Steam Controller Custom Firmware Discovery (and failing to do it myself)

[owenthepuppy]

WARNING: This can brick your controller from flashing it (which happened to me)

So I'm not sure where the right place to post about this is, but since this is the biggest modding scene with the controller right now I'll post it here. If anyone knows elsewhere to post, I can also do it there. I was wondering about running custom software on the controller, and was looking through how steam installs firmware, when I found a hardwareupdater folder, which has the controller firmware in it, and a tool to flash/put the controller in bootloader mode. The controller's own firmware is unsigned, CRC-only, without a signature, making it possible to flash custom firmware. I attempted to have Claude make me a small test program to try to run Rust on it (I do know Rust and Python, just not low level stuff like embedded devices), and ended up with a non-functioning device. I think the only way to fix this is to communicate with the J3 debug pad inside the controller. It uses an nRF52833 chip, so I need the SWD pinout, or another idea I don't know. I have the stock firmware backed up and a Pico for SWD flashing. I just can't identify the J3 pinout or get clean contact. I contacted steam support about the SWD pinout, they are steam support, so I might have success, but they haven't responded yet.

I wrote some more about the findings here.

[owenthepuppy]

Successful recovery! Doing some tests Claude gave me with a multimeter, I got the pinout for the debug pad, and used an RPI Pico to reflash it. Here's the pinout:
With the 2 alignment holes on the left, and 1 on the right, here is the pinout:
1 2 3 4 5
6 7 8 9 10
Pad Function
1 GND
2 SWCLK
3 GND
4 SWDIO
5 3.3V
6 NC
7 NC
8 NC
9 GND
10 nRESET (probable)

I got it working by using USB power instead of using that. I used an RPI Pico flashed with debugprobe, wired like this:
GP2 -> Pad 2
GP3 -> Pad 4
GND -> Pad 1 (or others should work)
3v3 DISCONNECTED
USB powering Pico and the controller.

To install probe-rs (the flashing tool), run cargo install probe-rs-tools.
You can list debugprobes with probe-rs list.
Running probe-rs info --chip nRF52833_xxAA should show the controller plugged in.

Afterwords, I recovered with the following:
tail -c +33 STOCK_IBEX_FIRMWARE_PATH.fw > stock_payload.bin
probe-rs download --chip nRF52833_xxAA --binary-format bin --base-address 0xA000 stock_payload.bin
probe-rs reset --chip nRF52833_xxAA
This put me into a bootloader I couldn't leave, so either wait like 5 minutes (untested), or do the flashing instructions on my site.

Yes, soldering was needed, but this should make it simpler as it uses alignment holes to just stay on: This.

[owenthepuppy]

Right, I forgot. Some probe-rs actions require root, but the path to it isn't in root, so run .cargo/bin/probe-rs instead.

[owenthepuppy]

Finally, my controller runs Rust.

[owenthepuppy]

hello from my steam controller
(it now acts as an HID keyboard)

[owenthepuppy]

A+START+SELECT puts the controller in bootloader mode.

[owenthepuppy]

The buttons are odd... A, B, Start and Select are fine, but the rest use something different that I/Claude can't figure out.

[owenthepuppy]

Turns out the other buttons (except the Steam button), use a GreenPak expander thingy.

[owenthepuppy]

The controller (and dongle) run Zephyr.

[owenthepuppy]

bad news, a while ago I accidentally locked up the firmware, and had to do a full erase to fix it, this appears to have broken all analog things and I cannot use joysticks or triggers anymore.

[owenthepuppy]

turns out that I am very late to all of this stuff and this already exists:
https://github.com/CouchTurtle/sc2-research/
https://github.com/mwdmwd/sc26re

so i found nothing new.

[owenthepuppy]

i got bored