Hacking [WIP] Emulating Skylander Portal with Arduino

dpad_5678

Ape weak on own. Ape strong in unity.
OP
Member
Joined
Nov 19, 2015
Messages
2,219
Trophies
1
XP
2,880
Country
United States
NOTE: We are trying the emulate the Skylanders Portal for the Wii/WiiU/PS3/PS4 games! Xbox 360 (and most likely ONE, as well) looks for a certain security chip in any USB peripheral attached. This is most likely impossible to emulate with an Arduino


If you're skeptical right away, here's a video:




Download The Portable Arduino Environment (with example code)
Download The Test GUI Program
Download Zadig 2.0.1


So I wanted to figure out a way to get the Skylanders Swap Force game to recognize my Arduino Micro (Micro and Leonardo have Atmega32u4 which are capable of emulating USB devices). I plugged the Portal into my Windows machine and saw that the Portal was recognized as a Raw HID device. I opened up USBVIEW (lsusb for Windows, basically) and copied down the Vendor ID and Product ID. I searched through my Arduino Installation to find the main USB core code. Finally, I found USBCore.cpp located in \hardware\arduino\avr\cores\arduino\.

I finally found some interesting code in the file:
Code:
D_DEVICE(0x00,0x00,0x00,64,USB_VID,USB_PID,0x100,IMANUFACTURER,IPRODUCT,ISERIAL,1);


As you can see, by changing USB_VID and USB_PID in the line of code, you can change the VID and PID of your Arduino board. I changed mine to the VID and PID of my Portal (all Swap Force Portals have the same PID and VID)

At the end, both lines 75 and 78 read the following:

Code:
D_DEVICE(0x00,0x00,0x00,64,0x1430,0x0150,0x100,IMANUFACTURER,IPRODUCT,ISERIAL,1);


Now, I did brick my Arduino Micro quite a few times messing around with the Keyboard.h's library's main code. Luckily I had my Uno (clone) which I was able to reflash the Micro's bootloader with. If you try this, I recommend you have the same.

So I put together a minimal sketch that includes the Keyboard.h library:

Code:
#include <Keyboard.h>

void setup(){

Keyboard.begin();

}


void loop(){

//nothing to see here

}


And uploaded this to my Micro. I fired up Skylanders Swap Force on my Wii and plugged in the Arduino Micro into the USB port of the Wii. Here's where I got excited: THE GAME RECOGNIZED IT AS A PORTAL! Now I got excited I fired up a Test GUI from a library called HIDAPI, and I plugged in my main Portal. I started placing figures on the Portal and the Portal would send data to the computer (however, the colors of the Portal were not changing based off of the type of character I placed on the Portal).

I used Serial.write(); to try to replicate the data that the Portal was sending to my PC, but I forgot that the Portal used a Raw HID method of data transfer, not Serial. So Serial wouldn't work.

I ripped my copy of Skylanders Swap Force to a WBFS file and started the game in Dolphin. It recognized the (real) Portal, but it wouldn't recognize figures. So I followed these instructions to get the Portal working, and got it. Make sure to use Zadig 2.0.1! So now Dolphin is recognizing the Portal and it's working just like a real console. Because we replaced the driver in Zadig, the Test GUI won't recognize our Portal anymore, so I used USBlyzer to see the data.

I think all we need now is a way to write RAW (!) HID data from the Arduino, because that's the protocol the Portal uses.

I'd really like to get this figured out and get a character emulated.



I used a fresh and portable Arduino environment to do this. You can download it here. This includes the test.ino sketch.
 
Last edited by dpad_5678,

Bug_Checker_

Well-Known Member
Member
Joined
Jun 10, 2006
Messages
950
Trophies
0
XP
664
Country
United States
NOTE: We are trying the emulate the Skylanders Portal for the Wii/WiiU/PS3/PS4 games! Xbox 360 (and most likely ONE, as well) looks for a certain security chip in any USB peripheral attached. This is most likely impossible to emulate with an Arduino


If you're skeptical right away, here's a video:




Download The Portable Arduino Environment (with example code)
Download The Test GUI Program
Download Zadig 2.0.1


So I wanted to figure out a way to get the Skylanders Swap Force game to recognize my Arduino Micro (Micro and Leonardo have Atmega32u4 which are capable of emulating USB devices). I plugged the Portal into my Windows machine and saw that the Portal was recognized as a Raw HID device. I opened up USBVIEW (lsusb for Windows, basically) and copied down the Vendor ID and Product ID. I searched through my Arduino Installation to find the main USB core code. Finally, I found USBCore.cpp located in \hardware\arduino\avr\cores\arduino\.

I finally found some interesting code in the file:
Code:
D_DEVICE(0x00,0x00,0x00,64,USB_VID,USB_PID,0x100,IMANUFACTURER,IPRODUCT,ISERIAL,1);


As you can see, by changing USB_VID and USB_PID in the line of code, you can change the VID and PID of your Arduino board. I changed mine to the VID and PID of my Portal (all Swap Force Portals have the same PID and VID)

At the end, both lines 75 and 78 read the following:

Code:
D_DEVICE(0x00,0x00,0x00,64,0x1430,0x0150,0x100,IMANUFACTURER,IPRODUCT,ISERIAL,1);


Now, I did brick my Arduino Micro quite a few times messing around with the Keyboard.h's library's main code. Luckily I had my Uno (clone) which I was able to reflash the Micro's bootloader with. If you try this, I recommend you have the same.

So I put together a minimal sketch that includes the Keyboard.h library:

Code:
#include <Keyboard.h>

void setup(){

Keyboard.begin();

}


void loop(){

//nothing to see here

}


And uploaded this to my Micro. I fired up Skylanders Swap Force on my Wii and plugged in the Arduino Micro into the USB port of the Wii. Here's where I got excited: THE GAME RECOGNIZED IT AS A PORTAL! Now I got excited I fired up a Test GUI from a library called HIDAPI, and I plugged in my main Portal. I started placing figures on the Portal and the Portal would send data to the computer (however, the colors of the Portal were not changing based off of the type of character I placed on the Portal).

I used Serial.write(); to try to replicate the data that the Portal was sending to my PC, but I forgot that the Portal used a Raw HID method of data transfer, not Serial. So Serial wouldn't work.

I ripped my copy of Skylanders Swap Force to a WBFS file and started the game in Dolphin. It recognized the (real) Portal, but it wouldn't recognize figures. So I followed these instructions to get the Portal working, and got it. Make sure to use Zadig 2.0.1! So now Dolphin is recognizing the Portal and it's working just like a real console. Because we replaced the driver in Zadig, the Test GUI won't recognize our Portal anymore, so I used USBlyzer to see the data.

I think all we need now is a way to write RAW (!) HID data from the Arduino, because that's the protocol the Portal uses.

I'd really like to get this figured out and get a character emulated.



I used a fresh and portable Arduino environment to do this. You can download it here. This includes the test.ino sketch.


I believe the Dropbox link is not reliable.


Also, I'll add this here ( I think there is a YouTube demo)
https://github.com/brandonlw/USBSimulator
http://www.brandonw.net/360bridge/doc.php
http://www.brandonw.net

I believe this shows USBSimulator and discusses xbox360 workaround but with Disney Infinity

 
Last edited by Bug_Checker_, , Reason: Updated

dpad_5678

Ape weak on own. Ape strong in unity.
OP
Member
Joined
Nov 19, 2015
Messages
2,219
Trophies
1
XP
2,880
Country
United States
I like the idea. Could you possibly finish this and, if possible, use the same PoC for amiibos? That would be amazing if you could :D
Unfortunatley this method is based on emulating the Skylanders USB Portal. Amiibo's use external readers/writers (O3DS (XL), 2DS) and built in readers/writers (Switch, Wii U N3DS (XL). So for now, just use the NTAG215 method.
 

bennyman123abc

Well-Known Member
Member
Joined
Mar 21, 2013
Messages
920
Trophies
1
Age
22
Location
Alton, IL
XP
1,208
Country
United States
Unfortunatley this method is based on emulating the Skylanders USB Portal. Amiibo's use external readers/writers (O3DS (XL), 2DS) and built in readers/writers (Switch, Wii U N3DS (XL). So for now, just use the NTAG215 method.
Would it be possible with a rewritable and attached NTAG?
 
  • Like
Reactions: Theprodigyhnic

bengalih

Well-Known Member
Member
Joined
Jun 28, 2009
Messages
133
Trophies
0
XP
438
Country
United States
So this is totally related - but I didn't want to start a new one as this thread isn't super old and also there doesn't seem to be that much interest.

I'm just curious as to why someone wasn't able to create a gct cheat code or something that simply bypasses the portal tricks the game into thinking a particular figure is mounted? I of course wouldn't know where to begin with this, but with all the wizards working on this stuff I'm surprised this was so difficult to do.
 

GreyWolf

Well-Known Member
Member
Joined
Mar 2, 2015
Messages
5,399
Trophies
0
Age
54
XP
1,516
Country
United States
So this is totally related - but I didn't want to start a new one as this thread isn't super old and also there doesn't seem to be that much interest.

I'm just curious as to why someone wasn't able to create a gct cheat code or something that simply bypasses the portal tricks the game into thinking a particular figure is mounted? I of course wouldn't know where to begin with this, but with all the wizards working on this stuff I'm surprised this was so difficult to do.

I'm not certain but I think the game also stores data on the figures, not just reading them.
 

Jubliano

New Member
Newbie
Joined
Oct 24, 2018
Messages
1
Trophies
0
Age
34
XP
53
Country
Netherlands
Awesome work dude, unfortunately the dropbox link is down. Could you reupload the files? Also, how did you capture and decrypt the packets?
 

obiima

Member
Newcomer
Joined
May 14, 2017
Messages
12
Trophies
0
XP
835
Country
Netherlands
FYI. It is possible to emulate a Skylanders portal for Xbox 360 but you need the security chip from a real Xbox 360 Skylanders portal (or another Activision Xbox 360 USB device) or a USB host shield with a real Xbox 360 portal connected to it.
 

Shrommygnome

Member
Newcomer
Joined
Jun 7, 2018
Messages
13
Trophies
0
XP
231
Country
United Kingdom
FYI. It is possible to emulate a Skylanders portal for Xbox 360 but you need the security chip from a real Xbox 360 Skylanders portal (or another Activision Xbox 360 USB device) or a USB host shield with a real Xbox 360 portal connected to it.

Obiima will you continue to develop the v4 board?

Thanks alot in advance
 

Theprodigyhnic

Active Member
Newcomer
Joined
Mar 24, 2017
Messages
32
Trophies
0
Age
34
XP
558
Country
United States
What ever became of this project. All the links are dead. Did he give up working on it. Also anyone have any information on Obiima Disney Infinity base emulator I can’t find information any where. I have been trying to find a copy of his V3 firmware and instructions on how to build it but I haven’t had any luck in finding anything.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • Sicklyboy @ Sicklyboy:
    I'm not familiar with the technicalities of the differences between the two versions, but I'm wondering if at least some of those differences are things that you could port over to the US version in your patch without having to include copyrighted assets from the EU version
  • TwoSpikedHands @ TwoSpikedHands:
    @Sicklyboy I am wanting to fully change the game and bend it to my will lol. I would like to eventually have the ability to add more characters, enemies, even have a completely different story if i wanted. I already have the ability to change the tilemaps in the US version, so I can basically make my own map and warp to it in game - so I'm pretty far into it!
  • TwoSpikedHands @ TwoSpikedHands:
    I really would like to make a hack that I would enjoy playing, and maybe other people would too. swapping to the EU version would also mean my US friends could not legally play it
  • TwoSpikedHands @ TwoSpikedHands:
    I am definitely considering porting over some of the EU features without using the actual ROM itself, tbh that would probably be the best way to go about it... but i'm sad that the voice acting is so.... not good on the US version. May not be a way around that though
  • TwoSpikedHands @ TwoSpikedHands:
    I appreciate the insight!
  • The Real Jdbye @ The Real Jdbye:
    @TwoSpikedHands just switch, all the knowledge you learned still applies and most of the code and assets should be the same anyway
  • The Real Jdbye @ The Real Jdbye:
    and realistically they wouldn't

    be able to play it legally anyway since they need a ROM and they probably don't have the means to dump it themselves
  • The Real Jdbye @ The Real Jdbye:
    why the shit does the shitbox randomly insert newlines in my messages
  • Veho @ Veho:
    It does that when I edit a post.
  • Veho @ Veho:
    It inserts a newline in a random spot.
  • The Real Jdbye @ The Real Jdbye:
    never had that i don't think
  • Karma177 @ Karma177:
    do y'all think having an sd card that has a write speed of 700kb/s is a bad idea?
    trying to restore emunand rn but it's taking ages... (also when I finished the first time hekate decided to delete all my fucking files :wacko:)
  • The Real Jdbye @ The Real Jdbye:
    @Karma177 that sd card is 100% faulty so yes, its a bad idea
  • The Real Jdbye @ The Real Jdbye:
    even the slowest non-sdhc sd cards are a few MB/s
  • Karma177 @ Karma177:
    @The Real Jdbye it hasn't given me any error trying to write things on it so I don't really think it's faulty (pasted 40/50gb+ folders and no write errors)
  • DinohScene @ DinohScene:
    run h2testw on it
    +1
  • DinohScene @ DinohScene:
    when SD cards/microSD write speeds drop below a meg a sec, they're usually on the verge of dying
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    Samsung SD format can sometimes fix them too
  • Purple_Heart @ Purple_Heart:
    yes looks like an faulty sd
  • Purple_Heart @ Purple_Heart:
    @Psionic Roshambo i may try that with my dead sd cards
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    It's always worth a shot
  • TwoSpikedHands @ TwoSpikedHands:
    @The Real Jdbye, I considered that, but i'll have to wait until i can get the eu version in the mail lol
  • I @ I-need-help-with-wup-wiiu:
    i need help with nusspli failed downloads, can someone respond to my thread? pretty please:wub: