Jason Harley 2o Wiki

It's only been 7 years? No love for Wii Speak :(

I finally got the light to turn on and some data to stream in using C#. I'll experiment some more and write up some documentation one day.

Open up a Wii Speak compatible title's DOL file in a hex editor and find a blob that starts with AE 2F DD EC, from there jump down 0x17CC7 (decimal 97479) bytes to what ends in FD 22 BA FA. You might want to put that blob into its own file because it needs to be sent to Wii Speak every time to initialize it. For legal reasons you shouldn't share the firmware blob. Wii Speak Channel can be obtained using NUSD.

There's more to it than just sending the firmware!

// Using LibUsbDotNet, use Zadig to use the libusb0 driver for Wii Speak.
BulkWriter = _USBDevice.OpenEndpointWriter(WriteEndpointID.Ep02, EndpointType.Bulk);
byte[] _firmware = File.ReadAllBytes("WiiSpeak-Firmware.bin");
void SendFirmware() {
	int bytesTransferred = -1;
	int segmentsize = 1024;
	byte[] segment = new byte[segmentsize];
	for (int i = 0; i < _firmware.Length; i += segmentsize)
	{
		int rem = segmentsize;
		if (i + 1024 > _firmware.Length)
			rem = _firmware.Length - i;
		Buffer.BlockCopy(_firmware, i, segment, 0, rem);
		BulkWriter.Write(segment, 0, rem, 5000, out bytesTransferred);
	}
}

With a PCAPNG USB capture of Wii Speak with Dolphin under Linux it's fairly easy to playback the approximate audio sent and received to/from Wii Speak. Just join all the isochronous data together and import into Audacity as raw audio. The following is from the Wii Speak Channel capture:

• iso_in = Signed 16-Bit PCM Big Endian Mono 8000 Hz
• iso_out = Signed 32-Bit PCM Big Endian Stereo 8000 Hz or 16-Bit PCM 16000 Hz (I can't tell the difference)

The 0x9A control messages from Dolphin Emulator old Wii Speak branch code. I've marked the ones that I haven't seen appear under Wii Speak Channel usage as unconfirmed.

• 0 - SAMPLER_STATE (on/off)
• 2 - SAMPLER_FREQ_A
• 3 - SAMPLER_FREQ_B
  • 0 - 8000 KHz (Wii Speak Channel default)
  • 1 - 11025 KHz
  • 3 - 16000 KHz
• 4 - SAMPLER_GAIN (arg1 & ~0x300) unconfirmed
  • 1 - 0 dB
  • 2 - 15 dB
  • 3 - 30 dB
  • 4 - 16 dB
• 12 - SAMPLER_MUTE (on/off)
• 20 - EC_STATE (ec_reset on/off) Echo Cancellation?
• 56? - SP_STATE unconfirmed
  • 4112 - SP_ENABLE
  • 8193 - SP_SIN
  • 8196 - SP_OUT
  • 8205 - SP_RIN

With EC_STATE you should always see: 1 sent/read then 0 sent/read straight after.

Wii Party-Mic Descriptor - VID: 0x057e - PID: 0x0308

• Dolphin Emulator - Specifically the dummy Wii Speak branch, looks like someone already figured out how Wii Speak works but no public demos of using the actual hardware.
• Matlo's serialusb - cheap USB proxy firmware and software. I was never able to hack isochronous support into the firmware but it confirmed some of the data obtained using Dolphin before they added USB passthrough.