参考:
How I hacked Google Daydream controller
How I hacked Google Daydream controller (Part IV)
反编译代码:
private static UUID A = UUID.fromString("0000180f-0000-1000-8000-00805f9b34fb");
static final String a = bbr.class.getSimpleName();
public static final UUID d = UUID.fromString("00002902-0000-1000-8000-00805f9b34fb");
public static final UUID e = UUID.fromString("0000180a-0000-1000-8000-00805f9b34fb");
public static final UUID f = UUID.fromString("00002a29-0000-1000-8000-00805f9b34fb");
public static final UUID g = UUID.fromString("00002a24-0000-1000-8000-00805f9b34fb");
public static final UUID h = UUID.fromString("00002a25-0000-1000-8000-00805f9b34fb");
public static final UUID i = UUID.fromString("00002a26-0000-1000-8000-00805f9b34fb");
public static final UUID j = UUID.fromString("00002a28-0000-1000-8000-00805f9b34fb");
public static final UUID k = UUID.fromString("00002a27-0000-1000-8000-00805f9b34fb");
public static final UUID l = UUID.fromString("00002a19-0000-1000-8000-00805f9b34fb");
public static final UUID m = UUID.fromString("0000fef5-0000-1000-8000-00805f9b34fb");
public static final UUID n = UUID.fromString("0000fe55-0000-1000-8000-00805f9b34fb");
private final VrCoreApplication B;
private BluetoothDevice C;
static final String A = bcj.class.getSimpleName();
private static UUID C = UUID.fromString("00000001-1000-1000-8000-00805f9b34fb");
private static UUID D = UUID.fromString("00000002-1000-1000-8000-00805f9b34fb");
if (C.equals(paramBluetoothGattCharacteristic.getUuid()))
{
localObject4 = paramBluetoothGattCharacteristic.getValue();
paramBluetoothGattCharacteristic = this.P;
if (localObject4 != null) {}
try
{
Object localObject1 = this.O;
if (localObject4.length < 19)
{
localObject1 = bbq.a;
i = localObject4.length;
localObject4 = new java/lang/StringBuilder;
((StringBuilder)localObject4).<init>(46);
Log.e((String)localObject1, "Invalid number of bytes to decode: " + i);
i = 0;
if (i != 0) {
break label781;
}
}
}
finally {}
}
}
((bbq)localObject2).b = ((byte[])localObject4);
((bbq)localObject2).c = 0;
((bbq)localObject2).d = ((bbq)localObject2).a(9, false);
((bbq)localObject2).a(5, false);
int i5 = ((bbq)localObject2).a(13, true);
int i = ((bbq)localObject2).a(13, true);
int i7 = ((bbq)localObject2).a(13, true);
int i4 = ((bbq)localObject2).a(13, true);
int i1 = ((bbq)localObject2).a(13, true);
int n = ((bbq)localObject2).a(13, true);
int j = ((bbq)localObject2).a(13, true);
int m = ((bbq)localObject2).a(13, true);
int i2 = ((bbq)localObject2).a(13, true);
int k = ((bbq)localObject2).a(8, false);
int i3 = ((bbq)localObject2).a(8, false);
int i6 = ((bbq)localObject2).a(5, false);
((bbq)localObject2).s[0] = bbq.a(i5);
((bbq)localObject2).s[1] = bbq.a(i);
((bbq)localObject2).s[2] = bbq.a(i7);
float[] arrayOfFloat = ((bbq)localObject2).s;
Object localObject4 = ((bbq)localObject2).t;
float f2 = arrayOfFloat[0];
float f3 = arrayOfFloat[1];
float f1 = arrayOfFloat[2];
float f4 = f2 * f2 + f3 * f3 + f1 * f1;
数据帧定义:
Daydream Controller数据帧格式,按照bit位定义如下,
bit000~bit008:时间戳(0~511)
bit009~bit013:包号(0~31)
bit014~bit026:地磁 X bit027~bit039:地磁 Y bit040~bit052:地磁 Z
bit053~bit065:ACC X bit066~bit078:ACC Y bit079~bit091:ACC Z
bit092~bit104:Gyro X bit105~bit117:Gyro Y bit118~bit130:Gyro Z
bit131~bit138:Touch X bit139~bit146:Touch Y
bit147:Click
bit148:Home
bit149:App
bit150:Volume -
bit151:Volume +
原始数据:
解析结果:
Connection Interval:
硬件及软件信息:
MCU:Dialog DA14681
Touch: IQS525
Battery: Coslight CA491539P(218-mAh)
LMP Version: Bluetooth Core Specification 4.1
Service: 0000fe55-0000-1000-8000-00805f9b34fb
Characteristic:00000001-1000-1000-8000-00805f9b34fb
Characteristic property:Notification
相关资源: