# Nintendo Switch Reverse Engineering > Notes begun by dekuNukem in 2017 and extended by contributors on how the Joy-Con, Pro Controller and parts of the Switch console and dock work, worked out from teardowns, logic-analyzer captures and packet logs. Markdown files cover the Joy-Con board test points and rail-connector pinout, the wired serial handshake with its CRC-8 checksum, Bluetooth HID input and output reports with 32 documented subcommands, the USB HID commands of the Pro Controller and charging grip, the SPI flash memory map with stick and 6-axis calibration, IMU conversion formulas and rumble encoding tables. The repository also keeps STM32 test firmware that plays the console or a Joy-Con on the rail, a Wireshark dissector for the Bluetooth traffic, and the captures behind the notes. - Type: Learning resource - Targets: Firmware · Protocol - Category: Learning resources - Relationship: Learning resource - Sources reviewed: 2026-10-19 - Added to the catalog: 2026-10-27 - Original resource: - Primary source: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/resources/nintendo-switch-joycon-re-notes/index.md) ## Requirements & limits - Reviewed at commit b354f21 (2026-08-21). Of 277 commits, 228 date from 2017 and most others from 2018–2021; the 2026 changes document the console's sanity checks on stick calibration. The notes describe the original Joy-Con and Pro Controller, listing controller firmware 3.89 as the latest, and several fields remain marked unknown, so newer firmware and controllers need separate checking. - Following the notes needs one's own controller. The wired-protocol work involves opening a Joy-Con and connecting its rail connector, which uses 1.8 V logic, to a logic analyzer or microcontroller; the Bluetooth and USB notes assume a host that can exchange raw HID reports, and their sample C code uses hidapi-style calls. No controller or dock firmware is included: the README says a dock firmware dump was made but is not posted. - The joycon_reader and joycon_spoofer projects target an STM32F072 and were generated with STM32CubeMX for Keil MDK-ARM; their build outputs are committed alongside the sources. The nxbt dissector has to be compiled as a plugin within a Wireshark source build, a Lua script dissects Bluetooth traffic captured over USB, and small Python scripts parse captures and compute the serial checksum. The .logicdata captures need logic-analyzer software that reads that format. - The Bluetooth notes also document SPI flash write and sector-erase and firmware-update commands, with warnings about erasing whole sectors; the field meanings come from the contributors' own captures and tests. - GitHub detects no license and the repository has no license file, so the notes state no reuse terms; a datasheets folder holds copies of third-party chip datasheets, and the Lua dissector says it is provided with no license. The README credits the many contributors. ## Primary sources 1. 2. 3. 4. 5. 6. 7. 8. 9. ## More in References and learning - [Android App Reverse Engineering 101](https://awesomerea.org/resources/android-app-re-101/index.md) · Learning resource - [Reverse Engineering iOS Applications](https://awesomerea.org/resources/re-ios-apps-course/index.md) · Learning resource - [tiny-dec](https://awesomerea.org/resources/tiny-dec/index.md) · Learning resource - [Reverse Engineering Reading List](https://awesomerea.org/resources/onethawt-re-reading-list/index.md) · Learning resource - [Decomp Academy](https://awesomerea.org/resources/decomp-academy/index.md) · Learning resource - [OWASP Firmware Security Testing Methodology (FSTM)](https://awesomerea.org/resources/owasp-fstm/index.md) · Learning resource ## About this entry The description was reviewed against primary sources. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.