Wiimote Communication Protocol

Bluetooth HID protocol specification for Nintendo Wii Remote (Wiimote) communication

The Wii Remote (Wiimote) communicates with the Wii console (and Dolphin) via Bluetooth using the HID (Human Interface Device) protocol. This document details the Bluetooth communication protocol based on actual packet captures.

Device Information

Device Name: Nintendo RVL-CNT-01
Device Type: Bluetooth HID device
Bluetooth Profile: HID (0x1124)
Profile Version: 0x100

Bluetooth Connection Process

Discovery and Inquiry

The Wiimote must first be discovered through Bluetooth inquiry:

< HCI Command: Inquiry (0x01|0x0001) plen 5
    lap 0x9e8b33 len 8 num 0
> HCI Event: Command Status (0x0f) plen 4
    Inquiry (0x01|0x0001) status 0x00 ncmd 1
> HCI Event: Inquiry Complete (0x01) plen 1
    status 0x00

During inquiry, the Wiimote continues to send periodic button state updates even before connection is established.

Connection Establishment

Once discovered, establish connection using the Wiimote’s Bluetooth address:

< HCI Command: Create Connection (0x01|0x0005) plen 13
    bdaddr 00:1F:C5:36:2B:32 ptype 0xcc18 rswitch 0x01 clkoffset 0x0000
    Packet type: DM1 DM3 DM5 DH1 DH3 DH5
> HCI Event: Command Status (0x0f) plen 4
    Create Connection (0x01|0x0005) status 0x00 ncmd 1
> HCI Event: Connect Complete (0x03) plen 11
    status 0x00 handle 12 bdaddr 00:1F:C5:36:2B:32 type ACL encrypt 0x00

Feature Discovery

After connection, query device features:

< HCI Command: Read Remote Supported Features (0x01|0x001b) plen 2
    handle 12
> HCI Event: Read Remote Supported Features (0x0b) plen 11
    status 0x00 handle 12
    Features: 0xbc 0x02 0x04 0x38 0x08 0x00 0x00 0x00

Link Policy Configuration

< HCI Command: Write Link Policy Settings (0x02|0x000d) plen 4
    handle 12 policy 0x0f
    Link policy: RSWITCH HOLD SNIFF PARK
> HCI Event: Command Complete (0x0e) plen 6
    status 0x00 handle 12

Device Naming

< HCI Command: Remote Name Request (0x01|0x0019) plen 10
    bdaddr 00:1F:C5:36:2B:32 mode 2 clkoffset 0x0000
> HCI Event: Remote Name Req Complete (0x07) plen 255
    status 0x00 bdaddr 00:1F:C5:36:2B:32 name 'Nintendo RVL-CNT-01'

L2CAP Channels

The Wiimote uses L2CAP (Logical Link Control and Adaptation Protocol) for data communication.

Channel Establishment

SDP Channel (PSM 1) - Service Discovery:

< ACL data: handle 12 flags 0x02 dlen 12
    L2CAP(s): Connect req: psm 1 scid 0x0040
> ACL data: handle 12 flags 0x02 dlen 16
    L2CAP(s): Connect rsp: dcid 0x0043 scid 0x0040 result 0 status 0
      Connection successful

HID Control Channel (PSM 0x11):

L2CAP(s): Connect req: psm 17 scid 0x0040

HID Interrupt Channel (PSM 0x13):

L2CAP(s): Connect req: psm 19 scid 0x0041

Channel Configuration

After connection, configure channel parameters:

< ACL data: handle 12 flags 0x02 dlen 12
    L2CAP(s): Config req: dcid 0x0043 flags 0x00 clen 0
> ACL data: handle 12 flags 0x02 dlen 18
    L2CAP(s): Config rsp: scid 0x0040 flags 0x00 result 0 clen 4
      Success
      MTU 185

The Wiimote uses an MTU (Maximum Transmission Unit) of 185 bytes for L2CAP communication.

Service Discovery Protocol (SDP)

The Wiimote exposes two SDP service records:

Service Record 0x10000 (HID Service)

HID Service Details

Service Record Handle: 0x10000
Service Class ID List: HID (0x1124)
Protocol Descriptor List:
  - L2CAP (0x0100) on channel 0x11
  - HIDP (0x0011)
Browse Group List: Public Browse Group (0x1002)
Language Base Attribute ID List:
  - Language: en (0x656e)
  - Encoding: UTF-8 (0x6a)
  - Base: 0x100
Bluetooth Profile Descriptor List:
  - HID (0x1124) version 0x100
Service Name: "Nintendo RVL-CNT-01"
Service Description: "Nintendo RVL-CNT-01"
Provider Name: "Nintendo"

HID-Specific Attributes:

Attribute ID	Type	Value	Description
0x0200	uint	0x100	HID Parser Version
0x0201	uint	0x111	Device Subclass
0x0202	uint	0x4	Country Code
0x0203	uint	0x33	Virtual Cable
0x0204	bool	0x0	Reconnect Initiate
0x0205	bool	0x1	Normally Connectable
0x0206	data	(HID descriptor)	HID Descriptor List
0x0207	data	0x409, 0x100	Language ID Base List
0x0208	bool	0x0	SDP Disable
0x0209	bool	0x1	Battery Power
0x020a	bool	0x1	Remote Wake
0x020b	uint	0x100	Profile Version
0x020c	uint	0xc80	Supervision Timeout
0x020d	bool	0x0	Normally Connectable
0x020e	bool	0x0	Boot Device

Service Record 0x10001 (PnP Information)

PnP Service Details

Service Record Handle: 0x10001
Service Class ID List: PNP Information (0x1200)
Protocol Descriptor List:
  - L2CAP (0x0100) on channel 0x1
  - SDP (0x0001)
Browse Group List: Public Browse Group (0x1002)
Bluetooth Profile Descriptor List:
  - PNP Information (0x1200) version 0x100

Attributes:

Attribute ID	Type	Value
0x0200	uint	0x100
0x0201	uint	0x57e
0x0202	uint	0x306
0x0203	uint	0x600
0x0204	bool	0x1
0x0205	uint	0x2

HID Descriptor

The Wiimote’s HID descriptor (attribute 0x0206) defines its report structure:

05 01 09 05 a1 01 85 10 15 00 26 ff 00 75 08 95 01 06 00 ff 09 01 91 00
85 11 95 01 09 01 91 00 85 12 95 02 09 01 91 00 85 13 95 01 09 01 91 00
85 14 95 01 09 01 91 00 85 15 95 01 09 01 91 00 85 16 95 15 09 01 91 00
85 17 95 06 09 01 91 00 85 18 95 15 09 01 91 00 85 19 95 01 09 01 91 00
85 1a 95 01 09 01 91 00 85 20 95 06 09 01 81 00 85 21 95 15 09 01 81 00
85 22 95 04 09 01 81 00 85 30 95 02 09 01 81 00 85 31 95 05 09 01 81 00
85 32 95 0a 09 01 81 00 85 33 95 11 09 01 81 00 85 34 95 15 09 01 81 00
85 35 95 15 09 01 81 00 85 36 95 15 09 01 81 00 85 37 95 15 09 01 81 00
85 3d 95 15 09 01 81 00 85 3e 95 15 09 01 81 00 85 3f 95 15 09 01 81 00
c0

Report IDs

The descriptor defines multiple report types:

Output Reports (0x91):

Report ID	Size	Description
0x10	1 byte	Command
0x11	1 byte	Command
0x12	2 bytes	Command
0x13	1 byte	Command
0x14	1 byte	Command
0x15	1 byte	Command
0x16	21 bytes	Command
0x17	6 bytes	Command
0x18	21 bytes	Command
0x19	1 byte	Command
0x1a	1 byte	Command

Input Reports (0x81):

Report ID	Size	Description
0x20	6 bytes	Core buttons
0x21	21 bytes	Core buttons + accelerometer
0x22	4 bytes	Core buttons (IR basic)
0x30	2 bytes	Core buttons
0x31	5 bytes	Core buttons + accelerometer
0x32	10 bytes	Core buttons + 8 extension bytes
0x33	17 bytes	Core buttons + accelerometer + 12 IR bytes
0x34	21 bytes	Core buttons + 19 extension bytes
0x35	21 bytes	Core buttons + accelerometer + 16 extension bytes
0x36	21 bytes	Core buttons + 10 IR bytes + 9 extension bytes
0x37	21 bytes	Core buttons + accelerometer + 10 IR bytes + 6 extension bytes
0x3d	21 bytes	Extension only
0x3e	21 bytes	Interleaved core buttons + accelerometer
0x3f	21 bytes	Interleaved core buttons + accelerometer + IR

Data Communication

The Wiimote continuously sends button state updates through the HID interrupt channel:

> ACL data: handle 12 flags 0x02 dlen 8
    L2CAP(d): cid 0x0041 len 4 [psm 0]
      0000: a1 30 00 10                                       .0..

Button State Packet Format

Byte 0: 0xa1 (HID report header)
Byte 1: Report ID (e.g., 0x30 for core buttons)
Byte 2-3: Button state bitfield

Example button states:

• a1 30 00 10 - Button 1 pressed
• a1 30 00 00 - No buttons pressed
• a1 30 10 00 - Button 2 pressed

The Wiimote sends button state updates continuously, even when no buttons are pressed, to maintain connection and provide real-time input.

Connection Teardown

Disconnect L2CAP Channel

< ACL data: handle 12 flags 0x02 dlen 12
    L2CAP(s): Disconn req: dcid 0x0043 scid 0x0040
> ACL data: handle 12 flags 0x02 dlen 12
    L2CAP(s): Disconn rsp: dcid 0x0043 scid 0x0040

Disconnect ACL Link

< HCI Command: Disconnect (0x01|0x0006) plen 3
    handle 12 reason 0x13
    Reason: Remote User Terminated Connection
> HCI Event: Command Status (0x0f) plen 4
    Disconnect (0x01|0x0006) status 0x00 ncmd 1
> HCI Event: Disconn Complete (0x05) plen 4
    status 0x00 handle 12 reason 0x16
    Reason: Connection Terminated by Local Host

Packet Flow Control

Bluetooth uses flow control to manage packet transmission:

> HCI Event: Number of Completed Packets (0x13) plen 5
    handle 12 packets 2

This event indicates that 2 packets have been successfully transmitted and the host can send more data.

Implementation Notes for Dolphin

Connection Handling

1. Perform Bluetooth inquiry to discover Wiimote
2. Create ACL connection to Wiimote’s Bluetooth address
3. Query device features and set link policy
4. Establish L2CAP channels for SDP, HID control, and HID interrupt
5. Parse HID descriptor to understand report formats

Data Reception

1. Listen on HID interrupt channel (PSM 0x13)
2. Parse report ID to determine data format
3. Extract button states, accelerometer data, IR data, extension data
4. Update emulated Wiimote state

Timing Considerations

• Wiimote sends updates approximately every 5-10ms
• ACL packet fragmentation occurs for larger reports
• Flow control events must be respected to avoid packet loss

When implementing Wiimote emulation, ensure proper handling of ACL packet fragmentation (flags 0x02 for first packet, 0x01 for continuation) to correctly reassemble L2CAP frames.

Reference Materials

The Wiimote uses standard Bluetooth HID protocols defined in:

• Bluetooth Core Specification
• HID Profile Specification v1.0
• USB HID Usage Tables

For complete protocol details, refer to HID_SPEC_V10.rar in the source documentation.