Author Topic: KNOCKOFF Back Button Attachement (CUHJ-15017) (Read 3967 times)

RDC · « **on:** October 12, 2020, 03:18:37 PM »

Finally picked one of these up, that didn't cost an arm and a leg and have poked around with it a bit. Will get some better images and such up when I have the time. Suspect now that it's a knockoff compared to the one mrt posted an image of here https://www.acidmods.com/forum/index.php/topic,44569.msg335405.html#msg335405 as well as another one LethalPrime brought to my attention.

Not really a heck of a lot going on in there hardware wise, it's pretty much all firmware that makes it happen.

Interestingly, they seem to have designed it with 4 buttons in mind (this board version anyway) instead of the 2 that other version of the board has. The 2 unpopulated buttons do nothing if they are installed, so I'm sure the firmware just isn't setup for it.

The display is a 128 x 32 OLED, possibly using the SSD1306 driver. I'll know more about that once I get an adapter board made up so I can see what's going on there, but it's pretty much laid out like the typical SPI controlled OLED display of that size using a 15 pin connector.

1 - C2P
2 - C2N
3 - C1P
4 - C1N
5 - 3.2v
6 - GND
7 - 3.2v
8 - CS
9 - RES
10 - D/C
11 - CLK
12 - DIN
13 - IREF
14 - VCOMH
15 - VCC

The interface between the attachment and the controller is I2C (360kHz) and it's a little interesting as it seems to be setup for more data than they are using it for with this attachment.

After all of the initial back and forth it goes thru, most likely just identifying what it is, it settles into pattern of asking for the same 5 bytes over and over roughly every 3ms, with only the first 2 bytes containing the buttons that have been setup.

20 = Request

Reply
00 = No button pressed or assigned
02 = L3
04 = R3
08 = OPT
10 = DU
20 = DR
40 = DD
80 = DL

1D = Request

Reply
00 = No button pressed or assigned
01 = L2
02 = R2
04 = L1
08 = R1
10 = /\
20 = O
40 = X
80 = [ ]

1F = Request, Reply 00 = Nothing

18 = Request, Reply 00 = Nothing

1C = Request, Reply 00 = Nothing

My Schematic* of the 3 boards in there - https://www.acidmods.com/RDC/DS4/CUHJ-15017/CUHJ-15017_v0.1.pdf

*Mostly complete, until I'm done messing with it and can remove everything for checking the missing values as well as PCB layout.

I may prod around a little more and see what happens. Kind of interested in seeing what tossing some data into the 3 unused spots might do. Most likely nothing, but who knows.

UPDATE:

Finally have an official one of these to look at, and this thing is for sure some kind of clone or something. It was purchased on eBay and the seller is pretty adamant about me "taking it to a Sony store to get the answer that is different from my though" Well, that there explains about as much as anyone should need to know, so that's not happening. If anyone does or knows anyone that works for Sony maybe they can shed some actual light on what this thing is, clone or was it licensed to be made as cheaply and shady as possible?

Well, here's my thoughts, and images on the subject.

First off, their packaging is pretty much a dead give away. Should have stopped once I saw that but figured it may have just been a store return or who knows since these things were rare for awhile, and getting even a used actual one I would have lived with.

OFFICIAL BOX

CLONE BOX

OFFICIAL PACKAGING

CLONE PACKAGING

Model numbers and stickers are very different.

OFFICIAL = CUHYA-0100

CLONE = CUHJ-15017

Then we get to the insides, and again it's night and day different. Official one is on the left, Clone is on the right.

LCD Connector is 17 pin on the Official, 15 pin on the Clone

HEADSET Connector Much different. They must not have been able to source the correct one as they had to put a small riser board underneath theirs to make it sit at the same height.

SELECT Button

BUTTONS

Finally the Motherboard, just again night and day different.

OFFICIAL MOTHERBOARD

CLONE MOTHERBOARD

LethalPrime · « **Reply #1 on:** October 12, 2020, 11:43:47 PM »

I have two boxed up launch edition ones that I intended to keep always sealed and collect if you want one at cost to poke around in.

RDC · « **Reply #2 on:** October 13, 2020, 02:49:59 AM »

Sent you a PM I'd be curious if that board version is different as well, since what seems to be the latter version does not have silk, 4 buttons and what seems like some Diode protection in there, aka a much nicer board, so part of me suspects this may be a knockoff the more I look at it, so having a know earlier version to look at would be nice.

LethalPrime · « **Reply #3 on:** October 13, 2020, 04:41:07 AM »

Yours does look a little different compared to the spawn wave tear down of the launch version, granted he didnt do closeups but the chip looks much larger in your tear down compared to his. It could just be perspective and camera lens size though.

I just saw your message I?ll respond to you as soon as I can. The model number on the launch boxes is CUHYA-0100 3004784

https://youtu.be/wG2H7JIKSwc

RDC · « **Reply #4 on:** October 13, 2020, 07:55:08 AM »

That one looks pretty much the same as the what I was considering a latter version, but suspect now that's an original as well. It looks like it also has a QFN style chip in it and no silk on the board, and the OLED FPC is different as well, so pretty convinced now this one here is a knockoff. Be interesting to see how much, if any, the data between them differs.

wickated · « **Reply #5 on:** October 13, 2020, 11:14:42 AM »

yeah, thats another chinese clone lol. its readable cuz it have tons of testpoints and erased mcu name(guess its STC chip)

RDC · « **Reply #6 on:** October 13, 2020, 03:51:53 PM »

So how many clones of this are there? or do you just mean 'another' as in another clone of something else?

Not sure what test points have to do with being able to read it. It does make that whole process a little easier, but I made adapters to be able get the LA on that EXT port bus ages ago.

LethalPrime · « **Reply #7 on:** October 13, 2020, 04:50:28 PM »

https://youtu.be/33Ux7nd3IpA

Teardown of a confirmed fake looks exactly like this one with the chip identifier scraped away.

If they haven?t made new cheaper to manufacture batches then the box model number should be the same on the boxes with just a different batch number next to it.

I can try to verify but I try to keep everything I do as car pickup only. I?ll see if I can schedule one for tomorrow, if the box model number is the same as launch I doubt Sony changed the insides and these are all just 1:1 clones.

Then again they could be stock intended for other regions and the clones could just be factory rejects with a different controller chip

MCorgano · « **Reply #8 on:** October 15, 2020, 04:31:31 AM »

I have one that I am pretty sure is legit, sold at EB games and walmart in canada, seems like we got a second wave of them come in. I can disassemble it and take a picture of the boards if you like.

Question about the headphone jack, i noticed it has a split ring on it. Is this needed? Like say we could dump and recreate the firmware / microprocessor setup, would we need to source a connector with this specific split-ring headphone jack?

RDC · « **Reply #9 on:** October 15, 2020, 04:54:36 AM »

Maybe you can dump and recreate the firmware, but I'd be pretty sure you all you'd get is garbage as I imagine they have some kind of protection implemented in there as pretty much every microcontroller has some type of that or another.

As far as this knockoff goes, it doesn't seem to be that complicated of a protocol, but on those thing they sometimes have a way of getting around or tricking the other device into working with it, so the official one might look completely different on the LA. I'll find that one once I get the official one here to compare that. Wouldn't be surprised if it was exactly the same, but also wouldn't be surprised if there was a completely different thing going on there.

That TRRS connector is setup that way so that the BBA can be plugged into the controller all the time and the controller doesn't think that a headset has been plugged in. That is that split ring stays open if just the BBA is plugged in, so the controller ignores the headset port. Then the jack on the BBA is the one that shorts that split ring together when you plug a headset into the BBA, so then the controller can tell if you have the headset plugged in or not. So technically yes, or you design your setup to stay away from that headset jack on the controller so only the actual headset would ever get plugged into it.

wickated · « **Reply #10 on:** October 15, 2020, 08:21:09 AM »

it is STC chip, they have read block bit, if u try to dump it it will be erased instead.

MCorgano · « **Reply #11 on:** October 16, 2020, 02:10:30 AM »

About the chips erasing themselves, is there any way around this? Or is the read blocking basically a dead end for dumping the firmware?

Quote from: RDC on October 15, 2020, 04:54:36 AM

That TRRS connector is setup that way so that the BBA can be plugged into the controller all the time and the controller doesn't think that a headset has been plugged in. That is that split ring stays open if just the BBA is plugged in, so the controller ignores the headset port.

That's actually quite clever. I was wondering if they were using it for some kind of data communication, to make the connector setup even MORE obscure and difficult for third parties to implement. Makes a lot of sense why it's set up that way now.

RDC · « **Reply #12 on:** October 16, 2020, 03:26:07 AM »

If the official one works even remotely the same way that the knockoff does then it shouldn't be too difficult to make your own, just need to figure out if there is anything funky going on in that protocol there. I know the knockoff has a 40 byte string that it spits out, not sure if that is what the controller is using to determine what the attachment is or what there yet. The official one should be here next week and after I've poked around with it a bit I'll know more there. Dumping the knockoff firmware isn't even on my list of things to try.

All of this is still vastly complicated versus just wiring up a couple of extra buttons and when all is said and done far more expensive than installing a reamapper and up to 6 remappable Tacts.

MCorgano · « **Reply #13 on:** October 17, 2020, 12:15:14 AM »

still it'd be pretty cool to have something like a remapper, but entirely clip on / exturnal. 3D print some paddles and a clip to hold everything, off you go. Heck even a straight copy of the official BBA but with 4 buttons would be enough to get a lot of people interested.

LethalPrime · « **Reply #14 on:** October 17, 2020, 03:25:21 AM »

Both the knockoff and the original cost 30 bucks so you?re wasting your time trying to make your own clone. I suspect the reason the clone has a place for theoretical 4 buttons is because it?s probably just a reprogrammed Aoilion back button attachment cloned to look and work like Sony?s 2 buttons one.

MCorgano · « **Reply #15 on:** October 18, 2020, 08:04:14 AM »

Making a clone would be more for experimentation / additional features. I have no idea if it's possible to do so, because the original doesn't seem to use this, but it'd be awesome if the BBA can also read the button state. Ex for holding a controller button to assign BBA button assignments. Further things like back buttons pressing multiple buttons, or triggering macros / recording and playing back macros would be very impressive for something you just plug in.

LethalPrime · « **Reply #16 on:** October 22, 2020, 11:33:17 AM »

Have you had time to take a look inside the genuine one RDC?

RDC · « **Reply #17 on:** October 22, 2020, 12:42:12 PM »

A little bit, still digging into it though. The first post has been updated.

MCorgano · « **Reply #18 on:** October 23, 2020, 02:22:37 AM »

Wow those main board are night and day. Makes me happy to know the one i opened so far was legit though. Very curious if the 3rd and 4th button pads on the clone do anything - have you tried triggering them yet?

RDC · « **Reply #19 on:** October 23, 2020, 03:24:55 AM »

Check out the stuff in between the pics.

LethalPrime · « **Reply #20 on:** October 24, 2020, 11:40:28 PM »

Can confirm now that the model number hasn?t changed in the new batch available in stores

MCorgano · « **Reply #21 on:** November 17, 2020, 03:57:28 AM »

Any new interesting findings? Didn't notice anything about actually trying the 3rd and 4th button spots or the 3 unused spots.

MCorgano · « **Reply #22 on:** December 08, 2020, 05:02:31 AM »

The plot thickens. https://www.aliexpress.com/item/1005001682158341.html
Almost skipped over it but i noticed it uses the EXT port communication to communicate, and is quite a bit cheaper than the original units. Morbidly curious so i ordered one but I don't have the tools to actually dissect the protocol or dump firmware. Interesting to see a design not trying to blatantly copy the original.

LethalPrime · « **Reply #23 on:** December 08, 2020, 11:19:15 AM »

Quote from: MCorgano on December 08, 2020, 05:02:31 AM

The plot thickens. https://www.aliexpress.com/item/1005001682158341.html
Almost skipped over it but i noticed it uses the EXT port communication to communicate, and is quite a bit cheaper than the original units. Morbidly curious so i ordered one but I don't have the tools to actually dissect the protocol or dump firmware. Interesting to see a design not trying to blatantly copy the original.

Looks like something they made because even Chinese fab houses probably don?t have enough OLED parts laying around right now :P

Pretty neat!

MCorgano · « **Reply #24 on:** January 11, 2021, 09:23:05 PM »

I wasted my money so you don't have to and ordered one of the cheaper china ones just to take a look inside. I have to say you get what you pay for. Only partial advantage of this over the original units is this includes rapidfire OOB and is cheaper, but you really get what you pay for.

The box was generic but not too bad. Can't complain about the packaging.

The fit of it isn't super horrible. It sort of depends on the springiness of the plastic to hold it in the right place. I have to note that the plastic feels VERY cheap. Reminds me of the plastic that is used in cheap screwdriver cases. The plastic tray that holds the screwdriver handle and bits. Definitely not as sturdy feeling as ABS. The buttons are not as clicky as the original ones, and feel mushy. The unit is also thicker overall, and the edges of the back are more square, making it less comfortable to rest your fingers on the buttons.

The connector is a simple PCB. Should work fine but is a bit of a pain to put in the controller.

The fit on the back is almost perfect, but the alignment of the connector isn't - so it hangs off the back a little.

Removing the rubber pad exposes two screw holes in the center. IT also destroys all stickiness of the adhesive rubber. If you care about getting it back together after taking it apart, I'd recommend actually cutting the rubber on either side of the middle section, and perhaps cutting a hole in the middle section for each of the 2 screws, or just scrapping the middle piece of rubber.

After the two screws are removed, the whole thing comes apart. More pieces than i was expecting

The board looks pretty basic. Has what appears to be an P24C02A EEPROM. I tried to read its contents using a CH341A programmer i had laying around, but I just get a block of F's. I don't know if dumping the firmware would be useful to anyone, but If someone wants to help me dump it I'm happy to post it here.

The processor seems to be an innosystem MP01010, but I couldn't find any info on this chip.

Back side of the board only has the buttons and leds. Nothing special

What I'm going to try is build this into the back of a ps4 controller bluetooth keyboard - the kind that fits into the controller. IT also wouldn't be super hard to 3d print and alternate back to this that has more scuf-like paddles.

wickated · « **Reply #25 on:** March 15, 2021, 05:50:21 AM »

Quote from: MCorgano on January 11, 2021, 09:23:05 PM

I wasted my money so you don't have to and ordered one of the cheaper china ones just to take a look inside. I have to say you get what you pay for. Only partial advantage of this over the original units is this includes rapidfire OOB and is cheaper, but you really get what you pay for.

bought this one too. looks and works really good for the price.

News:

Author Topic: KNOCKOFF Back Button Attachement (CUHJ-15017) (Read 3967 times)