Xbox One PadHack Thread - Calling the goons "Toodles, Gummowned, Phreak and You" Do it for the Kids

Thanks. Once I get my main stick done I’ll try this on the original ‘training’ padhack and see what happens. Maybe it’ll decided to work wired lol

Good to know, I’ll keep this as a backup option since it sounds more complicated :slight_smile:

Really? I’m only connecting to the middle contact which I assumed to just be a ‘listening’ point that doesn’t actually send voltage. I’m not saying connect the ‘broken’ analog voltage to the unaltered one’s pot, if that makes sense.

Looks like this thread slowed down. Anyone have any new information or breakthroughs?

unless someone has a bus pirate and alot of time on their hands I think we reached the extend we can from the Xb1 controller PCB.
Of course small amounts of new info might trickle in every now and then when we have a genius electronics engineer or just a ballsy modder

What I am waiting on is how would any 3rd party PCBs work out for us.

I wasn’t aware that there was more to padhack than start select guide and 8 buttons.

You forgot 4 directions.

Not sure if you followed this thread all the way through but there’s been numerous other things such as disabling wireless, removing antennas, negating analog sticks, repairing fucked up traces, etc.

Before making sarcastic ass remarks why don’t you see what kind of input other modders have given as well as myself, rather than just carrying on your typical trolling like you intended from your last post.

Not much further info to speak of really, I tried out something a little more clever to shut down the wireless but for some reason it just doesn’t want to play ball. I mean, I’m only like 3 feet away when testing, but still if I can’t get it to drop connection that close it’s not a success.

I even tried removing the end DC blocking capacitor (C62) to do what cutting the trace does pretty much, and it still connects. I stopped dinking with it after that. Truthfully, I’m stumped, I don’t know how it’s managing to make the connection with so much thrown in to ruin it. Without doing some serious testing with equipment at my work I’m out of ideas that aren’t completely asinine for the average modder. In a noisy atmosphere and farther away what I’ve done is probably just fine, but I wanted it cold stopped.

The reason the board won’t function if you remove the castellated PCB is because the security chip is on it, the main micro has signals to the other micro and not directly to the security chip, so we can’t just kill the secondary micro either even if we found a shutdown I/O.

So removing the wireless card is a bust? What about removing other components and infrared?

anyone have any input on connecting up the LED to an existing turbo panel? not sure if they mesh together since this one seems so insanely bright and can alter intensity (versus just on and off the old ones did).
Also, recommended contact point for it.

Infrared does nothing for this particular issue, I had my kinect unplugged during all of this. Infrared as I understand it is just for the advanced features like seeing if you are player 1 or 2, etc.

I started removing a few more select components from the wireless board’s transmission lines to see what would happen, nada. Shit’s obnoxious, and probably a result of the play and charge accommodation where it brings in 5v. Like a failsafe if/then/else where if it doesn’t find something recognizable but is powered then it automatically swaps to wireless, regardless of powering from 5v or 3v. This ensures it’s in a known state at all times, even if it’s annoying as shit to us.

With some more testing we can probably figure out a proper workaround, but for now I’ve got very little to add.

Hey did you happen to get the contact info for that bald guy with Microsoft? He hovered around our booth for a while. Maybe we can get some docs on the controller.

i’ve done several qanba q4s here in the bay area including the one i put into PRogs atrox. i asked him yesterday about how it was and he said he hasn’t had any issues whatsoever.

Older qanbas had a weird issue where the buttons were on different ground strings. They are not all the same.

I was thinking of trying to use my Mad Catz Se stick, but IDK how i could get the buttons to wire for both xbox 360 and xbox one. and im guessing Daisy Chaining is not a good option for this?

Yep, I posted about this maybe two weeks ago. The MCU board from the first pad I FUBAR’d was still good so I sacrificed it for science and sheared the wireless board clean off. This kills the baby…I mean board.

Warning~
The text below is fucking hard-core so if you’re the type that gets your mind blown by electronics, look away as I’m about to geek out harder than I have before

It’s been over a decade since I studied RF so I broke out one of my old E&M book and did some quick brushing up on the net. The antenna that the pad uses is called an Inverted-F Antenna (IFA), a variant of a slot antenna. See the Youtube video linked below if you feel like learning voodoo black magic that is RF. The trace we have been cutting is indeed along the antenna path, but it is not the feed source. Assuming the XB1 communicates at 2.4Ghz, that has a wavelength of ~12.5 cm. An ideal antenna will be about a quarter wavelength for maximum power transfer, which brings us to an ideal antenna length of ~3.125 cm, pretty damn close to the size of the XB1 antenna if you count the length of the meandering trace that we cut; so we are on the right track. In fact, I’m almost certain that this is a dual-band antenna (2.4 & 5 GHz) with the part that angles out to the right at ~30 degrees handling the 5 GHz band and the part on the left with the U-shape handing the 2.4 GHz band.

So with an antenna the size of 3.125 cm we can get a usable range of 30 feet according to this MS document on the XB1 controller. This white paper on IFA design seems to indicate that a PCB mounted IFA has a gain of about 2.5 dBi but lets be conservative and assume it has a gain of 1 or 0 dBi.

Finally Friis Equation states that the receiver power goes down by the square of the distance between receiver and transmitter antennas. Somebody mentioned that a cut trace right at the castellated (good word!) board would still allow them to connect at roughly a foot away. For an antenna to receive the same power at 30 ft as it does at 1 ft means the antenna at 1 ft can be 900 times worse (30 squared.) In dBi terms, that is an antenna with a gain of -30 dBi. If we assume the gain of an IFA antenna goes down by the square of its length*, that means an IFA antenna with a -30 dBi gain would be almost exactly 1mm in length (3.125cm / sqrt(900)). Guess what, the little bit of trace that we left between the cut that we made and the wifi board is definitely on the order of 1mm in length.

*Note: I honestly don’t know what the relationship is between an IFA’s gain vs its length but assuming it’s exponential is pretty conservative and should give us a pretty good approximation.

/hardcore mode

TLDR
According to my calculations, the small amount of trace left over after our cut is still long enough to radiate enough power to connect to the Xbox One controller at a distance of at least 1 foot.

I’m curious, have you messed with U3 at all?

Genius Work GrammatonKlerik.

That guy won’t tell us anything. I asked a simple question and he gave me the most awkward answer ever, dude was kind of a douche.

Yeah that was what my thoughts were too after all this. Removing C62 should basically cut the trace almost AT the source, however… that doesn’t necessarily mean that there isn’t some left that can couple the radiation correctly. I removed one of the inductors connecting one of the differential paths… which I’m assuming is the transmit, still nothing. super weird.

Unfortunately, because the coupling is still occuring near the castellated board or even on it, and the nature of our situation I can’t just pop in an attenuation circuit (there’s a little pi topology right after the micro coax, perfect for that), it won’t do any good. Instead, I tried to divebomb the RF by cutting the antenna (since it’s an F antenna and is just a short to ground DC wise) and putting a single stage LPF on the RF line to just sink the hi frequency energy to ground. I thought it would be a quick fix but just like the cutting it’s like the circuit is crazy sensitive and can deal with oddities really well at close range.

Most tests really should be run at about 6 feet away, but that does us no good since… well in tournaments we’re damn close to the xbox.

Good catch on the F antenna topology, I remember reading it was dual band but the little outspurt doing the 5Ghz makes sense.

The little black IC at the end of the matching? No, but after talking with a college buddy who’s an RF engineer he thinks it’s a mixer to handle the receive and transmit correctly when using the single antenna. I decided against removing that since it was way out of the range of the average modder, and it’s like a shotgun fix. If you remove it I would imagine it would have a good impact on killing the wireless.

So is removing C62 a good alternative to cutting the trace?

I was thinking it might be a power amp, but we could both be right as they have mixers with built-in power amps.

In either case I think the oscillator is the key to a solution. Without the oscillator signal, there is nothing for the upconverter (wherever it is) to upconvert the baseband to. No carrier frequency means no meaningful transmission to the Xbox receiver that has a pass band filter at 2.4GHz (maybe 5GHz too).

The oscillator, Y1, appears to be a 40MHz VCO based on the “T400” marking. I looked at some data sheets for a 4-pad VCO and Pin2 should be GND which it appears to be as I can see a thick trace connecting it to the ground plane. That makes Pin3 the output. One thing you could try is temporarily short pins 2 and 3 close to the Xbox and see if the connection drops and stays dropped. If so, we just solder bridge the two pads together and call it a day.

So like this?

https://dl.dropboxusercontent.com/u/1570228/grounded%202%20and%203.jpg