Show HN: DualShock calibration in the browser using WebHID | Hacker News Reader

Show HN: DualShock calibration in the browser using WebHID

blog.the.al

125 pointsal_al73 comments

This website uses undocumented HID commands of both DS4 and DualSense to re-center and recalibrate DualShock analog sticks.

Open articleView on HN

Really nicely done!

Can recalibration help when the controller is connected to a Playstation? Does it store the calibration somehow in the controller? Or is this only useful on a PC?

I'd love to somehow restore my PS5 DualSense that's fallen victim to stick drift. I looked once in Steam's debug info and instead of the stick reading 0 at center it was reading about 20,000. Given the max is 32,767 I've lost 2/3 of the useful range, so maybe there's no fixing it with software.

Yes, that's the point! I suggest to try calibration in temporary mode (center calibration has a checkbox in the wizard). See with https://hardwaretester.com/gamepad if the controller is calibrated correctly, in that case redo calibration in permanent mode. That flashes the calibration in the controller.

DS4Windows is a decent tool for the dual sense, I think they have an offset you can configure while using it on PC but it wont store to the controller itself..

i fixed a busted analog stick by opening it up and cleaning the sensor thanks to some youtube video.

I have revived my CH Mach III twice now with DeoxIT on the potentiometers. I've owned that stick for over 30 years at this point.

P.S. I wish someone made a modern joystick with a similar feel, but more than two buttons.

The CH Mach III looks tight! I was messing around with a DOS game Sword of the Samurai and was wondering what types of sticks were being used by enthusiasts at the time since that game supported a joystick.

What kind of things were you playing with that when you purchased it new? I'm in this industry in no small part to watching my brother play Descent with a joystick in the 90s. I think his was made by the same company - F-16 Flightstick. I remember it having suction cups on the bottom though

New would have been Chuck Yeager's Advanced Flight Trainer various EPYX sports games (e.g. Winter Games & California Games) A bit later would be Wing Commander and Traffic Department 2192. Even later (besides several Wing Commander sequels and spinoffs) Tyrian, One Must Fall 2097, and Duke Nukem 3D (keyboard & joystick instead of keyboard & mouse).

That works quite well, but I had to repeat it a few months later. I recommend cleaning also the other stick as the plastic in the DS4 casing can break from opening it too often.

The important part is how smooth the remaining values are.

Even a hundred discrete values should be enough for an axis.

This is amazing!! Thank you! I don't even have a PS controller and I'm grateful this exists.

I hope you'll do one for Xbox Elite controllers and button remapping next :) It sucks having to boot into a Windows VM to remap them.

"I noticed that many repair technicians were using my scripts to recalibrate controllers, which significantly reduced repair times and costs. However, many of them were also having a tough time setting up the environment to run the scripts: Python, libusb, Windows drivers, and all that complicated stuff: the user experience was completely off.

This led me to the idea of creating a multiplatform web UI that could simplify everything. I developed a prototype and shared the link on a Facebook group for repair technicians, where it was warmly (..really warmly!) received."

That's so wholesome. Other people would have seen their software being used and decided they should be turning a profit from it.

I am guessing the author is an alien tapped into the Strategic Galactic Good Cheer & Chill Reserve. That explains being able to provide a free utility/online service to the audience of 'gamers, when their controller is effed up'.

Helped out with the drift on my DualSense, now I don't have to trash it, thanks man!

It's detecting my Sony original DS4 controller as a clone.

Is it a DS V1 or V2? What is the build date of the firmware?

Calibration immediately errors out for my DualSense. Luckily mine doesn't actually need any calibration, I was just trying it out :)

What is the build date of your firmware? Sometimes updating the firmware to the latest version solves any issue

Does this mean that a malicious website could intentionally miscalibrate any HID devices connected, or does it ask for permissions?

The site has to request permission to access a device, then the user has to select the device from a permission dialog to grant access.

Good; that's way better than being able to reflash your PS4 controllers with a drive-by.

it does ask for permission, but a malicious website could ask it for a valid reason and then brick it, yup. On the other side, a controller should not be brickable via HID commands...

Are there any plans to support Switch Pro Controllers?

Can I detect analog stick drift with this?

> It is available only for Google Chrome, Chromium or compatiable browsers (e.g. Edge) because it uses WebHID, a javascript extension that can be used to send commands to a HID device.

I didn’t know about WebHID, but it’s interesting Firefox doesn’t support it. According to Mozilla’s position[0]:

> This API, like WebUSB, provides access to generic devices. Though this API is limited to human interface devices (HID), the same concerns apply as WebUSB, namely that devices are generally not designed with access from arbitrary websites in their threat model.

[0]: https://mozilla.github.io/standards-positions/#webhid

Or WebKit, per Apple...

>Here are some examples of features we have decided to not yet implement due to fingerprinting, security, and other concerns, and where we do not yet see a path to resolving those concerns:

    Web Bluetooth
    Web MIDI API
    Magnetometer API
    Web NFC API
    Device Memory API
    Network Information API
    Battery Status API
    Web Bluetooth Scanning
    Ambient Light Sensor
    HDCP Policy Check extension for EME
    Proximity Sensor
    WebHID
    Serial API
    Web USB
    Geolocation Sensor (background geolocation)
    User Idle Detection

What is the chrome team's threat model for this? Why are they ok with it?

They are OK with it because it's behind an explicit permission dialog and the user has to specifically choose a single device to grant access. I doubt there's been a single instance of a real world attack using this API. It's been enabled by default in Chrome for years, so it's not like there hasn't been an opportunity. This is just concern trolling by people who dislike the modern web for other reasons.

Well, it did break the security of YubiKeys

https://www.pcmag.com/news/google-chrome-feature-pokes-secur...

That's research, never used in a real world attack. It's long since patched, and also that's not the WebHID API.

Moving goal posts. I guess all of this xz stuff is overblown because we do not have a documented case where it was used? Just research about something that might happen does not count, I guess.

Here is a WebHID attack in Chrome with a 9.8 severity (https://www.cve.news/cve-2023-1529/)

I moved nothing. You didn't read my original comment that clearly specified "real world attack". Your second link doesn't qualify either. Besides, if you can connect a malicious USB device to the user's computer you've already won. There are a million ways to exploit that which have nothing to do with Chrome.

The xz thing was a big deal precisely because it was a real world attack. It wasn't something created by researchers as a proof of concept and disclosed to vendors. It was discovered in the wild, luckily before it caused any damage, but it was absolutely a real world attack.

Chrome enables Chrome OS. These security holes are allowed into the spec to ensure the Chrome machines are not totally hobbled.

Probably because it's listening to two general purpose input devices all the time at the very least? If you're that paranoid you probably shouldn't be using a non air-gapped machine in the first place.

JFC, is there any host functionality that Chrome will not try and implement in the browser. No wonder it is so bloated and leaks your fingerprint in a million different ways.

Apple says they will not implement WebHID and 15 other "features" in WebKit...

>Here are some examples of features we have decided to not yet implement due to fingerprinting, security, and other concerns, and where we do not yet see a path to resolving those concerns:

    Web Bluetooth
    Web MIDI API
    Magnetometer API
    Web NFC API
    Device Memory API
    Network Information API
    Battery Status API
    Web Bluetooth Scanning
    Ambient Light Sensor
    HDCP Policy Check extension for EME
    Proximity Sensor
    WebHID
    Serial API
    Web USB
    Geolocation Sensor (background geolocation)
    User Idle Detection

I completely understand the desire to not implement such things, but I also understand why they exist.

Unfortunately, perhaps due to a mixture of elitism, protectionism, and market dominance, writing cross-platform software in any capacity, let alone cross platform software that requires low-level hardware access, Bluetooth, video, geolocation, etc., is far harder than it deserves to be, and using the web as an abstraction layer makes these things a million times easier.

edit: It's also far easier to distribute this stuff. I just want my video game controller working in slightly better order - I don't want to have to install some bluetooth library and then choose between an x86 Mac, ARM Mac, x86 Windows, x64 Windows, AppImage, deb, flatpak, .tar.gz, snap, my package manager (if it's even there), try install it, shit, it doesn't run on my distro, patch it, use it once, then uninstall it.

cool

Chrome is doing amazing work with these WebAPIs. Here's a quick list of things enabled by Chrome being open-minded and allowing WebHID and WebUSB APIs to exist:

- Turn your Stadia controllers into bluetooth controllers: https://stadia.google.com/controller/index_en_GB.html

- Android Flash Tool: https://flash.android.com/welcome

- fastboot.js - FastBoot API but entirely though the web: https://kdrag0n.github.io/fastboot.js/demo/

- WebADB - Android debugging interface through the web: https://app.webadb.com/

and here's my favorite (because I used it in my RX-8)

- Node-Carplay - Carplay interface through a USB dongle in your browser with no external dependencies!!1! (https://github.com/rhysmorgan134/node-CarPlay)

Add to that list QMK VIA, which allows reprogramming a keyboard running the QMK firmware from the browser!

https://www.caniusevia.com/

Reprogram a $30 ham radio:

https://news.ycombinator.com/item?id=39850972

Are these really the job of your browser?

The browser is a great for distribution (apps are just URLs) and security (web pages need to ask permission before accessing anything on your computer outside of their domain).

More people should question the common belief that desktop OSes (without enforced app sandboxing) do a proper job at being a platform for utilities like OP's. When you download and run an .exe on a normal Windows pc, you're giving it read and write access to everything on your user account. It's bad that you're required to put so much trust in developers to run programs on typical desktop systems; this either ends up causing people to be extremely picky about what they run or to give out trust too freely and get bitten by malware often. Platforms like the browser which sandbox (web) apps and enforce a granular permission system are terrific.

With all the APIs available to the browser at what point do I have the same worry that an .exe brings?

Web pages can't do anything that affects the rest of your system without going through a permission dialog, and the permissions are always very granular. A page can't trigger a yes/no permission dialog to get access to all of your files; it can only trigger a file-picker that gives it access to whatever the user picks in it. An .exe doesn't need to go through any permission dialog to upload/wipe/infect any file in your home directory.

Hey - total tangent, but... I'm playing through Horizon Forbidden West. It's the first game on PC I've played that supports the DualSense (PS5 controller)'s haptic motors and adaptive triggers. They are something else when integrated properly with game events and sounds. It would be cool if this were integrated into more games!

Funny, I wish most games gave more options to turn them down. Some newer games are REALLY excessive with it. I encountered one game recently that felt it was necessary (no way to disable) to make the controller vibrate every single time you used the d-pad in the UI.

Helvetica with font-weight 300 makes the text really thin and hard to read at 100% zoom.

Looks great on mobile, fwiw

I think you misspelled "younger eyes"

So a malicious website can brick controllers. Good for author but I'm surprised its even possible.

You have to give it permissions to interface with the device, but also it sounds like a site wouldn't be able to so much "brick" it but rather miscalibrate it since it's not permanent. I assume it's just setting some offset values specific to the controller based on the stick's center point and whatnot. If a malicious site were to do that, you could just come back to this site and fix it.

Reading it more clearly the developer actually expresses concern about allowing the code to run on clones resulting in potentially bricking them due to not supporting the same operations. Perhaps its more accurately a possible deficiency in clone controllers that the developer supposes may be in danger.

Reply on news.ycombinator.com