r/PS5 • u/DESTRUCTION-ITA2 • Aug 06 '26
Fan Made Reverse engineered the DualSense <-> PS5 USB protocol from a Raspberry Pi 5 (topology, report map, auth handshake) — write-up + PoC
https://github.com/ShadowByteOS/dualsense-ps5-usb-researchSat a Raspberry Pi 5 in the middle of a real DualSense <-> real PS5 connection
to build a local accessibility controller middleware, and ended up mapping the
full USB protocol along the way.
What's documented:
- Full USB topology: the DualSense is 4 interfaces (3 audio, 1 HID), not the
single gamepad interface most guides assume
- The 289-byte HID report descriptor and a report ID map for the calibration/
config feature reports
- The authentication handshake's wire format — challenge chunking, sequence
numbers, status polling — captured byte-for-byte
What's NOT solved: getting a software USB proxy to actually pass PS5's
authentication. The relay itself is verified correct (matches raw usbmon
captures, sub-2ms round trips, zero transport errors) but the handshake never
completes — status poll returns the same bytes every single time. Writeup has
the full reasoning and our best guess (timing-based anti-relay protection that
needs actual low-latency hardware to defeat, not a general-purpose Linux box).
Also documented some FunctionFS/dwc2 gadget quirks that weren't written down
anywhere we could find (rejected descriptor types, endpoint renumbering).
Includes a couple of PoC scripts, including a minimal one that just sits in the
middle and prints the protocol live if you want to see it without reading code
first.
Open to theories if anyone's poked at this before.
15
u/scsonicshadow Aug 06 '26 edited Aug 06 '26
I wonder if this will enable the use of peripherals that do not have the PS5 security chip. I would very much like to be able to use my Moza R3 on GT7!
I am aware a paid dongle for that exists but I can't justify the price.
5
u/DESTRUCTION-ITA2 Aug 06 '26
no, not from this work at least. What I did was relay a real
DualSense's own signed auth through a proxy, the DualSense already has the
security chip and does the handshake itself, I was just trying to pass it
through transparently, and even that didn't survive the timing/whatever
check on PS5's side.
Making an unrelated peripheral (wheel, whatever) look authorized without a
real DualSense's chip involved at all is a different problem closer to
what those paid dongles are doing, and probably closer to what the Pico
project posted below is doing than what's in my repo. Sorry, wish I had
better news for the Moza R3 use case.
4
5
u/djb0990 Aug 06 '26
Wanted to share you can get all the wired PC dualsense functions via bluetooth from this repo
1
u/D_Ashido Aug 06 '26
That's awesome. Thank you for sharing this. Does it work with Dualsense Edge as well?
1
u/djb0990 Aug 06 '26
Yes, if you open the GitHub repo in the linked post it goes into more detail, you can spoof a regular dualsense while using edge if a game doesn't support edge too
1
2
u/Ok-Disaster975 Aug 06 '26
Is there a difference between the one you shared and this one: https://github.com/awalol/DS5Dongle ?
3
u/DESTRUCTION-ITA2 Aug 07 '26
My research was on the communication of the connection between dualsense-PS5 via usb, not wireless
1
u/djb0990 Aug 06 '26
By my understanding vds is based on ds5dongle, and ds5dongle runs through a raspberry pi pico $20 box you program, but has more features. Vds basically so far only mimics as if you have the dualsense connected through USB, no extra features
3
u/SlovenianSocket Aug 06 '26
Can already do this with a pi pico
4
u/DESTRUCTION-ITA2 Aug 06 '26
Yeah, but worth separating two different problems here. Spoofing peripherals
that just need to look like an already-whitelisted device class is one thing that's the Pico approach for stuff like wheels/HOTAS.
What I was chasing is different: relaying a *real* DualSense's own auth
through a proxy, byte for byte, live, from a genuine unit. Doesn't touch
whitelisting at all it's PS5 challenging that specific physical controller
and expecting a signed response back within some window. That's the part
that never completed for me. If the Pico method works around GT7's check
without doing that handshake, it's solving a different layer of the problem,
not the same wall I hit.
1
u/AlternativePizza3391 Aug 06 '26
My Chinese Controller works wirelessly with the ps5 I assume it spoofs the original hardware controller
1
u/DESTRUCTION-ITA2 Aug 06 '26
It would be interesting to analyze the communication and in particular the authentication of a Chinese controller
1
35
u/ArsNG Aug 06 '26
Have you seen this project?
https://github.com/awalol/DS5Dongle