diff --git a/ReverseEngineering/Luna_maiboard_V000456-00_rev3.md b/ReverseEngineering/Luna_maiboard_V000456-00_rev3.md
index 58b26b69..007ed002 100644
--- a/ReverseEngineering/Luna_maiboard_V000456-00_rev3.md
+++ b/ReverseEngineering/Luna_maiboard_V000456-00_rev3.md
@@ -10,9 +10,9 @@ Note that this [Teardown of Steam Controller](https://www.ifixit.com/Teardown/St
# LPC11U37F/501
-This is an ARM Cortex-M0, and seems to be the main/master processor of the Steam Controller.
+This is an ARM Cortex-M0, and seems to be the main/master processor of the Steam Controller.
-## Resources
+## Resources
This sections tracks useful documentation related to the processor.
@@ -43,7 +43,7 @@ This sections details how the pins of the process are configured and (potentiall
| 13 | PIO0_2 | PIO0_2 | In | Interrupt (PINT1) setup to monitor if this changes (trace leads to C56, continues to...). Seems to have something to do with Brown Out Detection. |
| 14 | PIO1_26 | PIO1_26 | In | S2 - Left trackpad click |
| 15 | PIO1_27 | PIO1_27 | In | S3 - LT (Left trigger digital) |
-| 16 | PIO1_4 | PIO1_4 | In | S8 - LB (Left bumper) |
+| 16 | PIO1_4 | PIO1_4 | In | S8 - LB (Left bumper) |
| 17 | PIO1_1 | PIO1_1 | Out | Active low enable for analog triggers (Left = AD0, Right = AD2) |
| 18 | PIO1_20 | PIO1_20 | In | S17 - FRONT_L (Front left arrow button) |
| 19 | PIO0_3 | USB_VBUS | In | Monitors the presence of USB bus power. Interrupt (PINT0) set to monitor if this changes. |
@@ -55,13 +55,13 @@ This sections details how the pins of the process are configured and (potentiall
| 25 | USB_DM | | | |
| 26 | USB_DP | | | |
| 27 | PIO1_24 | PIO1_24 | In? | Related to PIO1_8. Related to USART maybe? TODO |
-| 28 | PIO1_18 | TXD (USART) | Out | Connected to Nordic Semiconductor nRF51822 Bluetooth Smart and 2.4GHz proprietary SoC Pin 20 |
+| 28 | PIO1_18 | TXD (USART) | Out | Connected to Nordic Semiconductor nRF51822 Bluetooth Smart and 2.4GHz proprietary SoC Pin 20 |
| 29 | PIO0_6 | not(USB_CONNECT) | Out | Signal used to switch an external 1.5 k resistor under software control. Used with the SoftConnect USB feature. |
| 30 | PIO0_7 | PIO0_7 | Out | Set as output GPIO and driven low during init (trace leads to R9 (no-pop)). Related/similar to GPIO1_28? Any other purpose? More details? TODO|
| 31 | PIO1_28 | PIO1_28 | Out | Set as output GPIO and driven low during init (trace leads to R8 (no-pop)). Related/similar to GPIO0_7? Any other purpose? More details? TODO |
| 32 | PIO1_5 | PIO1_5 | In | USART/Radio Chip Related. PINT2 setup to monitor change. Trace leads to TODO|
| 33 | VDD | VDD | In | VDD |
-| 34 | PIO1_2 | PIO1_2 | In | S19 - FRONT_R (Front right arrow button) |
+| 34 | PIO1_2 | PIO1_2 | In | S19 - FRONT_R (Front right arrow button) |
| 35 | PIO1_21 | PIO1_21 | In | S5 - Right trackpad click |
| 36 | PIO0_8 | MISO0 | In | Master In Slave Out for SSP0. Connected to MISO on Right Trackpad/Haptic and Left Trackpad/Haptic. |
| 37 | PIO0_9 | MOSI0 | Out | Master Out Slave In for SSP0. Connected to MOSI on Right Trackpad/Haptic and Left Trackpad/Haptic. |
@@ -77,10 +77,10 @@ This sections details how the pins of the process are configured and (potentiall
| 47 | PIO1_13 | PIO1_13 | In | S6 - RT (Right trigger digital) |
| 48 | VDD | VDD | In | VDD |
| 49 | PIO1_14 | PIO1_14 | In | S10 - RB (Right bumper) |
-| 50 | PIO1_3 | PIO1_3 | In | S16 - Right inner grip button |
+| 50 | PIO1_3 | PIO1_3 | In | S16 - Right inner grip button |
| 51 | PIO1_22 | PIO1_22 | In | S4 - B Button |
| 52 | SWDIO/PIO0_15 | SWDIO? | | Connected to DEBUG interface for LPC11U37F |
-| 53 | PIO0_16 | | | |
+| 53 | PIO0_16 | | | |
| 54 | VSS | VSS | In | VSS |
| 55 | PIO1_9 | PIO1_9 | In | S7 - X Button |
| 56 | PIO0_23 | PIO0_23 | In | Input with pull-down resistor enabled. Connected to Data Ready on Right Trackpad/Haptic. |
@@ -88,7 +88,7 @@ This sections details how the pins of the process are configured and (potentiall
| 58 | VDD | VDD | In | VDD |
| 59 | PIO1_12 | PIO1_12 | Out | Right Haptic Activate. Toggle to generate vibrations (TODO: need better details on this). Initially input. Read during init to check if it is logic low or not. (trace leads to VDD on Trackpad/Haptics). If low PIO0_18 is checked. Later set to output and driven low (before PIO0_18 is set to output and driven low). |
| 60 | PIO0_17 | PIO0_17 | In | S1 - A Button |
-| 61 | PIO0_18 | PIO0_18 | Out | Left Haptic Activate. Toggle to generate vibrations (TODO: need better details on this). Initially input (If PIO1_12 is low this is read during init to check if it is logic low or not. (trace leads to R43 on front of PCB))? Later output related to haptics? |
+| 61 | PIO0_18 | PIO0_18 | Out | Left Haptic Activate. Toggle to generate vibrations (TODO: need better details on this). Initially input (If PIO1_12 is low this is read during init to check if it is logic low or not. (trace leads to R43 on front of PCB))? Later output related to haptics? |
| 62 | PIO0_19 | PIO0_19 | Out | Active high enable for powering Joystick to produce X and Y position ADC values. |
| 63 | PIO1_16 | PIO1_16 | In | Input with pull-down resistor enabled. Connected to Data Ready on Left Trackpad/Haptic. |
| 64 | PIO1_6 | PIO1_6 | Out | Chip Select/SS for Left Trackpad/Haptic (active low) |
@@ -98,7 +98,7 @@ This sections details how the pins of the process are configured and (potentiall
This section details what peripherals are used for on this processor.
* I2C Bus
- * Interface to MPU-6650?
+ * Interface to MPU-6500?
* TODO: Not confirmed yet.
* WWDT
* TODO: unknown.
@@ -179,7 +179,7 @@ This section details what peripherals are used for on this processor.
This is a 6-axis motion tracking device (i.e. accelerometer, gyroscope).
-## Resources
+## Resources
* TODO: datasheet, etc.
@@ -213,13 +213,13 @@ This is a 6-axis motion tracking device (i.e. accelerometer, gyroscope).
| 24 | SDA/SDI | I2C SDA | Connected to Pin 21 on LPC11U37F |
-# nRF51822
+# nRF51822
-This is the powerful, highly flexible multiprotocol SoC ideally suited for
+This is the powerful, highly flexible multiprotocol SoC ideally suited for
Bluetooth® low energy and 2.4GHz ultra low-power wireless applications. The
silkscreen labels this as RADIO.
-## Resources
+## Resources
* TODO: datasheet, etc.
@@ -277,16 +277,16 @@ This is the powerful, highly flexible multiprotocol SoC ideally suited for
| 48 | | | |
-# Cirque 1CA027
+# Cirque 1CA027
-This is the processor on the haptics board, which seems to be a custom design
+This is the processor on the haptics board, which seems to be a custom design
similar to the [GlidePoint TM040040](http://www.cirque.com/glidepoint-circle-trackpads).
-## Resources
+## Resources
* TODO: datasheet, etc.
-## Pinout
+## Pinout
| Pin Number | Datasheet Name | Pin Function | Notes |
|--------------:|-----------------------|---------------|---------------|
@@ -309,11 +309,11 @@ This is the processor on the haptics board, which seems to be a custom design
| 17 | | | |
| 18 | | | |
| 19 | | | |
-| 20 | | | |
-| 21 | | | |
+| 20 | | | |
+| 21 | | | |
| 22 | | | |
-| 23 | | | |
-| 24 | | | |
+| 23 | | | |
+| 24 | | | |
| 25 | | | |
| 26 | | | |
| 26 | | | |
diff --git a/ReverseEngineering/README.md b/ReverseEngineering/README.md
index f7badd50..bd10eab8 100644
--- a/ReverseEngineering/README.md
+++ b/ReverseEngineering/README.md
@@ -1,16 +1,16 @@
# Reverse Engineering
-Welcome to Reverse Engineering Subproject portion the Open Steam Controller effort.
-
+Welcome to Reverse Engineering Subproject portion the Open Steam Controller effort.
+
The work in this directory is the result of trying to understand the hardware
and its capabilities based on the available resources. In this case the resources
available were the circuit board itself and the raw binary firmware for the
- controller's main processor (the LPC11U37F).
+ controller's main processor (the LPC11U37F).
There is a lot of really neat and useful information captured here (i.e. the
fact that there is a section of EEPROM where Jingle Data can be stored to
change the official firmware's default behavior, how the interface to the
- Trackpads works) and the result of these efforts are the basis of many of the
+ Trackpads works) and the result of these efforts are the basis of many of the
Subprojects in the Open Steam Controller effort. If anything is unclear, or
you think I am not drawing proper attention to feature I have unearthed,
please be sure to let me know.
@@ -19,7 +19,7 @@ See the sections below for further details on the data that has been captured
in regards to the hardware and software, but please note that this is my first attempt
at reverse engineering. I may have not gone about this in the most efficient
or understandable manner, but I have done my best to make sure the results
- are captured concisely so that others may benefit from it.
+ are captured concisely so that others may benefit from it.
# Understanding the Hardware
@@ -28,26 +28,27 @@ This section captures details on the controller hardware (i.e. what pins are
connected to what peripherals or pins on other chips). This data was sometimes
obtained simply by using digital multimeter to ohm out connections. Other times
reverse engineering the firmware, or running tests with custom firmware were
- required to fully understand how the hardware was designed.
+ required to fully understand how the hardware was designed.
-See [Luna_maiboard_V000456-00_rev3.md](./Luna_maiboard_V000456-00_rev3.md)
- for information regarding the Steam Controller hardware pertaining to
+See [Luna_maiboard_V000456-00_rev3.md](./Luna_maiboard_V000456-00_rev3.md)
+ for information regarding the Steam Controller hardware pertaining to
Luna_mainboard V000456-00 rev3.
+See [d0ggle.md](./d0ggle.md) for information regarding the Steam Controller
+ Dongle hardware.
# Understanding the Software
-This section captures details on the software running on the controller
+This section captures details on the software running on the controller
processors. This data was primarily obtained by using a modified version
of [pinkySim](https://github.com/greggersaurus/pinkySim), which allowed for
- simulating the main processor (LPC11U37F) and logging relevant actions.
+ simulating the main processor (LPC11U37F) and logging relevant actions.
Verification of different behaviors often required running custom firmware
- to ensure the proper paths were being simulated.
+ to ensure the proper paths were being simulated.
See [LPC11U37F_Software.md](./LPC11U37F_Software.md) for information regarding
the software running on the LPC11U37 main/master processor.
-
# TODO
See [TODO](./TODO.md) for details.
diff --git a/ReverseEngineering/d0ggle.md b/ReverseEngineering/d0ggle.md
new file mode 100644
index 00000000..39b2e262
--- /dev/null
+++ b/ReverseEngineering/d0ggle.md
@@ -0,0 +1,77 @@
+# D0ggle Hardware
+
+The d0ggle is the dongle that comes with the steam controller. It is a very
+simple, off-the-shelf nRF24LU1+ USB device capable of sending radio packets. It
+comes preloaded with Valve's `d0ggle.bin` firmware, that can be found in the
+Steam client files inside a folder named `controller_base`.
+
+# nRF24LU1+
+
+The nRF24LU1+ is an Intel 8051 microcontroller coupled with an nRF24L01 2.4GHz
+Transceiver. This chip is used in a lot of similar hardware, such as the
+Logitech Unifying dongles, or many other proprietary wireless keyboard/mouse
+dongles.
+
+## Resources
+
+- [Product Specification v1.0](https://web.archive.org/web/20191011024449/https://www.sparkfun.com/datasheets/Wireless/Nordic/nRF24LU1P_1_0.pdf)
+
+## Pinout
+
+| Pin Number | Datasheet Name | Pin Function | Pin Direction | Notes |
+|--------------:|-----------------------|------------------|---------------|---------------|
+| 1 | VDD | | | |
+| 2 | VBUS | | | |
+| 3 | VDD | | | |
+| 4 | D+ | | | |
+| 5 | D- | | | |
+| 6 | VSS | | | |
+| 7 | PROG | | | |
+| 8 | RESET | | | |
+| 9 | VDD | | | |
+| 10 | P0.0 | | | |
+| 11 | P0.1 | | | |
+| 12 | VSS | | | |
+| 13 | P0.2 | | | |
+| 14 | P0.3 | | | |
+| 15 | P0.4 | | | |
+| 16 | P0.5 | | | |
+| 17 | VSS | | | |
+| 18 | VSS | | | |
+| 19 | VDD | | | |
+| 20 | VDD_PA | | | |
+| 21 | ANT1 | | | |
+| 22 | ANT2 | | | |
+| 23 | VSS | | | |
+| 24 | VDD | | | |
+| 25 | IREF | | | |
+| 26 | VSS | | | |
+| 27 | VDD | | | |
+| 28 | DEC1 | | | |
+| 29 | DEC2 | | | |
+| 30 | VSS | | | |
+| 31 | XC2 | | | |
+| 32 | XC1 | | | |
+
+## Software
+
+The software running on the dongle can be found in a file called d0ggle.bin in
+Steam's client files. TODO: Find where it can be downloaded.
+
+The dongle exposes a USB device with VID 0x28de and PID 0x1104. It exposes four
+HID interfaces, each corresponding to a single controller connection. They can
+be manipulated mostly independently (e.g. when pairing, it's recommended to send
+the "pairing packet" to all four interfaces).
+
+Each HID interface follows the Valve Controller Abstraction Protocol. The Packet
+IDs accepted by the dongle are documented in the [valve protocol documentation].
+
+The dongle also features a USB Bootloader mode that can be used to flash
+alternative firmwares. To enter this bootloader mode, one must send the
+[RebootToISP] packet. This bootloader is a derivative of the [Nordic nRF24
+Bootloader], modified to use USB HID instead of raw USB. It has the VID 0x28de
+and PID 0x1004.
+
+[valve protocol documentation]: valve_protocol.md
+[Nordic nRF24 Bootloader]: https://www.sparkfun.com/datasheets/Wireless/Nordic/nRF24LU1P_1_0.pdf#G1308975
+[RebootToISP]: valve_protocol.md#RebootToISP
\ No newline at end of file
diff --git a/ReverseEngineering/media/doggle_face_a.jpeg b/ReverseEngineering/media/doggle_face_a.jpeg
new file mode 100644
index 00000000..dce1ce29
Binary files /dev/null and b/ReverseEngineering/media/doggle_face_a.jpeg differ
diff --git a/ReverseEngineering/media/doggle_face_b.jpeg b/ReverseEngineering/media/doggle_face_b.jpeg
new file mode 100644
index 00000000..a5fed74d
Binary files /dev/null and b/ReverseEngineering/media/doggle_face_b.jpeg differ
diff --git a/ReverseEngineering/usbInterface.md b/ReverseEngineering/usbInterface.md
index 58895579..55b332ca 100644
--- a/ReverseEngineering/usbInterface.md
+++ b/ReverseEngineering/usbInterface.md
@@ -1,13 +1,16 @@
# USB Interface
The purpose of this document is to track details on the USB interface for the
- Steam Controller. This is done so that EP actions on the firmware side,
+ Steam Controller. This is done so that EP actions on the firmware side,
observed in simulation, can match up to real-world behavior. This will be
used to categorize more actions, memory usage, etc.
+The steam controller exposes an USB device with VID=0x28de and PID=0x1102. It
+has three different interfaces:
+
## EP1 (Keyboard)
-This interface mimics a USB keyboard.
+This interface mimics a USB keyboard.
Below are the messages received via usbmod related to different controller actions:
@@ -38,7 +41,7 @@ Below are the messages received via usbmod related to different controller actio
## EP2 (Mouse)
-This interface mimics a USB mouse.
+This interface mimics a USB mouse.
Below are the messages received via usbmod related to different controller actions:
@@ -58,15 +61,14 @@ Below are the messages received via usbmod related to different controller actio
## EP3 (Controller)
-This does not produce output by default (since custom HID only steam knows how
- to interact??).
-TODO: Map out messages with Steam running and controller in EP3 mode, or look online for people who mapped this all out already
+
+See the [valve_protocol.md](./valve_protocol.md) file for more information on
# Booting
This section details booting the controller via USB connection, with the focus
- being on what may be causing the jingle to play.
+ being on what may be causing the jingle to play.
* Connecting to wall adaptor (i.e. no OS interaction)
* LED illuminates, but no jingle and Right Trackpad is not in mouse mode (not haptic feedback)
diff --git a/ReverseEngineering/valve_protocol.md b/ReverseEngineering/valve_protocol.md
new file mode 100644
index 00000000..f187bf2b
--- /dev/null
+++ b/ReverseEngineering/valve_protocol.md
@@ -0,0 +1,237 @@
+# Valve Protocol
+
+Valve uses a unified protocol for most of their devices: The Steam Controller,
+Steam Controller Dongle, Knuckle Controllers, and even the frontplate of some
+Steam Machines?
+
+The protocol sits on top of HID, and uses Feature Reports for its
+communications. All usb devices compatible with this protocol have a USB VID of
+0x28de and a USB PID between 0x1101 and 0x1201 (exclusive). It's a sort of
+remote procedure call protocol, where the Host will send a packet via
+SET_FEATURE_REPORT to the device, and optionally retrieve the result with
+GET_FEATURE_REPORT.
+
+Each feature report is 0x40 bytes in size. The first byte of the Feature Report
+is a packet id, while the second byte is the number of additional bytes the
+report contains.
+
+Host->Device:
+
+
+ ID | Name | Bootloader | Firmware | Dongle
+-------|--------------------------------------|------------|------------|--------
+ 0x80 | SetControllerMappings | ⛔ | ✅ | ⛔
+ 0x81 | [ClearControllerMappings] | ⛔ | ✅ | ❓
+ 0x82 | GetControllerMappings | ⛔ | ✅ | ✅
+ 0x83 | [ControllerInfoRequest] | ✅ | ✅ | ✅
+ 0x84 | | ⛔ | ⛔ | ✅
+ 0x85 | ResetControllerMappings | ⛔ | ✅ | ⛔
+ 0x86 | FactoryReset | ⛔ | ⛔ | ⛔
+ 0x87 | [SetSettings] | ⛔ | ✅ | ⛔
+ 0x89 | | ⛔ | ✅ | ✅
+ 0x8a | | ⛔ | ⛔ | ✅
+ 0x8b | | ⛔ | ⛔ | ✅
+ 0x8c | | ⛔ | ⛔ | ✅
+ 0x8d | | ⛔ | ✅ | ⛔
+ 0x8e | SetSettingsDefaultValues | ⛔ | ✅ | ⛔
+ 0x8f | [TriggerHapticPulse] | ⛔ | ✅ | ✅
+ 0x90 | [RebootToISP] | ✅ | ✅ | ✅
+ 0x91 | EraseLPCFirmware | ✅ | ⛔ | ⛔
+ 0x92 | FlashLPCFirmware | ✅ | ⛔ | ⛔
+ 0x93 | VerifyLPCFirmware | ✅ | ⛔ | ⛔
+ 0x95 | [ResetSOC] | ✅ | ✅ | ⛔
+ 0x96 | SetPrngEntropy | ⛔ | ⛔ | ✅
+ 0x97 | EraseNRFFirmware | ✅ | ✅ | ⛔
+ 0x98 | FlashNRFFirmware | ✅ | ✅ | ⛔
+ 0x99 | VerifyNRFFirmware | ✅ | ✅ | ⛔
+ 0x9a | | ⛔ | ✅ | ⛔
+ 0x9b | | ⛔ | ⛔ | ✅
+ 0x9c | | ⛔ | ⛔ | ❓
+ 0x9d | | ⛔ | ⛔ | ❓
+ 0x9e | | ⛔ | ⛔ | ❓
+ 0x9f | TurnOffController | ⛔ | ✅ | ❓
+ 0xa0 | SetHardwareVersion | ✅ | ⛔ | ⛔
+ 0xa1 | | ⛔ | ⛔ | ✅
+ 0xa2 | | ⛔ | ⛔ | ✅
+ 0xa3 | | ⛔ | ⛔ | ✅
+ 0xa4 | | ⛔ | ⛔ | ✅
+ 0xa5 | | ⛔ | ⛔ | ✅
+ 0xa6 | | ⛔ | ⛔ | ✅
+ 0xa7 | CalibrateTrackpads | ⛔ | ✅ | ⛔
+ 0xa9 | | ⛔ | ✅ | ⛔
+ 0xaa | | ⛔ | ✅ | ✅
+ 0xab | | ⛔ | ✅ | ✅
+ 0xac | | ⛔ | ✅ | ⛔
+ 0xad | SetDonglePairingMode | ⛔ | ⛔ | ✅
+ 0xae | ControllerInfoRequest | ⛔ | ✅ | ⛔
+ 0xaf | | ⛔ | ⛔ | ✅
+ 0xb0 | | ⛔ | ⛔ | ✅
+ 0xb1 | SetControllerKeyboardMouseInputState | ⛔ | ⛔ | ✅
+ 0xb2 | PairingFailed | ⛔ | ⛔ | ✅
+ 0xb3 | PairingSuccess | ⛔ | ⛔ | ✅
+ 0xb4 | GetControllerInfo | ⛔ | ⛔ | ✅
+ 0xb5 | CalibrateIMU | ⛔ | ✅ | ⛔
+ 0xb6 | PlayAudio | ⛔ | ✅ | ⛔
+ 0xb7 | StartFlashJingle | ⛔ | ✅ | ⛔
+ 0xb8 | FlashJingle | ⛔ | ✅ | ⛔
+ 0xb9 | EndFlashJingle | ⛔ | ✅ | ⛔
+ 0xba | GetChipID | ⛔ | ✅ | ⛔
+ 0xbb | ReadUID | ⛔ | ✅ | ⛔
+ 0xbf | CalibrateJoystick | ⛔ | ✅ | ⛔
+ 0xc1 | SetAudioMapping | ⛔ | ✅ | ⛔
+ 0xc5 | SetUserLedColor | ⛔ | ⛔ | ⛔
+ 0xc6 | SendIRCode | ⛔ | ⛔ | ⛔
+ 0xc7 | StopIR | ⛔ | ⛔ | ⛔
+
+## ClearControllerMappings
+[ClearControllerMappings]: #ClearControllerMappings
+
+Sent when exiting lizard mode. Clears the controller mappings.
+
+## ControllerInfoRequest
+[ControllerInfoRequest]: #ControllerInfoRequest
+
+Asks the controller to send its ControllerInfo. The response will contain a
+Packet ID 0x83, and its data will be an array of HardwareInfo.
+
+### HardwareInfo
+
+Offset | Type | Field Name
+-------|------|-----------
+0 | u8 | Type
+1 | u32 | Value, little endian
+
+### HardwareInfo types
+
+Here are the different types byte understood by the Steam Client software
+(as of 1/04/2020):
+
+Type ID | Name | Bootloader | Description
+----------|--------|-----------|---------
+0 | Unknown | ⛔ | Firmware returns eeprom field 8.
+1 | USB PID | ✅ | The same as the USB PID. Likely more useful for wireless transmission.
+2 | flags? | ⛔ | Firmware always returns 3
+3 | Unknown | ⛔ | Not sent by firmware.
+4 | Firmware Version | ✅ | Version/timestamp of the firmware running on the LPC side (e.g. 57bf5c10).
+5 | NRF Firmware Version | ⛔ | Version/timestamp of the firmware running on the NRF side
+9 | Hardware Version | ✅ | Version of the controller hardware (as stored in EEPROM)
+10 | Unknown | ⛔ | Firmware returns the data stored at DAT_10000078
+11 | Unknown | ⛔ | Not sent by firmware.
+
+## SetSettings
+[SetSettings]: #SetSettings
+
+Sets the controller settings. The additional data is an array of ControllerSetting.
+
+### Controller settings
+
+Offset | Type | Field Name
+-------|------|-----------
+0 | u8 | Setting Type
+1 | u16 | Setting Value, little endian
+
+### Setting types
+
+ ID | Name | Min | Max | Default | Description
+-----|------|-----|--------|---------|---------------
+0x00 | | 0 | 10 | 8 |
+0x01 | | 0 | 10 | 3 |
+0x02 | | 0 | 360 | 345 |
+0x03 | | 0 | 25000 | 1200 |
+0x04 | | 0 | 1 | 0 |
+0x05 | | 0 | 1 | 0 |
+0x06 | | 0 | 6 | 0 |
+0x07 | | 0 | 8 | 3 |
+0x08 | | 0 | 8 | 0 | Lizard mode related? Data is 7 when sent to dongle.
+0x09 | | 0 | 1 | 1 |
+0x0a | | 0 | 0x4000 | 7000 |
+0x0b | | 0 | 30 | 6 |
+0x0c | | 0 | 50 | 5 |
+0x0d | | 1 | 500 | 100 |
+0x0e | | 0 | 200 | 50 |
+0x0f | | 0 | 2000 | 923 |
+0x10 | | 0 | 2000 | 382 |
+0x11 | | 1 | 10 | 2 |
+0x12 | | 0 | 20000 | 8000 |
+0x13 | | 0 | 4096 | 0xF830 |
+0x14 | | 0 | 4096 | 0xF254 |
+0x15 | | 0 | 500 | 5 |
+0x16 | | 0 | 8 | 2 |
+0x17 | | 0 | 8 | 2 |
+0x18 | | 0 | 20 | 15 |
+0x19 | | 0 | 0x7FFF | 4000 |
+0x1a | | 0 | 0 | 0 |
+0x1b | | 1 | 0x7FFF | 27500 |
+0x1c | | 0 | 0x1000 | 0xF830 |
+0x1d | | 0 | 0x1000 | 0xF254 |
+0x1e | | 0 | 2000 | 0 |
+0x1f | | 1 | 0x4000 | 12000 |
+0x20 | | 0 | 1 | 1 |
+0x21 | | 0 | 8000 | 4000 |
+0x22 | | 1 | 500 | 200 |
+0x23 | | 0 | 1 | 0 |
+0x24 | | 0 | 1 | 0 |
+0x25 | | 10 | 1500 | 300 |
+0x26 | | 1 | 1000 | 50 |
+0x27 | | 0 | 1 | 0 |
+0x28 | | 1 | 180 | 20 |
+0x29 | | 0 | 25000 | 600 |
+0x2a | | 0 | 1 | 0 |
+0x2b | | 0 | 1 | 0 |
+0x2c | | 0 | 100 | 100 |
+0x2d | | 0 | 100 | 100 | Sent periodically
+0x2e | | 0 | 1 | 0 |
+0x2f | | 0 | 1 | 0 | Haptics ADC Sample Size. 0 = 256, 1 = 128.
+0x30 | | 0 | 0x7FFF | 0 |
+0x31 | | 1 | 2 | 2 |
+0x32 | | 0 | 0x7FFF | 1800 |
+0x33 | | 0 | 0x7FFF | 0 |
+0x34 | | 0 | 0 | 0 |
+0x35 | | 0 | 0 | 0 |
+0x36 | | 0 | 0 | 0 |
+0x37 | | 0 | 0 | 0 |
+0x38 | | 0 | 0 | 0 |
+0x39 | | 0 | 0 | 0 |
+0x3a | | 0 | 0 | 0 |
+0x3b | | 0 | 0 | 0 |
+
+## SetDonglePairingMode
+[SetDonglePairingMode]: #SetDonglePairingMode
+
+Arguments:
+- Don't pair: 0x00 0x00
+- Start pairing: 0x02 0x3c
+
+## TriggerHapticPulse
+[TriggerHapticPulse]: #TriggerHapticPulse
+
+Triggers a Haptic vibration.
+
+Offset | Type | Name
+-------|------|-------
+0 | u8 | Haptic side (0 = right, 1 = left)
+1 | u16 | ??
+3 | u16 | ??
+5 | u16 | ??
+7 | u8 | Optional - defaults to zero if not present.
+
+## RebootToISP
+[RebootToISP]: #RebootToISP
+
+Reboots this device to the in-system programmer. The specifics of that mode are
+device-specific. See the device-specific documentation for more information.
+
+Depending on the type of device, it may take additional arguments:
+
+- For the Steam Controller Dongle, takes 4 bytes of arguments: `7a 6f 74 21`. It
+ is unknown what those arguments are.
+- For the Steam Controller, takes no arguments.
+
+## ResetSOC
+[ResetSOC]: #ResetSOC
+
+Restarts the device. May optionally be passed an argument to restart the device
+in a specified mode. For the steam controller:
+
+- `C0 BA AA EC` will reset the controller in bootloader mode.
+- Otherwise, it will restart normally.