Jonathan Thomson's web journal

Fake Wii Nunchuks with a 6331 Accelerometer April 29, 2012

Filed under: Electronics,QCN — jethomson @ 12:45 am

While evaluating the suitability of a Wii nunchuk as an earthquake sensor (article not yet published), I discovered a few things about non-official nunchuks that use an accelerometer with the markings 6331 over QS***, where the asterisks stand in for a three letter code. This website (translated PDF) says these accelerometers are MMA6331L chips, but I’m not certain if they are genuine Freescale parts. The 6331 nunchuks don’t behave the same as the original nunchuks, which use an STMicroelectronics’ accelerometer. The 6331 nunchuks differ from the original in two important ways.

First, the 6331 based nunchuks don’t encrypt their data whether they are initialized using the old or the new method. This is important because there is a lot of microcontroller code on the web for reading data from a nunchuk that uses the old initialization method and decrypts the nunchuk data. Using this code on a 6331 based nunchuk will result in mangled data caused by incorrectly applying the decryption routine on unencrypted data. The solution is to use the new initialization method. This method causes an STMicroelectronics based nunchuk to output unencrypted data. Since the 6331 based nunchuks output unencrypted data no matter the initialization method, it’s better to use the new method without a decryption routine so your code will support both types of nunchuks.

    void nunchuck_init_old ()

    void nunchuck_init_new ()

Second, the accelerometer data in 6331 based nunchuks have some bits that are permanently fixed (i.e. stuck at 0 or 1). Bit 0 of byte 2 is always zero, bit 0 of byte 3 is always one, and bit 0 of byte 4 is always zero. Bits 3, 4, and 5 of byte 5 are also stuck at zero.

    Table 1
              7   6   5   4     3   2   1   0
    byte 2  | x | x | x | x | | x | x | x | 0 |
    byte 3  | y | y | y | y | | y | y | y | 1 |
    byte 4  | z | z | z | z | | z | z | z | 0 |
    byte 5  | z | z | 0 | 0 | | 0 | x | b | b |

Each axis of accelerometer data is represented by 10 bits with the 2 least significant bits of each axis stuffed in byte 5. When bytes 2 through 4 are transformed into accelerometer axis data, Table 1 can be rearranged to get Table 2.

    Table 2
                                      9   8   7   6   5   4   3   2   1   0
    x always zero                   | x | x | x | x | x | x | x | 0 | 0 | x |
    y always one, y always zero     | y | y | y | y | y | y | y | 1 | 0 | 0 |
    z always zero                   | z | z | z | z | z | z | z | 0 | z | z |

I have no idea why the accelerometer data in 6331 based nunchuks have some bits stuck like this. My first guess was that it had something to do with the Wii Motion Plus’s passthrough mode. The Wii Motion Plus (WM+) has a passthrough mode that interleaves nunchuk data with motion plus data. The WM+ discards some of the nunchuk’s LSBs to make room for bookkeeping bits. So I thought that since newer Wiimote’s include WM+ maybe the 6331 nunchuks don’t bother with the bits that will be discarded anyway. However, the bits discarded by the WM+ don’t match up with the fixed bits of the 6331 based nunchuks.

Identifying a 6331 based nunchuk
Unfortunately these fake nunchuks aren’t as easy to avoid as one might think. A nunchuk I purchased off of Amazon, which was advertised as official and looks genuine, has the same 6331 accelerometer and board as an obviously fake nunchuk I bought on eBay. The one I bought from amazon has a rubberized joystick, triwing screws, and the Nintendo logo.

There are a few ways to tell if your nunchuk is 6331 based. The most thorough method is to open the nunchuk and look for an accelerometer on the side of the board opposite the joystick with the markings 6331 over QS***, where the asterisks stand in for a three letter code. Another method is to use a program that performs the old initialization method and decrypts the data. When the joystick is centered the x-axis for the joystick (not the accelerometer) should be around 128. If the x-axis reads around 174 then the decryption algorithm has mangled unencrypted data. The decryption algorithm is (x xor 0x17) + 0x17 or in decimal (x xor 23) + 23. Therefore, (128 xor 23) + 23 = 174.

The STMicroelectronics accelerometer inside an official nunchuk. The official nunchuk also has a shielded cable.

Inside an fake/knock-off nunchuk purchased on eBay.

The board of a nunchuk that looks official from the outside but is actually fake. Notice that the EEPROM spot isn’t populated. The pinout of the 6331 as seen on the fake nunchuk’s board appears to agree with the datasheet except for one strange exception. The nunchuk is a three axis device, but the datasheet says the MMA6331L only measures x and y axis data. Pin 4 of the datasheet says it has no internal connection but on the board pin 4 has a trace that is connected to a filter capacitor and the microcontroller just like pins 2 and 3, which are the x-axis and y-axis data pins! It should also be noted that the MMA6331L’s minimum range is +-4g, where the STMicroelectronic’s nunchuk measures acceleration over the range +-2g.

Final Thoughts
If you have any information to share, please leave a comment below. I’m particularly interested to hear why 6331 based nunchuks have some of the accelerometer data bits stuck or how to unstick them. I’d also really like to hear what sort of accelerometers are being used in the nunchuks that come packaged with the newest Wiis.


3 Responses to “Fake Wii Nunchuks with a 6331 Accelerometer”

  1. […] nunchuks that are unsuitable earthquake sensors because their accelerometer data has stuck bits. Even worse, it can be very difficult to impossible to tell if a nunchuk is official by external […]

  2. Ivan Says:

    hi. i have the same board but after a few mounts and many resoldering i lost the schematic. can you pls tell me the pin out. 1st two are GND and then i cant remember 😦

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s