HID profile
  delay(200);  // Short delay
  bluetooth.println("SC,0000");  // Set HID profile
  delay(200);  // Short delay
  bluetooth.println("SD,2504");  // Set HID profile
  delay(200);  // Short delay
  bluetooth.println("R,1");  // Reboot
  delay(400);  // Short delay
  bluetooth.begin(9600);  // Start bluetooth serial at 9600
}

void loop()
{
  if(bluetooth.available())  // If the bluetooth sent any characters
  {
    // Send any characters the bluetooth prints to the serial monitor
    Serial.print((char)bluetooth.read());  
  }
  if(Serial.available())  // If stuff was typed in the serial monitor
  {
    // Send any characters the Serial monitor prints to the bluetooth
    bluetooth.print((char)Serial.read());
  }
  // and loop forever and ever!
}

score 1 · Answer 1 · answered Jul 29 '18 at 10:31

You've most likely solved or moved on already, but I'm too now trying to figure out RN-42 for xbox-360 gamepad and kinda confused with how HID flag register works.

SH command expects four hex characters which equate to 16 bits. Flag register has 10 bits. I have no idea how am I supposed to map 16 bits to 10 but your

bluetooth.println("SH,0100"); // Set HID flag to Joystick

command probably won't set it to a joystick, as all examples show it needs to be

bluetooth.println("SH,0240"); // Set HID flag to Joystick

Again, no idea why tho.

Spoofing an RN42 into a Wiimote

1 Answers1