Steam Controller 2026 Custom Firmware/Bootloader Method¶

thing¶

so i thought i was the first person to find this stuff. i wasnt. people have discovered this before me, and discovered more than me, my work is poorly documented and not very useful. i probably won't update this more, as i don't enjoy the project much now. here is some other projects people have made: https://github.com/CouchTurtle/sc2-research https://github.com/mwdmwd/sc26re

DANGER¶

THIS APPEARS TO BE AN INTERNAL UNDOCUMENTED TOOL, YOU CAN BRICK YOUR DEVICE, MAKE SURE TO COPY THIS FOLDER ELSEWHERE SO STEAM DOESN'T DECIDE TO DELETE IT. CLOSE STEAM WHEN MESSING AROUND SO IT DOESN'T BREAK IT IN THE MIDDLE OF FLASHING. I DO NOT KNOW WHERE THIS IS ON WINDOWS, OR IF IT EVEN EXISTS. IDK MUCH ELSE THAN THIS YET. OTHER PEOPLE SHOULD DO SOME MORE WORK

EXTREME DANGER¶

I ended up bricking my controller with this, and until I can access the internal SWD debug thing with its pinout, I cannot fix it, BE CAREFUL WITH CFW.

MAJOR UPDATE¶

Successful recovery! Using an RPI Pico, and soldering to debug pins, I flashed the firmware back, more on the recovery and pinout here

I got it to run Rust!

Turns out there is an extremley useful recovery button for broken firmware, pressing A+START+SELECT puts it in bootloader mode when turning it on!

I could not find this ANYWHERE else on the internet. I was trying to install CFW on my Steam Controller so I can run games ON THE CONTROLLER (might be coming soon!). I don't know much about this, but since I have updated the controller on this computer, this folder existed, I looked with Claude, and there was no sign of the firmware. I was about to give up, and then i found this:

~/.local/share/Steam/bin/hardwareupdater/

It may also be in here:

~/.steam/steam/ubuntu12_32/hardwareupdater/

But I didn't have it there.

IDK when this gets created, but it has a few EXTREMELEY useful files in it (for me at least).

IBEX_FW_6A4423D7.fw: IBEX is the codename for the Steam Controller (2026), and this file is integrity checked with a CRC-32, and appears to have no cryptographic signature or encryption on it. This file could probably be reverse engineered.

PROTEUS_FW_6A4423DE.fw: This appears to be the Steam Controller Puck firmware, but since this is not my main target, I haven't messed with it yet.

hardwareupdater.cfg: IDK what this file does but it contains the following (for me at least):

MUST_UPDATE_TRITON_FW_TS:6A18D057
MUST_UPDATE_PROTEUS_FW_TS:6A18D053
TRITON_FW_TS:6A4423D7
PROTEUS_FW_TS:6A4423DE

UPDATE: This appears to tell hardwareupdater what file to flash, since you don't give the file as an arg.

Finally, the most useful file (maybe), hardwareupdater.x86_64: This is a pyinstaller packaged CLI for putting firmware on the controller and puck. After doing a chmod +x to the file to make it executable, running it gives the following:

hardwareupdater.py [--help | --check-for-updates | --update-all  | --update-by-serial SERNUM | --prep-by-serial SERNUM | --reboot-by-serial SERNUM | --show-all-devices]

This appears to be extremeley useful. Running this:

./hardwareupdater.x86_64 --show-all-devices

Lists devices in this format:

{
    "version": "1.5",
    "updates_available": [
        {
            "type": 2,
            "Name": "Triton USB",
            "hardware_id": 73,
            "serial_number": "FXA9961700A0E",
            "current_ts": "0x6A4423D7",
            "update_ts": "0x0",
            "must_update": false
        }
    ]
}

must_update and update_ts may break update-all, and automatic updates in it, and won't work until a new update is available, since there is no newer FW than what I have, I cannot test it. Update by serial should still work.

Taking the serial_number and running this:

./hardwareupdater.x86_64 --prep-by-serial SERIAL_NUMBER

Puts the controller into bootloader mode, identifying as this:

28de:1005 Valve Software Steam Controller Bootloader

After a bit of time in this mode, it will exit bootloader mode, and if steam is open, it will open the firmware updating/onboarding screen again. I haven't tested yet but i assume the --update-by-serial lets you update by the .fw files.

UPDATE:¶

I just tested flashing the stock firmware file, it flashes even if it's already updated, but it says "ERROR: NO UNIT NEEDING UPDATE FOUND FOR SERIAL NUMBER" if you don't prep-by-serial first. You update with this command:

./hardwareupdater.x86_64 --update-by-serial SERIAL_NUMBER

Serial number is the one from the list command. The best way to install custom firmware is to just replace the IBEX_FW file with the SAME NAME. MAKE SURE TO BACK IT UP TO RESTORE LATER. Steam may also do it when opened, SO CLOSE STEAM WHEN DOING THIS OR YOU MAY BRICK YOUR CONTROLLER. IDK if Steam will, and I don't want to maybe brick my controller.

UPDATE 2:¶

After reflash, puck paired fine, but haptics sound wrong, IDK if it will fix itself, may update later. This may be unrelated.

The firmware file (according to Claude)¶

The IBEX fw file has this format, a 32-byte header — [magic 0xD2D86467][payload size (350672)][CRC-32 of payload 0x92D7396B][20 zero bytes] — followed by a raw Nordic nRF52833 (Cortex-M4) firmware image, with the size and CRC-32 both verified against the file.