Update: This post has been updated to correct some details regarding the radio channels and frequencies used during the advertisement and pairing processes. So I was messing around with my Ocu...
Intro In the world of reverse engineering and binary analysis, tools like Ghidra are indispensable. But what if you could supercharge your Ghidra workflow by seamlessly integrating it with powerfu...
Intro I recently got my hands on a controller from the Oculus Quest 3 and decided to explore what’s new. The Oculus Quest 3 controller brings several hardware updates from its predecessor, the Qu...
Intro The extracted firmware dump provided an opportunity to better understand the memory architecture and data management within the controller’s firmware. The illustration below showcases the la...
Intro As we found out in Oculus2: Inside the Controller, a controller is based on nRF52832 SoC. Nordic Semiconductor nRF52832 Multiprotocol BLUETOOTH® 5.2 SoCs are powerful and highly flexible, m...
Controller overview This time, I decided to dig into Oculus’s controller to see what interesting I could find there. I’m taking a closer look at the Oculus Quest 2 controller. I’ve always been cur...
The battery connector is the most annoying thing in my test setup - constantly having to plug and unplug a small connector for each modification is not only frustrating but also time-consuming, as ...
The stand and enclosures for buttons were designed by myself and 3D-printed using PLA plastic. This how the setup looks like (JTAGulator remained connected from previous post): top: bottom The ...
JTAG pins were found in my previous post “Oculus2: HW reverse engineering - test points.” I am sure for 99.99999% that, SoC JTAG pins are disabled. A modern SoC has an OTP configuration bit to disa...
Oculus 2 partition layout N Name type Start End Size 0 0x000000 6000 0x6000 1 ...