IR Commands
Taken and modified from Dmitry.gr's writeup
| CMD | DIR | NOTES |
|---|---|---|
| 00 | g2w | Compressed EEPROM write. Documented at length above. Writes 128 bytes on a 128-byte boundary. "extra" byte is top 8 bits of address. Bottom 8 bits will always be zero. Reply will be CMD_04 |
| 02 | w2w, g2w | Direct EEPROM write. Documented at length above. Writes 128 bytes on a 128-byte boundary. "extra" byte is top 8 bits of address. Bottom 8 bits will always be zero. Reply will be CMD_04 |
| 04 | w2w, w2g | ACK for an EEPROM write (CMD_00, CMD_02, CMD_0A, CMD_80, CMD_82) |
| 06 | ?2w | Direct internal memory write. "extra" byte is top 8 bits of address. First byte of payload is low byte of address. The rest of the payload will be written to internal memory at that address. Yes, this means RAM, MMIO, etc. Reply will be CMD_06 |
| 0A | ?2w | Direct EEPROM write, random length. "extra" byte is top 8 bits of address. First byte of payload is low byte of address. The rest of the payload will be written to EEPROM at that address. Reply will be CMD_04 |
| 0C | w2w, g2w | EEPROM read. Payload is a 16-bit start address, big-endian, followed by a one-byte length. Reply will be CMD_0E |
| 0E | w2w, w2g | EEPROM read reply. Payload is the data requested by CMD_0C |
| 10 | w2w | Sent by the master walker in a peer-play scenario at start. Enclosed is 0x68 bytes of data - the "IDENTITY DATA". The expected reply from the peer is CMD_12 |
| 12 | w2w | Sent by the slave walker in a peer-play scenario in reply to CMD_10. Enclosed is 0x68 bytes of data - the "IDENTITY DATA". This data is explained later. The "master" will proceed to exchange needed data, and then will send CMD_14 |
| 14 | w2w | Sent by the master walker in a peer-play scenario after all the needed data has been exchanged. Enclosed is 0x34 bytes of data - the "PEER PLAY DATA", "extra" byte byte will be 1. Slave walker replies with CMD_14 as well, same format, "extra" byte byte will be 2. Master will then send CMD_16 |
| 16 | w2w | Sent by the master walker in a peer-play scenario. No data. Reply is also a CMD_16. Does the entire peer-play UI and awards gift item. |
| 1C | w2w | Sent by the either walker during peer play when it's detected that it's "played" with this peer too recently. Shows the "Cannot connect to trainer again" error. No data. |
| 20 | g2w | Requests walker's "IDENTITY DATA". No data attached. Walker is expected to reply with CMD_22 |
| 22 | w2g | Data is "IDENTITY DATA", 0x68 bytes |
| 24 | ?? | Ping request. No operation other than reply with CMD_26. |
| 26 | ?? | Ping reply. Sent in reply to CMD_24 |
| 2A | g2w, w2g | Data is "UNIQUE ID DATA", used to set RTC. Erases the walker. Differs somehow from CMD_2C. Reply is CMD_2A, 0x28 bytes, "UNIQUE ID DATA" which is now all 0xFF. This command is actually used by the game to reset the walker |
| 2C | ?2w | Data is "UNIQUE ID DATA", used to set RTC. Erases the walker. Differs somehow from CMD_2A. Reply is CMD_2C, 0x28 bytes, "UNIQUE ID DATA" whic is now all 0xFF |
| 32 | ?2w | Data is "IDENTITY DATA" that master sends to the slave. From it only RTC is used, if a flag is set. Reply from the walker will be CMD_34 |
| 34 | w2? | Reply to CMD_32, no data |
| 36 | ?2w | No data, no reply. Shows "Cannot complete this connection" error |
| 38 | ?2w | Performs the "walk start" action (same as what CMA_5A does), but without the UI. Does not erase "special event" status, unlike CMD_5A which does. See CMD_5A for details. |
| 40 | g2w | Same as CMD_32. Data is "IDENTITY DATA" that master sends to the slave. From it only RTC is used, if a flag is set. Reply from the walker will be CMD_42 |
| 42 | w2g | Reply to CMD_40, no data |
| 44 | w2g | No data, no reply. Show "cannot complete this connection" |
| 4E | g2w | No data. Reply is CMD_50. Performs "walk end" action, erases pokemon state, shows "walk end" UI |
| 50 | w2g | Reply to CMD_4E, no data |
| 52 | ?2w | Same as CMD_32. Data is "IDENTITY DATA" that master sends to the slave. From it only RTC is used, if a flag is set. Reply from the walker will be CMD_54 |
| 54 | w2? | Reply to CMD_52, no data |
| 56 | ?2w | No data, no reply. Shows "Cannot complete this connection" error |
| 5A | g2w | No data. Reply is CMD_5A. Performs "walk start" action, including copying data to proper places, shows the UI |
| 60 | ?2w | Same as CMD_32. Data is "IDENTITY DATA" that master sends to the slave. From it only RTC is used, if a flag is set. Reply from the walker will be CMD_62. Also reload our walker info from eeprom. |
| 62 | w2? | Reply to CMD_60, no data |
| 64 | ?2w | No data, no reply. Shows "Cannot complete this connection" error |
| 66 | ?2w | No data. Set the message to show at connection end to be "Completed". Reply is CMD_68 |
| 68 | w2? | No data. Reply to CMD_66 |
| 80 | g2w | Compressed EEPROM write. Documented at length above. Writes 128 bytes on a 128-byte boundary. "extra" byte is top 8 bits of address. Bottom 8 bits will always be 0x80. Reply will be CMD_04 |
| 82 | w2w, g2w | Direct EEPROM write. Documented at length above. Writes 128 bytes on a 128-byte boundary. "extra" byte is top 8 bits of address. Bottom 8 bits will always be 0x80. Reply will be CMD_04 |
| 9C | ?2w, w2? | No data. Show "Could not receive..." error. Reply is CMD_9C |
| 9E | ?2w, w2? | No data. Show "Could not receive..." error. Reply is CMD_9E. Sent by walker in reply to CMD_A0, CMD_A2, CMD_A4, CMD_A6, CMD_A8, CMD_AA, CMD_AC, CMD_AE |
| A0 A2 A4 A6 A8 AA AC AE | ?2w, w2? | Use byte 0x5A of the most recently received "IDENTITY DATA" as event index. Check if we've participated. If so, reply with an empty CMD_9E, if not, reply with the same CMD as we received, 17 bytes. First 16 will be "EVENT BITMAP", last will be the event index we just checked for. |
| B8 BA BC BE | ?2w | No data. Award the user a stamp. In order they are: heart, spade, diamond, club. Replies are CMD_C8, CMD_CA, CMD_CC, CMD_CE respectively |
| C0 | ?2w, w2? | No data. Award the user a "special map" This seems to do nothing but show an icon in the UI, and show the "Special map received" message. Reply is also an empty CMD_C0 |
| C2 | ?2w, w2? | No data. Award the user an "event pokemon". Details later. Reply is also an empty CMD_C2 |
| C4 | ?2w, w2? | No data. Award the user an "event item". Details later. Reply is also an empty CMD_C4 |
| C6 | ?2w, w2? | No data. Move the user to an "event route". Details later. Reply is also an empty CMD_C6 |
| C8 CA CC CE | w2? | Replies to CMD_B8, CMD_BA, CMD_BC, CMD_BE respectively. No data. |
| D0 | ?2w | No data. Same as CMD_C0, except also grant the user all 4 stamps |
| D2 | ?2w | No data. Same as CMD_C2, except also grant the user all 4 stamps |
| D4 | ?2w | No data. Same as CMD_C4, except also grant the user all 4 stamps |
| D6 | ?2w | No data. Same as CMD_C6, except also grant the user all 4 stamps |
| D8 | ?2w | No data. Show "Cannot complete this connection" error. No reply. |
| F0 | ?2w, w2? | Not yet fully understood. Data is 0x71 bytes of "ENROLL DATA" Some sort of enroll action. The only path to code that writes te EEPROM's "UNIQUE ID DATA" and "LCD INIT DATA". Reply is also a CMD_F0, with 0x28 bytes of data - a copy of the "UNIQUE ID DATA" |
| F4 | ?2w | Immediate disconnect. No reply. |
| F8 | w2g, w2w | Part of connection initiation as explained above. No data. Sent by slave walker to master walker or game after getting CMD_FA |
| FA | g2w, w2w | Part of connection initiation as explained above. No data. Sent by game or master walker to slave walker after seeing an advertising byte 0xFC on IR |
| FE | ?2w, w2? | Not yet fully understood. Writes the 8 data bytes to EEPROM at offset 8. Never seen in the wild. Reply is an empty CMD_FE |