dekunukem/nintendo_switch_reverse_engineering

This repository is a collection of notes from a hobbyist who physically took apart Nintendo Switch Joy-Con controllers to figure out how they work internally. The findings are shared openly for the Switch homebrew and hardware community. The content covers low-level hardware details. There are annotated PCB diagrams showing the physical circuit board layout of both left and right Joy-Con, with test points identified. The Joy-Con runs at 1.8 volts internally, and the author notes Nintendo used an unusual button-scanning method: instead of the standard approach of pulling individual button lines high or low, the buttons are arranged in a matrix grid scanned by a built-in keypad scanner chip at 128KHz, which makes it much harder to fake button inputs programmatically. On the hardware side, the Joy-Con contains two chips on its internal data bus: a 4 megabit flash memory chip and a 6-axis motion sensor (accelerometer and gyroscope combined). The repository documents the addresses and data formats used to communicate with both, including captured recordings of the actual signals on those lines during startup and while the controller is in use. The motion sensor is polled around 740 times per second, though the controller only reports data to the console every 15 milliseconds. The physical connector between Joy-Con and the Switch console has 10 pins. The repository maps out the function of each pin, including power, serial data lines in each direction, a reset line, and a flow control line. The initial connection runs at 1,000,000 bits per second and then switches to 3,125,000 bits per second after a handshake. The handshake byte sequences for the console and controller are documented. The repository also covers Bluetooth communication, button and input report formats, and notes from other contributors who added findings of their own.