Skip to content

USB Protocols

Jump to bottom
Brian Hartvigsen edited this page Nov 10, 2023 · 4 revisions

Skylander USB Portal protocol

Background

The maximum buffer size is 32 bytes for most portals. Commands sent to the portal can be the minimum size necessary, though it is allowed to zero pad. All responses from the portal are sent with a 32-byte buffer, zero-padded when necessary. The 0th-byte acks the command sent (for most commands.)

If you are using hidapi, the buffer will be 33 bytes and the 0th byte is set to 0 (the channel) and the command starts at the 1st byte.

Maximum Figures

Portal Max Figures
Wii Wireless 4
Wii Wired 8

Commands

Ready
Command { 'R', 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 }
Response { 'R', 02, 0a, 03, 02, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 }

The 4-byte sequence after the R (0x52) contains a 2-byte device type and 2 unknown bytes that appear consistent for portal.

Portal bytes
Wii Wireless 01 29 00 00
Wii Wired 02 0a 03 02

Activation
Command { 'A', (00 | 01), 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 }
Response { 'A', (00 | 01), ff, 77, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 }

The 3rd byte of the command is whether to activate (0x01) or deactivate (0x00) the portal. The response echos back the activation byte as the 2nd byte of the response. The 3rd and 4th bytes of the response appear to vary from wired to wireless. On wired portals, the bytes appear to always be ff 77. On wireless portals, during activation the 3rd byte appears to count down from ff (possibly a battery power indication) and during deactivation ed and eb responses have been observed. The 4th byte appears to always be 00 for wireless portals.

Wii U Wireless: 41 01 f4 00 41 00 ed 00 41 01 f4 00 41 00 eb 00 41 01 f3 00 41 00 ed 00

Status
Command { 'S', 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 }
Response { 'S', 55, 00, 00, 55, 3e, (00|01), 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 }

Status is the default command. If you open the HID device and activate the portal, you will get status outputs.

The 4 bytes {55, 00, 00, 55} are the status of characters on the portal. The 4 bytes are treated as a 32-bit binary array. Each unique Skylander placed on a board is represented by 2 bits starting with the first Skylander in the least significant bit. This bit is present whenever the Skylandar is added or present on the portal. When the Skylander is added to the board, both bits are set in the next status message as a one-time signal. When a Skylander is removed from the board, only the most significant bit of the 2 bits is set.

Different portals can track a different number of RFID tags. The Wii Wireless portal tracks 4, the Wired portal can track 8. The maximum number of unique Skylanders tracked at any time is 16, after which new Skylanders appear to cycle unused bits.

Certain Skylanders, e.g. SwapForce Skylanders, are represented as 2 ID in the bit array. This may be due to the presence of 2 RFIDs, one for each half of the Skylander.

The 6th byte {3e} is a counter and increments by one. It will roll over when reaching {ff}.

The purpose of the (00\|01) byte at the 7th position appear to indicate if the portal has been activated: {01} when active and {00} when deactivated.

Color
Command { 'C', 12, 34, 56, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 }
Response { 'C', 12, 34, 56, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 }

The 3 bytes {12, 34, 56} are RGB values.

This command should set the color of the LED in the portal, however this appears deprecated in most of the recent portals. On portals that do not have LEDs, this command is silently ignored and do not require a response.

Query
Command { 'Q', 10, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 }
Response { 'Q', 10, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 }

In the command the 3rd byte indicates which Skylander to query data from. Index starts at 0x10 for the 1st Skylander (as reported in the Status command.) The 16th Skylander indexed would be 0x20.

A response with the 2nd byte of 0x01 indicates an error in the read. Otherwise, the response indicates the Skylander's index in the 2nd byte, the block read in the 3rd byte, data (16 bytes) is contained in bytes 4-20.

A Skylander has 64 blocks of data indexed from 0x00 to 0x3f. SwapForce characters have 2 character indexes, these may not be sequential.

Write
Command { 'W', 10, 00, 01, 02, 03, 04, 05, 06, 07, 08, 09, 0a, 0b, 0c, 0d, 0e, 0f, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 }
Response { 'W', 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00 }

In the command the 3rd byte indicates which Skylander to query data from. Index starts at 0x10 for the 1st Skylander (as reported in the Status command.) The 16th Skylander indexed would be 0x20.

4th byte is the block to write to.

Bytes 5 - 20 ({ 01, 02, 03, 04, 05, 06, 07, 08, 09, 0a, 0b, 0c, 0d, 0e, 0f }) are the data to write.

The response does not appear to return the id of the Skylander being written, the 2nd byte is 0x00; however, the 3rd byte echos the block that was written (0x00 in example above.)

Useful Resources

Skylander reading/dumping

USB HID

Xbox360 specific

Clone this wiki locally