WiiU Gamepad Technical Documentation

accelerometer

Anonymous (anonymous@undisclosed.example.com) — 2024-12-24T15:51:13+00:00

Accelerometer The accelerometer is a STMicroelectronics LIS3DH (marking C3H). It is connected to the UIC over SPI. Vendor datasheet

audio_amplifier

Anonymous (anonymous@undisclosed.example.com) — 2025-03-21T22:54:10+00:00

Audio amplifier The audio amplifier used in the gamepad is a Texas Instruments TLV320AIC3012. No datasheet for it has been found, though there is a datasheet for the TLV320AIC3100, which appears to be a close match. Clock generation The amplifier's input clock (MCLK) is sourced from

audio_controller

Anonymous (anonymous@undisclosed.example.com) — 2025-03-21T22:16:50+00:00

Audio controller The audio controller has two main components: output (playing sound to the internal speakers or headphone jack) and input (recording sound from the internal microphone). It supports PCM16 and A-law or µ-law encoded PCM8. Sound output can be mono or stereo, input is always mono.

camera_controller

Anonymous (anonymous@undisclosed.example.com) — 2025-05-17T11:50:42+00:00

Camera controller NOTE: this is a findings dump for now. It is unclear what is what, so there may be stuff pertaining to the h264 codec in here. Not sure how interwoven it is with the camera controller. Known registers: Address Desc. 0xF0000800

compass

Anonymous (anonymous@undisclosed.example.com) — 2024-12-24T15:53:14+00:00

Compass The compass is a STMicroelectronics chip with marking MSA3D. It is not yet known what it is or whether it is a custom chip. The magnetic sensors are external to it. It is connected to the UIC over SPI.

dma

Anonymous (anonymous@undisclosed.example.com) — 2025-04-20T19:10:12+00:00

DMA The gamepad features 5 DMA channels. The first two channels are intended for communication with peripherals such as SPI and IR, while the three last are general DMA channels suitable for uses such as blitting graphics to the framebuffer. The base I/O addresses for the DMA channels are as follows:

flash_layout

Anonymous (anonymous@undisclosed.example.com) — 2025-01-19T20:42:29+00:00

FLASH layout The gamepad's firmware data is stored in a 32MB FLASH memory. This page describes the layout of the data in that memory. Memory map Address Internal name Description 0x0000000 SPL Second-stage bootloader 0x000E000 ErrorLog

fpgapad

Anonymous (anonymous@undisclosed.example.com) — 2025-03-19T22:59:06+00:00

FPGApad The FPGApad is Arisotura's modified WiiU gamepad, which serves for reverse-engineering and development purposes. This page is intended to document the FPGApad and provide a blueprint for anyone wanting to attempt a similar mod. Reason On a stock gamepad, the firmware can only be updated over wifi. Since the firmware runs on the bare metal, you need a functional firmware to do anything, including uploading new code to the gamepad. This excludes any sort of reverse-engineering work be…

general_registers

Anonymous (anonymous@undisclosed.example.com) — 2025-10-15T21:16:37+00:00

General registers Address Desc. 0xF0000000 Hardware ID 0xF0000004 Soft reset 0xF0000008 Hardware setup 0xF000000C PLL - input clock divider 0xF0000010 PLL - clock multiplier 0xF0000014 PLL - primary clock divider 0xF0000018 PLL - secondary clock 1 divider

gpio

Anonymous (anonymous@undisclosed.example.com) — 2025-10-15T21:37:12+00:00

GPIO The GPIO registers allow direct control over the SoC's I/O lines. Here is a list of the known GPIO registers, as well as the values the stock firmware initializes them to. Address Mask Init. Desc. 0xF000502C 0xC000 0x8000 ? (could be LCD pixel clock?)

gyroscope

Anonymous (anonymous@undisclosed.example.com) — 2024-12-24T15:56:58+00:00

Gyroscope The gyroscope is an InvenSense ITG-3280. It is connected to the UIC over SPI. No datasheet for it has been found, but there is the following datasheet for the ITG-3200.

h264_codec

Anonymous (anonymous@undisclosed.example.com) — 2025-05-25T18:31:11+00:00

H264 codec The gamepad features a hardware H264 codec. It can decode a video feed to the screen, and encode the video feed from the camera. Register map: Address Desc. 0xF0008404 ??? 0xF0008408 ??? 0xF000840C ??? 0xF0008410 ??? 0xF0008414

hardware_overview

Anonymous (anonymous@undisclosed.example.com) — 2025-01-20T21:04:43+00:00

Hardware overview Motherboard revisions There are atleast two known revisions of the WiiU gamepad motherboard. Revision 01 (PWB/MAIN/AU/HF-C/DH-01) is the most common. Revision 20 (DRC-MAIN-20) is possibly an earlier motherboard revision. The most notable difference is that the speakers are soldered directly to the motherboard instead of using connectors. There are also other minor hardware differences, the full extent of which isn't known yet.

i2c

Anonymous (anonymous@undisclosed.example.com) — 2025-04-20T11:51:12+00:00

I2C The I2C interface connects the LCD, audio amplifier and camera to the CPU. There are two possible I2C controllers. If the LSB of register 0xF0000000 is 0x41, the gamepad has the Samsung controller, otherwise it has the Renesas controller. In practice, I have only seen Renesas controllers so far, so I don't know how rare the Samsung one is. Considering that the I2C controller is part of the SoC, it is likely that the Samsung controller is solely prototype stuff. As further evidence, the di…

irq_controller

Anonymous (anonymous@undisclosed.example.com) — 2025-05-16T22:33:11+00:00

IRQ controller The IRQ controller is presumably able to schedule and distribute IRQs based on a priority order. Registers The IRQ controller has the following registers: Address Desc. 0xF0001200 Shorthand IRQ enable for IRQ 0x00..0x0F

lcd

Anonymous (anonymous@undisclosed.example.com) — 2025-03-16T15:26:21+00:00

LCD The gamepad's LCD is connected to the I2C interface: bus 3, device 0x39. Initialization Before displaying anything, the LCD must be initialized with the following sequence. First, configure the LCD GPIO (at 0xF0005100) as an output, by setting it to 0xC200. Then set it to zero (0xC200), wait atleast 5 milliseconds, set it to one (0xC300), wait atleast 15 milliseconds. This sequence seems to prepare the LCD for I2C communication.

lcd_controller

Anonymous (anonymous@undisclosed.example.com) — 2025-09-04T22:29:42+00:00

LCD controller The gamepad provides simple display hardware that can display a video feed (from the camera or the H264 decoder) and a framebuffer overlay on top. Register map: Address Desc. 0xF0009400 Horizontal timing control 0xF0009404 Vertical timing control

memory_map

Anonymous (anonymous@undisclosed.example.com) — 2025-05-14T15:55:55+00:00

Memory map The gamepad has a pretty simple memory map. Start End Desc. 0x00000000 0x3FFFFFFF main RAM (4MB, mirrored) 0x00000000 0x00000FFF boot ROM overlay 0xE0010000 0xE001FFFF SDIO registers (256 bytes, mirrored)

mystery_registers

Anonymous (anonymous@undisclosed.example.com) — 2025-04-25T21:42:29+00:00

Mystery registers The various bits and parts of the gamepad hardware that haven't been connected to something bigger. Registers 0xF0000C00 reg F0000C24 -> 00000001 (old 00000001) reg F0000C30 -> 00000007 (old 00000007) reg F0000C34 -> 00000007 (old 00000006) reg F0000C38 -> 00000007 (old 00000005) reg F0000C3C -> 00000007 (old 00000004) reg F0000C40 -> 00000007 (old 00000007) reg F0000C44 -> 00000007 (old 00000005) reg F0000C48 -> 00000007 (old 00000003) reg F0000C4C -> 00000007 (old 000000…

pinouts

Anonymous (anonymous@undisclosed.example.com) — 2025-05-11T19:08:00+00:00

Pinouts Known pinouts for the various ICs and connectors on the Gamepad motherboard. DRC-WUP Ball 1 2 3 4 5 6 7 8 9 10 11 12 13 14 A x GND 1v behind EM19 GND behind EM20 2v7 behind EM14 to Screen to Screen to Screen to Screen

pmic

Anonymous (anonymous@undisclosed.example.com) — 2025-04-03T20:30:36+00:00

PMIC The gamepad's power management IC is a Texas Instruments SN1010007. So far no datasheet has been found. It is connected to the UIC's I2C bus, where its device ID is 0x48. Pinout Pin Desc. 1 ?? 2 ?? 3 ?? 4 ?? 5 Battery pin 1 (red)

register_map

Anonymous (anonymous@undisclosed.example.com) — 2025-04-20T22:45:50+00:00

Register map This page lists all the known I/O registers. 'Mask' is the value read back after writing 0xFFFFFFFF to the register. This doesn't account for read-only or write-only bits, but gives a basic idea of the register's layout. Similarly, some registers might be missing because they were reading as zero.

sdio

Anonymous (anonymous@undisclosed.example.com) — 2025-04-16T20:24:03+00:00

SDIO The gamepad includes a SDIO host controller to access the BCM4319 wifi card. Registers The SDIO host controller registers are at 0xE0010000. They occupy a 256-byte block which is mirrored across the entire 0xE0010000-0xE001FFFF range. Address

spi

Anonymous (anonymous@undisclosed.example.com) — 2025-04-17T15:44:12+00:00

SPI The SPI bus connects the gamepad storage (Flash memory) and the UIC to the CPU. SPI controller The gamepad uses a pretty simple SPI controller with 16-byte FIFOs for reading and writing. Due to the way this is designed, one has to be mindful to avoid FIFO overflows/underflows during a SPI transfer.

start

Anonymous (anonymous@undisclosed.example.com) — 2025-05-16T21:58:26+00:00

WiiU Gamepad Technical Documentation The aim is to document the inner workings of the WiiU Gamepad. This is still largely a work in progress. Hardware documentation * Hardware overview * Memory map * Register map * General registers * IRQ controller * GPIO * Timers * DMA * SPI * UART * I2C * LCD controller * LCD * Audio controller * Audio amplifier * Camera controller *

test_points

Anonymous (anonymous@undisclosed.example.com) — 2025-05-13T14:41:55+00:00

Test points The Gamepad's motherboard features many test points. TODO: make a picture with the test points labelled, maybe interactive The following test points have been identified so far: Test point Description TP3 Right speaker +

timers

Anonymous (anonymous@undisclosed.example.com) — 2025-04-13T13:51:02+00:00

Timers The gamepad has the following timer registers: (TODO word better) Address Desc. 0xF0000400 Prescaler for timer 0/1 0xF0000404 Prescaler for count-up timer 0xF0000408 Count-up timer 0xF0000410 Timer 0 control 0xF0000414 Timer 0 counter

touchscreen_controller

Anonymous (anonymous@undisclosed.example.com) — 2024-12-24T15:49:10+00:00

Touchscreen controller The touchscreen controller is a Texas Instruments TSC2046. It is connected to the UIC over SPI. Vendor datasheet

uart

Anonymous (anonymous@undisclosed.example.com) — 2025-05-10T11:55:25+00:00

UART The gamepad features 3 UART controllers. Base address Desc. 0xF0004C00 UART0 0xF0004C40 UART1 0xF0004C80 UART2 The entire UART region is mirrored every 256 bytes over 0xF0004C00..0xF0004FFF. Related IRQs: IRQ Desc. 0x03 UART0

uic

Anonymous (anonymous@undisclosed.example.com) — 2025-04-18T12:00:15+00:00

UIC The UIC is the gamepad's auxiliary microcontroller. It is connected to the CPU over the SPI bus. Given the characteristics, the UIC could be a STM8L151R8. It has 4KB of RAM, 2KB of EEPROM and 64KB of FLASH. Pinout Pin Name Function 1 PA0

uic_eeprom_structure

Anonymous (anonymous@undisclosed.example.com) — 2025-04-18T09:54:16+00:00

UIC EEPROM structure The UIC's EEPROM occupies address range 0x1000..0x17FF. (TODO: maybe it occupies more?) The first 256 bytes are used internally, while the rest is used for user data storage. for more info. Address Length Description 0x1010

uic_firmware_re_notes

Anonymous (anonymous@undisclosed.example.com) — 2024-12-08T13:24:32+00:00

UIC firmware RE notes kind of a general dump for anything pertaining to the UIC firmware RAM address desc. 01a5 FIFO for ?? 01ab FIFO for ?? 01b1 FIFO for general commands 01b7 copy of EEPROM config data (1100 and up) General commands

uic_internals

Anonymous (anonymous@undisclosed.example.com) — 2024-10-20T11:35:16+00:00

UIC internals This page documents the low-level aspects of the UIC. General characteristics The UIC is a STM8 microcontroller. It is likely a STM8L151R8. It has 4KB of RAM, 2KB of EEPROM and 64KB of FLASH. Memory map Start End Desc. 0x00000

wifi

Anonymous (anonymous@undisclosed.example.com) — 2025-02-18T11:36:52+00:00

Wifi The gamepad includes a Broadcom BCM4319 wifi card for network communications. It is accessed over SDIO. The driver used in the stock gamepad firmware is a port of open-source BCM43xx drivers. Hardware The gamepad's wifi card uses the Broadcom BCM4319 SoC. Broadcom hardware is poorly documented, but open-source drivers can be found for it.