API tools faq
paste
Advertisement
Zoinkity

VRU Commands and Communication

Zoinkity
May 4th, 2017
1,045
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 14.09 KB | None | 0 0
raw download clone embed print report
  1. Will send all commands to this thing up to four times in a row, assuming no errors.
  2. Refer to these two dumps:
  3. vru.USA-all-test.txt (E Pikachu) https://pastebin.com/5Fr9G36N
  4. DdG_log_full_route_statuses.bin.txt (J Densha) https://pastebin.com/rNe7CQNf
  5. All logged commands are taken after sending and reading back response.
  6.  
  7. All listed below are PIF commands, sent to the SI like normal controller commands. Values marked "address" will use the standard pifcmd address checksum algo, though it's suspected the field is ignored in most commands. "Data" uses the standard pifcmd data checksum.
  8.  
  9. In pythonese:
  10. def ctrl_address_crc(address):
  11. """Returns checksum used for HW address."""
  12. ret = 0
  13. for i in range(16):
  14. ret <<= 1
  15. v = 0x15 if ret & 0x20 else 0
  16. ret |= bool(address & 0x400)
  17. address <<= 1
  18. ret ^= v
  19. return ret & 0x1F
  20.  
  21. def ctrl_data_crc(data, length=None):
  22. """Returns checksum for data sent to serial device.
  23. If length is not given, uses the length of the data.
  24. NOTE! Normal 32byte controller pak data must be 32 bytes,
  25. not 33! That was an assumption on their part!"""
  26. ret = 0
  27. if length is None:
  28. length = len(data)
  29. for i in data[:length]:
  30. m = 0x80
  31. while m:
  32. ret <<= 1
  33. x = bool(i & m)
  34. if ret & 0x100:
  35. ret ^= 0x85 - x
  36. else:
  37. ret += x
  38. m >>= 1
  39. for i in range(8):
  40. ret <<= 1
  41. if ret & 0x100:
  42. ret ^= 0x85
  43. return ret & 0xFF
  44.  
  45.  
  46. Important commands:
  47.  
  48. FD
  49. Device channel reset
  50.  
  51. read 0x25 bytes of data from VRU addy
  52. 03.25.09xxxx.ddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddcc
  53. send:
  54. x combination of value and address checksum
  55. FFE0 address
  56. 001F checksum
  57. recieve:
  58. d data (0x24)
  59. data is 16bit byteswapped
  60. c data checksum for d
  61. set to 0xFF on send
  62.  
  63. data breakdown:
  64. 0 4 unknown; J & E VRUs always seems to report 80000F00
  65. 4 2 error flags
  66. 6 2 # valid results (?)
  67. 8 2 voice level from mic
  68. A 2 relative voice level
  69. C 2 voice length (prob. milliseconds)
  70. E 2 hit 1: index or 0x7FFF
  71. 10 2 hit 1: deviance value
  72. 12 2 hit 2: index or 0x7FFF
  73. 14 2 hit 2: deviance value
  74. 16 2 hit 3: index or 0x7FFF
  75. 18 2 hit 3: deviance value
  76. 1A 2 hit 4: index or 0x7FFF
  77. 1C 2 hit 4: deviance value
  78. 1E 2 hit 5: index or 0x7FFF
  79. 20 2 hit 5: deviance value
  80. 22 2 mode + status flags; normally should report 0040
  81. 23 1 data checksum
  82.  
  83. error flags appear to be (byteswapped):
  84. 0400 voice too low; occurs with low voice levels and relative voice levels, unsure rules
  85. 0800 voice too high; any voice level over 0xDAC(?) appears to trigger this
  86. 4000 no valid matches; I think this means the deviation for all results is greater than the default 0x640 seen in software, since can report match results anyway.
  87. 8000 too much noise; relative voice level below 0x190(?) appears to trigger this
  88.  
  89. 0x7FFF is always reported as an index when fewer than that number of entries are loaded into memory. For example, if only four words are loaded, index 5 will always be 0x7FFF.
  90.  
  91. write 0x14 bytes of data to VRU addy
  92. 17.01.0Axxxxdddddddddddddddddddddddddddddddddddddddd.cc
  93. send:
  94. x combination of value and address checksum
  95. FFE0 address
  96. 001F checksum
  97. d data (0x14)
  98. data should be 16bit byteswapped, aligned right (so NULLs to the left but strings reading left->right, byteswapped.)
  99. recieve:
  100. c data checksum for d
  101. set to 0xFF on send
  102.  
  103. J str data pattern is:
  104. ----0300 0000dddd dddddddd dddddddd dddddddd dddddddd dddddddd dddddddd dddddddd ddddff00
  105. Max length to send is 0x22, aligned to right side of buffer (0x26 - len(data)) and preceeded by 3. Data is 16bit LE. Flag indicates status after sending command. There's a NULL between the string and the 0003.
  106. Regardless, address always appears to be 0.
  107.  
  108. Except for ー only Katakana and Hiragana may be used.
  109. Invalid as first char: ーんっゎンッヮヵヶ
  110. ぁ can only follow ふフヴ
  111. ァ can only follow ふフヴ
  112. ぃ can only follow うてでふウテデフヴ
  113. ィ can only follow うてでふウテデフヴ
  114. ぅ can only follow とどふトドフヴ
  115. ゥ can only follow とどふトドフヴ
  116. ぇ can only follow うしえちぢつふウシジチヂツフヴ
  117. ェ can only follow うしえちぢつふウシジチヂツフヴ
  118. ぉ can only follow うふウフヴ
  119. ォ can only follow うふウフヴ
  120. ゃ can only follow きしちにひみりぎじぢびぴキシチニヒミリギジヂビピヴ
  121. ゅ can only follow きしちにひみりぎじぢびぴキシチニヒミリギジヂビピヴ
  122. ょ can only follow きしちにひみりぎじぢびぴキシチニヒミリギジヂビピヴ
  123. ャ can only follow きしちにひみりぎじぢびぴキシチニヒミリギジヂビピヴ
  124. ュ can only follow きしちにひみりぎじぢびぴキシチニヒミリギジヂビピヴ
  125. ョ can only follow きしちにひみりぎじぢびぴキシチニヒミリギジヂビピヴ
  126. ー cannot follow きっンッ
  127. ん and ン cannot repeat (んん or ンン)
  128. っ can only follow ーあいうえおなにぬねのまみむめもやゆよらりるれろわゐゑをんぁぃぅぇぉゃゅょっゎアイウエオナニヌネノマミムメモヤユヨラリルレロワヰヱヲンァィゥェォャュョッヮ
  129. ッ can only follow ーあいうえおなにぬねのまみむめもやゆよらりるれろわゐゑをんぁぃぅぇぉゃゅょっゎアイウエオナニヌネノマミムメモヤユヨラリルレロワヰヱヲンァィゥェォャュョッヮ
  130.  
  131. E str data pattern is pretty much same:
  132. ----0300 0000 dddd dddd dddd dddd dddd dddd dddd dddd dddd dddd dddd dddd dddd dddd dddd dddd 0000
  133. Always sent in sets of four commands, even when data is shorter than this.
  134. Refer to "USA VRU Sound Indicies.txt" for values. https://pastebin.com/ajLzRLze
  135.  
  136. Also used to send the string mask patterns. Data is right-aligned and padded with zeroes to an even length, followed with command 0004. Set bits allow strings, unset ignores.
  137.  
  138. read 2 bytes from VRU addy (mode & status)
  139. 03.03.0Bxxxx.ddddcc
  140. send:
  141. x combination of value and address checksum
  142. FFE0 address
  143. 001F checksum
  144. recieve:
  145. d data recieved from VRU (byteswapped)
  146. FF00 ???; returns error 5 when set
  147. 0200 ???; returns error 0xE or 5 when set (same error as bad wchar)
  148. 0100 ???; returns error 0xD or 5 when set
  149. 0040 ???; returns error 0xF when set
  150. 0007 mode
  151. c data checksum for d
  152. set to 0xFF on send
  153.  
  154. write 4 bytes to VRU addy (HW commands/status + HW data)
  155. 07.01.0Cxxxxdddddddd.cc
  156. send:
  157. x combination of value and address checksum
  158. FFE0 address
  159. 001F checksum
  160. d data (4 bytes, byteswapped)
  161. 0007 0000 mode
  162. 0000 FFFF argument
  163. recieve:
  164. c data checksum for d
  165. set to 0xFF on send
  166.  
  167. uses: (shown is byteswapped)
  168. 000 0200xx00 clears x strings from device
  169. 000 00000700 used when VRU Status is 1, 3, or 5 before setting words
  170. 000 05000000 stops listening
  171. 000 00000600 starts listening
  172.  
  173. flags = VRU HW state when initializing(?) address; believed to control power
  174. 03.01.0Dxxxx.ff
  175. send:
  176. x combination of value and address checksum
  177. FFE0 address
  178. 001F checksum
  179. recieve:
  180. f error flags
  181. set to 0 on send
  182.  
  183. Note they use a table of address, >> 3 actual: (1E, 6E, 08, 56, 03).
  184. Each is sent in-sequence, assuming nothing goes wrong.
  185.  
  186. Also used when switching the device "off" and "on"; i.e.:
  187. Off:
  188. 03.01.0D080E.00
  189. 07.01.0C000005000000.4E
  190. 03.03.0B0000.010097
  191. 03.03.0B0000.050044
  192. On:
  193. 03.01.0D0000.00
  194. 03.03.0B0000.000000
  195. 07.01.0C000000000600.78
  196.  
  197.  
  198.  
  199. Step 1: detect if a VRU is attached
  200. send SI Status commands. Device type is 0x100.
  201. reinit software flags
  202. On initial connect:
  203. check status:
  204. send SI Status cmd
  205. return Err 1 after four retests if Not Present flag
  206. return Err 0xB after four retests if not a VRU (device type != 0x100)
  207. return Err 4 if IO Error flag
  208. return Err 4 if addy crc error
  209. send SI cmd 0xFD to channel (initializes channel)
  210. return Err 4 on failure
  211. send SI cmd 0xD: 0F0
  212. if flag (cmd[5]) & 1, retest up to four times
  213. return Err 1 if Not Present, IO Error, or error retesting device status
  214. return Err 4 after four retests if flag & 1
  215. send SI cmd 0xD: 370
  216. (as above)
  217. send SI cmd 0xD: 040
  218. (as above)
  219. send SI cmd 0xD: 2B0
  220. (as above)
  221. send SI cmd 0xD: 018
  222. (as above)
  223. check status:
  224. (as above)
  225. return 0xF if Slot Empty flag
  226. send SI cmd 0xC: 000 00000100
  227. return Err 1 if Not Present, IO Error, or error retesting device status
  228. return Err 4 if data crc mismatch after four retests
  229. read VRU state:
  230. check status:
  231. (as above)
  232. return Err 0xF if Slot Filled flag
  233. state = send SI cmd 0xB: 000
  234. return Err 1 if Not Present or IO Error
  235. return Err 4 if data crc mismatch after four retests
  236. return Err 0xF if state & 0x40
  237. return Err 5 if state & 0xFF00
  238.  
  239. USA initialization slightly different.
  240. After sending 0xFD commands, wait until Count advances 0x23C346. Presumably this is to ensure it's been adequately powered.
  241. check status
  242. state = send SI cmd 0xB: 000
  243. save status read by 0xB command to a register for comparison later. Looks like 0100 flag indicates USA; error 5 is returned on a mismatch.
  244. continue as normal
  245.  
  246.  
  247. State flag returned by status reads is inverted between J and U devices. (0:Japan, 1:USA)
  248.  
  249.  
  250. Step 2: send strings (J)
  251. if state in (1, 3, 5):
  252. check status:
  253. (as above)
  254. return Err 0xF if Slot Empty flag
  255. return 5 if mode == 0
  256. send SI cmd 0xC: 000 00000700
  257. (as above)
  258. [presumes no error; if one occurs loads uninitialized value off stack]
  259. retest 20 times
  260. read VRU state:
  261. (as above)
  262. mode = 0 if state & 0xFF00
  263. mode = 0, return 0 if (state & 7) == 0
  264. return Err 5 if (state & 7) == 7
  265. return Err state if state != 0xF
  266. return Err 0x10 if all retests fail
  267. check status:
  268. (as above)
  269. return Err 0xF if Slot Empty flag
  270. send SI cmd 0xC: 000 0200##00 # number of strings
  271. (as above)
  272. read VRU state:
  273. (as above)
  274. return Err 5 state & 0xFF00
  275. for i in strings:
  276. return Err 0xE if string unusable
  277. check status:
  278. (as above)
  279. return Err 0xF if Slot Empty flag
  280. byteswap i
  281. buf[0:0x26 - len(i)] = repeat(0, 0x26 - len(i))
  282. buf[0x26-len(i):] = i
  283. buf[0x22-len(i)] = 3
  284. if len(i) > 0xE:
  285. send SI cmd 0xA: 000 buf[:0x14]
  286. return Err 1 if Not Present or IO Error
  287. return Err 4 if data crc mismatch after four retests
  288. send SI cmd 0xA: 000 buf[0x14:0x28]
  289. (as above)
  290. read VRU state:
  291. (as above)
  292. return Err 0xD if state & 0x100
  293. return Err 0xE if state & 0x200
  294. return Err 5 if state & 0xFF00
  295. if also sending stringmask:
  296. check status:
  297. (as above)
  298. return Err 0xF if Slot Empty flag
  299. l = len(data) + (len(data) & 1)
  300. if len(data) & 1:
  301. data.append(0)
  302. byteswap data
  303. buf[0x12 - l] = 4
  304. buf[0x14-l:] = data
  305. send SI cmd 0xA: 000 buf[:0x14]
  306. (as above)
  307. return Err 5 if state & 0xFF00
  308.  
  309.  
  310. Step 2: send strings (E)
  311. if state not in (1, 3, 5):
  312. check status:
  313. (as above)
  314. return Err 0xF if Slot Empty flag
  315. return 5 if mode == 0
  316. send SI cmd 0xC: 000 00000700
  317. (as above)
  318. [presumes no error; if one occurs loads uninitialized value off stack]
  319. retest 20 times
  320. read VRU state:
  321. (as above)
  322. mode = 0 if state & 0xFF00
  323. mode = 0, return 0 if (state & 7) == 0
  324. return Err 5 if (state & 7) == 7
  325. return Err state if state != 0xF
  326. return Err 0x10 if all retests fail
  327. check status:
  328. (as above)
  329. return Err 0xF if Slot Empty flag
  330. send SI cmd 0xC: 000 0200##00 # number of strings
  331. (as above)
  332. read VRU state:
  333. (as above)
  334. return Err 5 state & 0xFF00
  335. for i in strings:
  336. # If no sum, no blocknum, or no length given, fill them in. (Official did this already)
  337. # If your sound entries are big endian, flip to little.
  338. check status:
  339. (as above)
  340. return Err 0xF if Slot Empty flag
  341. byteswap i
  342. buf[0:0x4F - len(i)] = repeat(0, 0x4F - len(i))
  343. buf[0x4F-len(i):] = i
  344. buf[0x4A-len(i)] = 3
  345. for j in range(0, 0x50, 0x14):
  346. send SI cmd 0xA: 000 buf[j:j+0x14]
  347. return Err 1 if Not Present or IO Error
  348. return Err 4 if data crc mismatch after four retests
  349. read VRU state:
  350. (as above)
  351. return Err 0xD if state & 0x100
  352. return Err 0xE if state & 0x200
  353. return Err 5 if state & 0xFF00
  354. if also sending stringmask:
  355. check status:
  356. (as above)
  357. return Err 0xF if Slot Empty flag
  358. l = len(data) + (len(data) & 1)
  359. if len(data) & 1:
  360. data.append(0)
  361. # If necessary, pad data to even length and byteswap data.
  362. buf[0x26 - l] = 4
  363. buf[0x28-l:] = data
  364. send SI cmd 0xA: 000 buf[:0x14]
  365. (as above)
  366. read VRU state:
  367. (as above)
  368. send SI cmd 0xA: 000 buf[0x14:0x28]
  369. ditto
  370. read VRU state:
  371. (as above)
  372. return Err 5 if state & 0xFF00
  373.  
  374.  
  375. Setting unresponsive until needed:
  376.  
  377. 01.03.00.000100
  378. 03.03.0B0000.000000
  379. 03.01.0D080E.00 # optional to lower power
  380. 01.03.00.000101
  381. 07.01.0C000005000000.4E
  382. 01.03.00.000100
  383. 03.03.0B0000.010097
  384. 01.03.00.000101
  385. ...
  386. 01.03.00.000100
  387. 03.03.0B0000.050044
  388. 01.03.00.000101
  389.  
  390. 03.01.0D0000.00 # optional to raise power
  391. 01.03.00.000101
  392. ...
  393.  
  394.  
  395. Fetching results:
  396. check status:
  397. (as above)
  398. return Err 0xF if Slot Empty flag
  399. return Err 5 if mode != 0
  400. send SI cmd 0xC: 000 05000000 # #results to read back?
  401. (as above)
  402. read VRU state
  403. (as above)
  404. return Err 5 if state & 0xFF00
  405. mode = 1
  406. (if previous Err 0xC returned resets state to listening)
  407.  
  408.  
  409. # with power regulation(?)
  410. 01.03.00.000100
  411. 03.03.0B0000.000000
  412. 01.03.00.000101
  413. 07.01.0C000000000600.78
  414. 01.03.00.000100
  415. 03.25.090000.80000F00000002009D057C07B004000077040400CC041000F9041400030505001205400097
  416. 03.01.0D0000.00
  417. # disable again
  418. 03.01.0D080E.00
  419. 01.03.00.000100
  420. 07.01.0C000005000000.4E
  421. 01.03.00.000100
  422. 03.03.0B0000.010097
  423. 01.03.00.000101
  424.  
  425. #without
  426. 01.03.00.000100
  427. 03.03.0B0000.000000
  428. 01.03.00.000101
  429. 07.01.0C000000000600.78
  430. 01.03.00.000100
  431. 03.25.090000.80000F000000010045069A3570040700AC011000E60200001903120040031E005603400094
  432. # disable again
  433. 01.03.00.000100
  434. 07.01.0C000005000000.4E
  435. 01.03.00.000100
  436. 03.03.0B0000.010097
  437. 01.03.00.000101
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!