daydream/miraprism/ximflip AR/VR controller

Hi Everyone,

While waiting for my espruino boards I dug out my old miraprism AR headset in attempt to hack the controller. Controller has touchpad, buttons, gyro and accelerometer. I always wanted to do that and now figured maybe there is a chip inside supporting espruino. I opened it and there was nRF51822 inside with nice SW programming connector on the PCB. After looking through the forums 51 series doesnt support the espruino fully. Maybe you can have more comments on that how hard would it be to flash it.
I thought I will try to hack it anyway by sniffing the services and characteristics so I can write web bluetooth app to use it. I found some people were able to hack the google daydream which is similar controller.
https://hackernoon.com/how-i-hacked-google-daydream-controller-c4619ef318e4
https://github.com/mrdoob/daydream-controller.js
I based my web bluetooth app on the second link. Miraprism doesnt have much info but I found out that the guangdong company that was making the controller for them made their own which is identical and its called ximflip. I think they made similar headsets/controllers under different names or for different companies. There is a lot of documentation available including BOM.
https://fcc.report/FCC-ID/2ALLR-X3C01
Note that comparing to the daydream they dont have the magnetometer so they have to calibrate their controller position.
I spent two evenings and I think got quite far but dont want to get stuck in the rabbit hole especially that I would prefer to get the espruino working there. In original daydream they where sending all axes mag/acc/gyro in raw values. It was challenging to figure out the bits in the whole frame.
Its different with ximflip. They by default send 3 bytes 2's complement per axis rotation. I was wondering why the value goes from -1800000 to +1800000. Then I looked through their higher level SDK. Its only header files and main, the rest is compiled. You can see there that the accuracy of rotation is 4 digits.
https://github.com/Ximmerse/SDK_Flip/tree/d10cc0c0ef8d9a5e12f8e0bbd1115ea7199325b2
So I realised if I divide the rotation by 10k I will get +-180.0000 deg. One of the axis behaves different. Thats the point when I got stuck. Also I bet to get the raw acc and gyro you need to send command through F002 characteristic but couldn't figure out that either.
Anyway, that was fun. Here is the repo where you can try out the code if you get controller.
https://github.com/kristosb/WebXimflip
https://kristosb.github.io/WebXimflip/
Here I found a controller that should be a clone of it:
https://www.amazon.com/Beracah-Controller-Wireless-Bluetooth-Gamepad-Daydream/dp/B07DD5N6ZT/ref=sr_1_4?dchild=1&keywords=daydream+controller&qid=1589203626&sr=8-4

Cool feature of this controller is touchpad which works quite well.
Thanks!

1 Attachment