Ubisoft BattleTag Coding Resources and Progress


Hello everyone.

I created a pretty extensive document so far on the breakdown of how the Ubisoft Battletag system works, it’s internal components and gathered a ton of resources for the hardware / software so far.  I am putting it up now for public consumption, and will have to sort through the resources I gathered and upload those as well.

The more people we have that are interested in this, the more people that can help.

The last bit that is the major roadblock is the Hex Code which is how the game code interacts with the physical hardware, how the lights on the gun work, how much health you have etc.

Ubisoft Battle Tag RFID.

(Adding this as a note.)


Found the actual specs on the FCC testing reports.

There were 2 documents one for the “laser” section, testing the infrared.

And the second was testing the RFID, which said it was 13.56MHz!


Ding, big clue. Not the 125 KHz low frequency cards, it was using the 13.56MHz High frequency cards.

Yeah it seems like it is reversed, you might think 125 KILO HERTZ is Low? Yes, we’re so used to thinking in Kilobytes and Megabytes that we don’t remember that MHz in Radio waves is the distance between peaks, so at 13.56MHz the distance between peaks is much much shorter than at 125Khz.


That is why FM radio is in MHz and AM is in KHz. AM (KHz) travels much farther like Bass travels greater distances, as opposed to Treble (MHz) which drops off quickly because of the tighter peaks.


13.56MHz rfid can transmit data at a much higher rate as well.


( 125 Khz / 13.56 Mhz)


1. Range : Less(few cms) / More (around 1 Meter)

2.Technology: Vicinity coupling / Near field coupling

3.Antenna : Quite large / Compact

4. Use : Limited  /Wide applications

5. Cost : Cheaper / Some what costlier than 125Khz


The 13.56MHz rfid cards/chipsets are actually used for NFC (that newfangled payment method, or if you remember or use one that “speedpass” for Mobile) (Though the “speedpass” is encrypted, which mostly can only be done on the 13.56MHz rfid chips, there are ways for 125KHz chips to be encrypted as with the basic encryption that the tags for animals have)

The danger with using 125KHz rfid with payment information is the distance, since the frequency is higher you need a larger antenna because the waves drop off faster than 13.56MHz and it’s slower dropoff. If you used a HF 125KHz chip with personal information on it, you could use a higher powered small antenna (palm of your hand setup) to scan tons of people’s information and decrypt it later on.

Now with that out of the way on to the good part.

Progress: Leaps and bounds!!


Rfid scanner came in the mail today 4/18/2012.

Got home scanned the bases #1,#2,ammo(2count), ammo (4count), and the T-blaster.


Altered and tested the code.

Created Base #3, #4, medkit #1, medkit #2.

Tested with T-blasters. (55)


Holy Crap it Works!


It was simple enough to deduce what the code would be for base #3 and #4 from the following.


Base #1 (red)= 50 00 00 03


Base #2 (blue) = 51 00 00 03


Ammo (2 count) = 40 00 00 03


Ammo (4 count) = 41 00 00 03

My choices would be, maybe the med kits are 60 and 61? 70 / 71?

But after trying 52 and 53 for  base #3 and base #4 that pointed to the medkits being in-line with the ammo packs.

Medkit #1 is 52 and Medkit #2 is 53!


Here are the actual card scans, I read from Base #1 and Base #2, and since I have 4 bases of each type I though…

Well I might as well see if I can actually rewrite one of these.

Needless to say I was able to re-write the bases.

(taking care that I labled them and wrote down their original code along with saving formatted backups of each first)



Un-written #1Serial: 8025A2C15EBE04


00 01 02 03  first section is part of the serial, underlined.

04 BE 5E 6C

C1 A2 25 80

C6 48 00 00

00 00 00 00

FF FF FF FF  data starts after this

00 00 00 00  like a header.

50 00 00 03 sparkly bits that show what the id is (50 in this case means Base #1)

00 00 00 00 garbage bits, the rest of the “card” is empty past this point.

00 00 00 00

00 00 00 00




Un-written Base#2(blue) used to write the #1 below.



00 01 02 03

04 DA 13 45

B9 A2 25 84

BA 38 00 00

00 00 00 00


00 00 00 00

51 00 00 03

00 00 00 00

00 00 00 00

00 00 00 00



Re-written #1Serial: 8025A2C1254D04

00 01 02 03

04 4D 25 E4

C1 A2 25 80

C6 48 00 00

00 00 00 00


00 00 00 00

51 00 00 03

00 00 00 00

00 00 00 00

00 00 00 00 


(It scanned as if it were Base #2 (blue) !!!!)


So I grabbed extra ammo 2 counts and re wrote those from:

ammo 4 count

40 00 00 03


ammo 2 count

41 00 00 03



42 00 00 03


43 00 00 03


Loaded up the game with 4 controllers, team deathmatch all bases and medkit/ammo packs.

One gun on each team, started shooting and scanning medkits and respawn bases at Base #3(yellow) and Base #4(green)!


Test works perfectly.


Then I just re-wrote the bases and ammo packs back to original code. Test with the scanner again, works fine :)




So with this information, I need to get Mifare UL (13.56MHz) cards (that is the type of card that the bases actually are)

I tried to re-write the 4 cards I got (Mifare 1k, and Mifare 4k) with the code from the bases but it didn’t work.

Well my next “shipment” comes in Friday with a different chipset of Rfid scanner, arduino, and several types of rfid cards.

So the testing and more fun to be had!



Next up Game Decoding/Coding in LUA.


Btw if you haven’t checked out LUA seriously it is free and small (my download was about 25 mb!)


I’m using the SciTE program as a viewer/ coder.



Lua is available for free






I’ll post more about some of the code.


A little more on the hardware I’ve found.


The Ubiconnect base station.

At first glance it isn’t terribly impressive.

It has a USB cable going to it and an obvious target (you have to shoot it during the tutorial)

a few led’s that light up, and no speaker.


I opened it up and checked out the cheaaaap antenna they made (but it works with the sub 1ghz formula (you don’t need more than 7 inches when its 900MHz fat!)


I looked up the small chip that was onboard, well it was the Largest chip but it is only about 5mm x 5mm.

It is a really impressive piece of hardware I have to say!

Texas Instruments C1111-F32



Handles 500Kbps bi-directional wifi.

USB 2.0 plus all the below information.



Frequency (Min) 300MHz, 391MHz, 782MHz

Frequency (Max) 348MHz, 464MHz,928MHz

Device Type System-on-Chip

Flash size (KB) 32

RAM size (KB) 4

Data Rate (Max) (kbps) 500

Operating Voltage (Min) (V) 3

Operating Voltage (Max) (V) 3.6

RX Current (Lowest) (mA) 16.2

Standby Current (uA) 0.3

Wakeup Time (PD–>RX/TX) (uS) 330

Modulation Techniques 2-FSK, GFSK, MSK, OOK, ASK

Sensitivity (Best) (dBm) -112

TX Power (Max) (dBm) 10

Programmable Output Power Ranging From (dBm) -30 to 10

Antenna Connection Differential


After seeing the above specs, I was really impressed, not to mention it made perfect sense why it can just be powered over USB with min and max voltage hanging around the 3-3.6 volt range. (USB pushes about 5volts max roughly, yeah I know there are some “high powered” usb ports that can push 12volts, but you’ve seen how slow your phone charges on the computer rather than plugged into the wall….5volts nuff said)


So I was looking into that chip more thoroughly because I want to use a higher gain antenna on it.

I needed to know what the current dB was, what the current sensitivity in dBm was, max TX power dBm and voltages.

I don’t want to fry the chip by pushing a +90dB antenna with it.

Though that does sound awesome


(Ok so, I know I’m not going to be amplifying it through the onboard equipment, I’m essentially going to be powering the antenna off another usb port..if I get a powered antenna.)

With that said, I do have a couple smaller dB antennas lying around that I need to do some simple modification to….aka cutting the fitting off of the end and soldering 2 wires to the existing antenna.


And then range testing and power testing with applications.


Not like I don’t have 4 bases…soon to have 6 total bases available.


(and interesting enough in 2008 Wireless USB started coming out, which might be harder to find but might also be an option)




Projects from here.



1.Analyze the LUA code further. (I’ve already altered my code to skip the tutorial, and remove the intro video)

2.Figure out the hardware Hex code and how it compares to the LUA code (LUA Byte code and Lua code)

3.Try to develop a game mode not already in the game.

4. Create new LUA code for the game pages (the software is like a web browser, each page calls a different LUA code like how html can call CSS and javascript documents) (BTW this is sooo cool, and extremely easy compared to decompiling and rescripting hmm C++ written programs, .Net written programs C# etc etc)

5. make more bases with rfid cards.

6. record new voices for the game




(Since there has been 1 update to the game software, I can see the differences in what was updated)


I was just browsing through the included audio files, and funny enough the “normal” voice actor did players 1-8, but there’s a different voice actor that recorded players 9-16!

I also found the code where I can change the max players to whatever I want.

When I get my extra guns in the mail (6 more) I can experiment with adding more players :)


Game Mode Ideas

Now, I would Love to have a rainbow six style game mode(s) available.

(as I was writing this I started thinking of more)

1. Save the hostage!

2. Take down/assassinate the high profile target.

3. Team Fortress style classes, (right now probably just a medic class(healing shots), and assault(ammo shots). In the future engineer(can nullify or activate bases?)(capture enemy spawn points?) possibly with a turret? that would need to scan several bases to get “build” points to be able to activate the turret? Grenadier, when we figure out how to make a “grenade” function work. Sniper, when we build a gun / rifle extender that can focus the beam more than 75-77mm(currently))

Greg mentioned having a Nuke end the match :) That technically is doable, we can have a game mode that you have to “disarm” a nuke and if you can’t get to the enemies base within a time limit the nuke goes off and everyone’s health goes to zero, or the attacking team gets wiped out and has to go back to respawn.

(the nuke sound can easily be added to the game, when he’s counting down 5,4,3,2, BOOOOOOM)


Do-able now or soon.


1.Making more bases with rfid cards.

2.Work on amplifying the antenna with existing external antenna(s) {yes gramatically correct for RF antennas}

3.read up on lua coding and hardware coding.

4.examining existing game code an byte code (the Texas Instruments documentation gives all of the starter code needed for interfacing with the hardware, I can “remove” that part of the code since it is needed every time you want to have the base station talk with the guns)

5. Put together price points for selling rfid coded bases / keychains/ etc.

6. Find throat mics that are not expensive but have good quality. (also headsets/ earpieces that have volume control, the walki-talkies are kindof loud)

7. Add volume control physically to the guns (in game they can be turned down or muted!)


(find more people to add to this note!)


(include pictures / screenshots of code)



PCB of Ubiconnect showing the TI C1111-F32 chip


*Update 4-25-2012 (early ass o’clock in the morning)*

The gun uses the exact same chip by Texas Instruments. (makes sense since they bought them in bulk for this project = lower hardware costs)


So the “protocols” used in basic send the light schemes, readouts of the guns / team selection / player number etc.

The code from TI will help take out at least the standard “hey I’m starting communication wanna talk back to me?” preamble which is around 10 lines of code (give or take a few lines)


Then from there I’ll need to figure out what each set of code does, hopefully all of the codes are listed within the TI product manual.


I’m thinking that the majority of codes are just:

1. what bases are used and what they do.

2. starting health, lives, ammo / clips, player number, number or team designation.

3. time to count down for the start of the match, and time to count down for the end of the match.


Actually that should be All of the code.


I don’t want to speak too early, but that actually should be relatively simple to figure out.

Since there are about 8 or so different game modes, and they did 1 update so I can see the differences from before and after the update and what they changed.


Luckily it is not a complex coding language that needs to be translated like from binary to hex to ascii before I can read it.

It is written in essentially plain english, and then it has a set of bytecode that goes along with it.


Example from “Free For All” bytecode. (the first 41 lines look like this)



0×53, 0×43, 0×30, 0×35, 0×00, 0×00,

0×53, 0×43, 0×30, 0×33, 0×00, 0×00

,0×41, 0×53, 0×48, 0×54, 0×00, 0×00,

0×53, 0×57, 0×35, 0×36, 0×00, 0×00,

0×53, 0×44, 0×31, 0×33, 0×00, 0×00,

0×53, 0×57, 0×32, 0×32, 0×00, 0×00,

0×53, 0×43, 0×30, 0×38, 0×00, 0×00,

0×53, 0×43, 0×30, 0×32, 0×00, 0×00,

0×53, 0×44, 0×31, 0×34, 0×00, 0×00,

0×53, 0×57, 0×31, 0×32, 0×00, 0×00,

0×53, 0×57, 0×34, 0×32, 0×00, 0×00,

0×41, 0×52, 0×41, 0x4d, 0×00, 0×00,

0×53, 0×43, 0×31, 0×30, 0×00, 0×00,

0×53, 0×43, 0×30, 0×39, 0×00, 0×00,

0×41, 0x4d, 0×45, 0×44, 0×00, 0×00,

0×53, 0×44, 0×30, 0×33, 0×00, 0×00,

0×53, 0×44, 0×30, 0×32, 0×00, 0×00,

0×53, 0×43, 0×30, 0×37, 0×00, 0×00,

0xcc, 0×01,

0xcc, 0×01,

0xcc, 0×01,

0xcc, 0×01,

0xcc, 0×00,

0xcc, 0×03,

0xcc, 0×03,

0xcc, 0×03,

0xcc, 0×03,

0xcc, 0×03,

0xcc, 0×03,

0xcc, 0×03,

0xcc, 0×00,

0xcc, 0×00,

0xcc, 0×00,

0xcc, 0×00,

0xcc, 0×00,

0xcc, 0×00,

0xcc, 0×00,

0xcc, 0×00,


And these have been acquired, surprisingly enough they are in the correct color scheme as well.

Wrist Watch Walki-Talkie 1

Wrist Watch Walki-Talkie 2


*update #2 -4/25/2012*

Pictures of the innards of the t-blaster (gun)



Here you can see all the components (minus the vest connector at the bottom of the handle.


The layout is pretty basic, below the main board you can make out the antenna for the rfid scanner built into the gun. (it is the vertical card in this picture)


This is the top of the rfid scanner card (the vertical card in the above picture)


Showing the wiring and chip layout of the PCB


Here you can make out the actual text on the chips.


PCB with the rf “gun” part removed. So you can better see the chips. In the middle the CC1111F32, to the right (the two chips are store and forward memory chips.) The data is literally stored and forwarded from and to there. It is like temporary memory.


Connector for the Vest.


Back of the push button (trigger)


back of the (accessory) 6 “pin” contact point


The Front of the Display.


Back of the display showing wiring and on-board paths.


Back of the display showing the part number.


The front of the display “shield”, you can see the shapes of the base in the upper left, the lightning bolt shape, health, ammo, scan?


Here you can better make out the different shapes.

First Impressions: Max Payne 3

Holy crap!

Honestly that is the first thing that comes to mind.

(I’ll have to re-write this when I get some time, but I really wanted to share with you all how amazing this is so far!)

I have been looking forward to Max Payne 3 for a while now. Even more so since last year I was fortunate enough to see the press preview at New York Comic Con (NYCC).

I ended up getting the Xbox360 version, since that was the version that I originally saw the demo done on. I normally go with PS3 version if the graphics will just look better or PC versions of games that I know will have a large support community or mods or that will have better graphics +2.

But the Xbox 360 version looks amazing for Max Payne 3, no worries there for graphics.

So the story is great, I love how they really show how broken Max really is. He is truly haunted by the events in the first game, even more so many years later.

He has taken to drinking heavily and popping pain killers. Which leads to the intersting camera work, and sometimes “blips*” in the camera when you are going through a cut scene. *note: the blips are not a glitch, they are intentional, and not really a blip persay. More like a “tear” I guess, it is hard to describe. *

So Max is broken, and gets talked into taking a body guard job in São Paulo Brazil for a wealthy family. Needless to say São Paulo is dangerous for the wealthy, and shit goes bad …fast.

The story has a normal amount of twists and turns in it so far through disc 1 (Xbox 360 has 2 discs, which I rather like since that gives a lot of content and doesn’t skimp on graphics or sound).

There are several difficulty levels: Easy, Medium, Hard, Hardcore, Oldschool.

Now there are a couple other options besides difficulty that you can choose from.

A lot of games now have the ability to turn on and off aim assist, which is nice to have if you are a casual gamer, just want to pick up a game and shoot some people,  or a hardcore gamer that doesn’t want any assistance at all.

But Max Payne 3 changes it up a little besides having just aim assist on and off. You also get the ability to have a hard lock, soft lock, or no target lock. The Hard lock sticks your targeting reticule on the enemy, the soft lock is like a sticky but doesn’t lock your sights on the enemy so you can skip over someone you want to save for later, and the no target lock speaks for itself.

I am a fan of the soft lock, because when you are in bullet-time you can really pump rounds into someone and then hit left trigger and switch to someone else and get more rounds etc until you are done with bullet-time. Super efficient and pretty darn bad-assed!

Speaking of Bullet-time, Dear God! You have the option now in all versions to slow down the last kill “kill-cam” or “bullet cam” so you can hold A in the Xbox 360 version and then just keep firing. Which again Good Lord! It is brutal!

Last night I got through disc 1 completely, and loved every minute of it. If you screw up a section you don’t have to go way back like other games make you, a lot of the sections are split up very nicely with the amount of enemies they throw at you. It doesn’t feel that bad to mess something up when you don’t have to spend more than 10 minutes killing a group of people.

The dialogue is well scripted, and the voice acting is, like always, incredible. My wife even laughed about a particular jab at a particular Jersey boy “you spray tan douchebag.”

I am not surprised that this game is getting so many rave reviews. “9.0 of 10″ “88 of 100″

I was just going to put the scores in, but the short reviews really do speak to the quality of this game.

Taken from computerandvideogames.com

OPM UK : 8/10 - A dark, cinematic single-player campaign lasting around ten hours coupled with a compelling multiplayer offering make this a worthy addition to the genre, even if it can’t quite compete in the very top tier. But for legacy’s sake, we hope that this time Max’s retirement is permanent.

  • GamesRadar10 - Between its pacing, its presentation, and its excellent gunplay, Max Payne 3 has raised the bar for other action games to follow. Welcome back.
  • G45/5 - Max Payne 3 is a technological tour de force that will have you screaming “Dear lord!” more times than midnight mass. The performances are top notch, the action plays out with unrivaled fluidity, and the multiplayer is deep and rewarding. Silly distractions aside, Max Payne 3 is an action lover’s wet dream that also happens to employ some of the slickest direction and transitional trickery this side of a David Fincher box set. Lock and load. It’s bullet time…time.
  • X360A93 - A true cinematic gaming masterpiece, Max Payne 3 is not just another triumph for Rockstar, but it’s also testament to what the developer can do when it turns its hand to linear storytelling. Max Payne 3 might be a stylistic shift for the series, but it’s also a raw and brutal portrait of a man pushed to the edge that deserves a place alongside Rockstar’s superlative open-world efforts. Get ready to enter a world of Payne.
  • IncGamers9/10 - An expert blend of cinematic storytelling and flamboyant action, weaved together by a team with a clear passion for the genre and the content. Payne never felt so good
  • StrategyInformer9.0 - As with Rockstar’s other franchises, Max Payne 3 is enveloped in love and a huge amount of dedication. This is a consistently thrilling and explosive tale that states its case as one of 2012′s best. I’d be hard pushed to find a game that has made me scream with excitement on such a regular basis, as the compelling narrative and rewarding gunplay conglomerate into a truly spectacular product. Max Payne 3 lets you star in your favourite action movies, minus the Wahlberg.
  • IGN9/10 - There are plenty of games which are celebrated for their gameplay but lack anything in way of story or character. Max Payne 3 is a different type of proposition. The gameplay is simple yet satisfying, but it’s entirely in the service of a strongly-authored narrative. Players aren’t at the liberty to roam, to explore, or to shake things up. Some might find this too controlling, but in return for your freedom, you’re rewarded with a mature genre piece which is also a finely-realised character study. Action games continue to inch the dial towards 11, sometimes at the expense of their narrative integrity. Max Payne 3, however, has the conviction to reign in the action, imbue it with purpose – the spectacle still sparkles but it also makes sense.
  • 1UPA- - Although the gunplay may still have its roots planted firmly in the past, the way Max Payne 3 showcases its world is undeniably forward thinking. It’s a bit strange to gain so much pleasure from Max’s suffering, but I guess that’s the true essence behind Rockstar’s magic.
  • GameReactor9/10 - Max Payne 3 is an accomplishment any way you look at it. The story may perhaps get a bit murky towards the end, but other than that it fires on all cylinders from beginning to end. The action will make your nose bleed, it’s well directed, and refreshingly free of the conventions that often plague this genre. This is, simply put, the best shooter I’ve played in a long time. Don’t let Payne’s beer belly fool you, he’s in the best shape of his career.
  • VideoGamer8/10 - In Max Payne 3 the risk of death and restart is often too great. Why do something that makes you look and feel like an action hero, when holding back behind cover means you’re more likely to survive? The shame, then, is that the difficulty encourages over-cautious play.
  • GamesTM8/10 - Ultimately, none of the story beats or polish mask the fact that Max Payne 3 is very much a refinement of an old formula, and if you’re looking for something brand new or revelatory it just isn’t here. However, what is amazing is how Rockstar has fallen back on its trademark production values and sublime attention to detail to update the franchise in a compelling way. Factor in some impressive multiplayer offerings and it’s still head-and-shoulders above most of its trigger-happy ilk. Which perhaps says as much about the state of the genre as it does Rockstar’s obvious skill.
  • The Guardian5/5 - Max Payne 3, then, is another stylish, self-conscious and enthrallingly full-bloodied title from the Rockstar hivemind. If it is at all possible to distil every great Hollywood action flick into one interactive experience – with all the wise-cracking thuggery and anti-hero angst that would entail – this is it.
  • GameInformer9.25 - No matter what gameplay mode I chose, I had a great time playing Max Payne 3. The gameplay doesn’t explore new territory, but delivers a retro charm that fans of the series should appreciate. It’s a new day for Max Payne, and at the same time, a return to his glorious past.
  • GameSpot9.0 - With savage gunplay and an absorbing personal story, Max Payne 3 is an exhilarating shooter that grabs hold of you and doesn’t let go.
  • Destructoid9.0 - Max Payne 3 is a fantastic package, with a top-notch presentation and plenty of content to keep players busy and happy. It may have been a long time in coming, but there’s no arguing with results, and Max is the kind of guy who gets them. Fans and newcomers alike are going to find plenty to enjoy in this exceptional title.
  • Joystiq4.5 - Max Payne 3, a game built out of remarkably implemented, masterfully presented parts. Video games live or die by the mechanisms that lie underneath. That’s why the graveyards are always full.
  • Polygon9/10 - This is the first time Rockstar has made a game that excels best as just that, supported and expertly augmented by the production values and attention to small details that its games have always been known for. It is uncompromisingly excellent, with a sense of focus that has secured Max Payne’s legacy once again.
  • The Telegraph4.5 - It may not have the scope of Rockstar’s most famous oeuvre, but it more than makes up for that in focus, detail and raw thrills.
  • OXM UK8/10 - Like its hero, Max Payne 3 has its flaws. The repetitive action might be reminiscent of the original games, but it’s still repetition, and ultimately that causes things to drag. Fortunately just like Max himself it’s also difficult to dislike – the plot isn’t something you’ll be able to leave alone for long, bullet time still has the capacity to thrill and the multiplayer provides the variety and unpredictability required for genuine longevity. This new spin on familiar action is proof, if proof were needed, that there’s life in the old dog yet.
  • GiantBomb4/5 - Rockstar Games modernizes and makes Max Payne its own, creating something grittier and more grounded in reality, if not quite as singular.
  • Eurogamer7/10 - What it has in abundance, though, is expensive-looking environments for Max to dive around in and then talk to himself, and that’s just about enough to keep you going for as long as it takes to settle the score. All the same, you can’t escape the feeling that Rockstar just isn’t as good at a pure third-person shooter as it is with the open worlds of Grand Theft Auto or Red Dead Redemption, and in this linear context it’s much harder to put up with its usual missteps in mechanics and difficulty.
  • Edge7 - This is a game about a world-weary killer doing the only thing he knows how to, and for all its spectacular action beats there’s something apt about Max’s fatigue.