Tuesday, September 28, 2010

LazerTag Team Ops Packet - Part 2

Good progress with the LTTO hosting gun!

The hosting packets are composed of:

9 bit command packet
[ 1 bit zero ] [ 8 bit command code]
8 bit data packet * n
9 bit crc packet
[ 1 bit one ] [ 8 bit sum of previous bytes ]

All of which use the 3000 ms mark, 6000 ms sleep, 3000 ms mark header.

The command codes discovered so far are:
COMMAND_CODE_CUSTOM_GAME_MODE_HOST = 0x02,
COMMAND_CODE_PLAYER_JOIN_GAME_REQUEST = 0x10,
COMMAND_CODE_ACK_PLAYER_JOIN_RESPONSE = 0x01,
COMMAND_CODE_CONFIRM_PLAY_JOIN_GAME = 0x11,
COMMAND_CODE_COUNTDOWN_TO_GAME_START = 0x00,
COMMAND_CODE_SCORE_ANNOUNCEMENT = 0x31,
COMMAND_CODE_PLAYER_REPORT_SCORE = 0x40,

The packet groups look like:
COMMAND_CODE_CUSTOM_GAME_MODE_HOST

0x002, //command code
0x00, //Game ID
0x10, //game time minutes
0x10, //tags
0xFF, //reloads
0x15, //sheild
0x10, //mega
0x20, //unknown
0x01, //unknown
0x100, //checksum

Where the first and last packets are 9 bits. The known values are base 10 hex where 9=0x09 but 10=0x10 and 0xff is 'unlimited'.

The join game request is sent by the joining gun on recv of the above advertisement.

COMMAND_CODE_PLAYER_JOIN_GAME_REQUEST
0x010, //command code
0x00, //game id
0x00, //player id
0x00, //unknown
0x100 //checksum

The host then confirms the join by sending back the ids and team/player numbers

COMMAND_CODE_ACK_PLAYER_JOIN_RESPONSE
0x001, //command code
0x00, //game id
0x00, //player id
0x09, //some combination of team/player number
0x100 //checksum

The gun must then confirm this join to be part of the game by sending back both id's

COMMAND_CODE_CONFIRM_PLAY_JOIN_GAME
0x011, //command code
0x00, //game id
0x00, //player id
0x100 //checksum

If the host goes 60 seconds without getting another player it starts the game countdown at 30 seconds and starts sending countdown announcements once a second.

COMMAND_CODE_COUNTDOWN_TO_GAME_START
0x000, //command code
0x00, //game id
0x30, //seconds left in digit hex
0x02, //unknown
0x00, //unknown
0x00, //unknown
0x100, //checksum

Once the game starts the LTTO gun sends the 5 bit, all zero, 3k,6k,6k pulse once a second but it is not required. All guns will end the game after the timeout in the game announce. Then the host gun starts the score announce beacon.

COMMAND_CODE_SCORE_ANNOUNCEMENT
0x031, //command code
0x00, //game id
0x11, //unknown
0x0F, //unknown
0x100, //checksum

The player gun response is still a mystery but it looks like:

COMMAND_CODE_PLAYER_REPORT_SCORE
0x040, //command code
0x00, //game id
0x10, //unknown,
0x00, //unknown, hits?
0x01, //unknown
0x00, //unknown
0x00, //unknown
0x00, //unknown
0x00, //unknown
0x100, //checksum

More then one similar looking packet is exchanged. Determining the meanings will require multi-gun controlled tests. After the score is reported the host sends back command 0x41 which appears to report the hits per player. When all players have checked in the host spits out command 0x32 periodically, with still contents of unknown meaning.

No comments: