BattleTag Usb Protocol

Based on USB sniffing and lua comments, plus guessing on some things. Using commands appears to work to pair guns with a test application written in C using the hidapi library.

UBIConnect radioProtocolId = 1
UBIConnect classId = 1
Blaster radioProtocolId = 0x02 (ID 1) to 0x0A (ID 8)
Blaster classId = 1

Protocol seems to loosely follow [byte count] [receiver radioProtocolId] [command] for the first three bytes of each message, but only the command appears to always be consistent. It looks like 0xFF is used for the receiver radioProtocolId in cases where all devices should receive the message.


Connect to UBI Connect
Software sends request and the UBIConnect responds with a Device Descriptor (00 00 2D 6A 01 00 00 10 in my case) it looks like the last four bytes (01 00 00 10) should always be the same, whereas the first four bytes should be unique. Cannot confirm with only one UBI Connect, but blasters seems to be similar.

Init UBI Connect (Host -> UBIConnect)
(0x01 0x00 0x01 0xFF)

Init UBI Connect Response (Host <- br="" ubiconnect="">(0x0A 0x00 0x12 0xFF 0x00 [8 Byte UBIConnect Device Descriptor])

Ack UBI Connect Response (Host -> UBIConnect)
(0x0A 0x00 0x12 [1 Byte radioProtocolId] [1 Byte classId] [8 Byte UBIConnect Device Descriptor])

Request Connections (Host -> UBIConnect)
(0x00 0x01 0x04 [1 Byte radioProtocolId] [1 Byte classId] [8 Byte UBIConnect Device Descriptor])

Request Response (Host <- br="" ubiconnect="">(0x04 0x01 0x04 [1 Byte radioProtocolId] [1 Byte classId] [8 Byte UBIConnect Device Descriptor])

Ping Loop?
Software sends this out several times, no response from the device is ever received, ignoring it does not seem to prevent blaster pairing.

Request Connections (Host -> UBIConnect)
(0x00 0xFF 0x06 [1 Byte radioProtocolId] [1 Byte classId] [8 Byte UBIConnect Device Descriptor])

Request Connections (Host -> UBIConnect)
(0x00 0xFF 0x86 [1 Byte radioProtocolId] [1 Byte classId] [8 Byte UBIConnect Device Descriptor])

Request Response (Host <- br="" ubiconnect="">(Unknown...)

Pair Blaster
When blaster is turned on UBIConnect asynchronously sends message 12 with blaster Device Descriptor. First four bytes are unique to blaster, second four bytes appear to be standard (02 00 00 20). 

Blaster Init (Host <- br="" ubiconnect="">(0x10 0x00 0x12 [8 Byte Blaster Device Descriptor] [8 Byte Blaster Device Descriptor])

Request polling halt (Host -> UBIConnect)
(0x01 0x00 0x13 [1 Byte radioProtocolId] [1 Byte classId] [8 Byte UBIConnect Device Descriptor])

Blaster Received Response(Host -> UBIConnect) Blaster radioProtocolId = Gun number to be used + 1
(0x0A 0xFF 0x12 [1 Byte Blaster radioProtocolId] [1 Byte radioProtocolId] [1 Byte classId] [8 Byte Blaster Device Descriptor])

Blaster Init (Again!) (Host <- br="" ubiconnect="">(0x10 0x00 0x12 [8 Byte Blaster Device Descriptor] [8 Byte Blaster Device Descriptor])

Ack Blaster Already Recieved (Host -> UBIConnect)
(0x0B 0xFF 0x12 [1 Byte Blaster radioProtocolId] [1 Byte radioProtocolId] [1 Byte classId] [8 Byte Blaster Device Descriptor])

Request Firmware Info (Host -> UBIConnect)
(0x00 [1 Byte Blaster radioProtocolId] 0x04 [1 Byte Blaster radioProtocolId] [1 Byte radioProtocolId] [1 Byte classId] [8 Byte Blaster Device Descriptor])

Blaster Init (Again!) (Host <- br="" ubiconnect="">(0x00 [1 Byte Blaster radioProtocolId] 0x04 [3 Byte Version???] [8 Byte Blaster Device Descriptor])

Profile Info Request (Host -> UBIConnect)
(0x05 [1 Byte Blaster radioProtocolId] 0x84 0x00 0x00 0x00 [8 Byte Blaster Device Descriptor])

Profile Info Request Response (Host <- br="" ubiconnect="">(0x35 0xFF 0x05 0x00 0x00 0x00 0x11 [1 Byte data size] [Profile Data])

Ping Message?
Software seems to send a ping message that should check for disconnection of blasters if no response if returned.
Ping (Host -> UBIConnect)
(0x00 0xFF 0x05)

Ping (Host -> UBIConnect)
0x00 [1 Byte Blaster radioProtocolId] 0x05

Game Bytecode Upload
Gameplay information (lua bytecode?) is uploaded to the blasters before the game starts.

Each command appears to receive a mirror response from all paired blasters with the first byte adjusted for the message size and the second byte set to the corresponding [1 Byte Blaster radioProtocolId].

Unlock Memory Register (Host -> UBIConnect)
(0x01 0xFF 0x86 0x00 0x00)

Prepare Memory Register (Host -> UBIConnect)
(0x04 0xFF 0x81 0x00 0x00 0x40 0x00)

Prepare for Upload Register (Host -> UBIConnect)
(0x06 0xFF 0x82 0x00 0x00 0x40 0x00 0x01 [bytecount])

Upload Bytecode (Host -> UBIConnect)
([byte count + 3] 0xFF 0x83 0x00 [Data])

Lock Memory Register (Host -> UBIConnect)
(0x01 0xFF 0x86 0x00 0x01)

Check Vest Connections
Before match can start players need to connect vests to blasters (If Required for game).

Check Vest connections (Host -> UBIConnect)
(0x00 0xFF 0xC1)

Check Vest connections Not Connected Response(Host <- br="" ubiconnect="">(0x00 [1 Byte Blaster radioProtocolId] 0xC1 0x00)

Check Vest connections Is Connected Response(Host <- br="" ubiconnect="">(0x00 [1 Byte Blaster radioProtocolId] 0xC1 0x01)

Start Game CountDown
In Progress

In Game Commands
In Progress