Mysteries - Revision history

Stopa: /* Is there more than one revision of the bootrom? */

2026-03-22T12:05:21Z

Is there more than one revision of the bootrom?

← Older revision		Revision as of 15:05, 22 March 2026
Line 15:		Line 15:
	=== Is there a JTAG? ===		=== Is there a JTAG? ===
	=== Is there more than one revision of the bootrom? ===		=== Is there more than one revision of the bootrom? ===
	'''Background:''' Bootrom visible portion has been dumped on the entire 3DS Family (3DS, 3DSXL, 2DS, New3DS, New3DSXL, New2DSXL), and even a prototype board from April(?) 2010. All matching exactly.		'''Background:''' Bootrom visible portion has been dumped on the entire 3DS Family (3DS, 3DSXL, 2DS, New3DS, New3DSXL, New2DSXL, iQue3DSXL), and even a prototype board from April(?) 2010. All matching exactly.

	=== What is the EMMC controller @ 0x10100000 doing? ===		=== What is the EMMC controller @ 0x10100000 doing? ===

Shinyquagsire23: formatting

2022-08-10T03:56:11Z

formatting

← Older revision		Revision as of 07:56, 10 August 2022
Line 37:		Line 37:

	This could be referring to the ROM on the AR6K wireless chip:		This could be referring to the ROM on the AR6K wireless chip:
	- Some 2DS units have the WiFi chip soldered directly to the board (such as the 2DS in this FCC filing: https://fccid.link/BKE/FTR001N), and some do not.		* Some 2DS units have the WiFi chip soldered directly to the board (such as the 2DS in this FCC filing: https://fccid.link/BKE/FTR001N), and some do not.
	- The AR6K ROM only acts as an initial loader.		* The AR6K ROM only acts as an initial loader.
	- Maybe some AR6K-family devices allow signature checks on the firmware? Or maybe some registers weren't write-once but should have been?		* Maybe some AR6K-family devices allow signature checks on the firmware? Or maybe some registers weren't write-once but should have been?

	=== What did SVC 0x74 in the ARM11 kernel do before it got stubbed? ===		=== What did SVC 0x74 in the ARM11 kernel do before it got stubbed? ===

Shinyquagsire23: just spitballing here

2022-08-10T03:53:38Z

just spitballing here

← Older revision		Revision as of 07:53, 10 August 2022
Line 35:		Line 35:
	=== What was the problem in "initial program loader" that was mentioned in an FCC filing by Nintendo for 2DS? ===		=== What was the problem in "initial program loader" that was mentioned in an FCC filing by Nintendo for 2DS? ===
	'''Background:''' http://www.neogaf.com/forum/showthread.php?t=814624&page=1		'''Background:''' http://www.neogaf.com/forum/showthread.php?t=814624&page=1

			This could be referring to the ROM on the AR6K wireless chip:
			- Some 2DS units have the WiFi chip soldered directly to the board (such as the 2DS in this FCC filing: https://fccid.link/BKE/FTR001N), and some do not.
			- The AR6K ROM only acts as an initial loader.
			- Maybe some AR6K-family devices allow signature checks on the firmware? Or maybe some registers weren't write-once but should have been?

	=== What did SVC 0x74 in the ARM11 kernel do before it got stubbed? ===		=== What did SVC 0x74 in the ARM11 kernel do before it got stubbed? ===
	=== What is the PTM abbreviation? ===		=== What is the PTM abbreviation? ===

MarcusD: replace abbreviations with newly acquired information

2022-07-12T20:41:40Z

replace abbreviations with newly acquired information

← Older revision		Revision as of 00:41, 13 July 2022
Line 26:		Line 26:

	=== What is the PDN abbreviation? ===		=== What is the PDN abbreviation? ===
	: ~~Power distribution network~~		: PowerDowN

	=== How does Nintendo reflash bricked systems? ===		=== How does Nintendo reflash bricked systems? ===
Line 37:		Line 37:
	=== What did SVC 0x74 in the ARM11 kernel do before it got stubbed? ===		=== What did SVC 0x74 in the ARM11 kernel do before it got stubbed? ===
	=== What is the PTM abbreviation? ===		=== What is the PTM abbreviation? ===
	: ~~Power/time management~~		: PlayTime Management

	=== Why is the DTCM not used anywhere except bootrom? ===		=== Why is the DTCM not used anywhere except bootrom? ===

Qyriad at 17:43, 3 May 2018

2018-05-03T15:43:17Z

← Older revision		Revision as of 19:43, 3 May 2018
Line 5:		Line 5:
	: C may stand for Chiheisen ("horizon" in Japanese, the O3DS's codename being "Project Horizon").		: C may stand for Chiheisen ("horizon" in Japanese, the O3DS's codename being "Project Horizon").
	:: Not true, Horizon refers to the OS.		:: Not true, Horizon refers to the OS.
			: CTR stands for Citrus.

	== Hardware ==		== Hardware ==

EvilFlight at 02:16, 17 April 2018

2018-04-17T00:16:52Z

← Older revision		Revision as of 04:16, 17 April 2018
Line 45:		Line 45:
	'''Theory:''' NtrBoot another time		'''Theory:''' NtrBoot another time
	=== Why are there 4 stubbed syscalls named SendSyncRequest1-4? ===		=== Why are there 4 stubbed syscalls named SendSyncRequest1-4? ===
			=== Is there a deterministic formula for calculating the Movable.sed KeyY high u64? ===
			'''Background:''' We know now that the high 4 bytes of KeyY can be reliably estimated to be 1/5th of the LocalFriendCodeSeed (low 8 bytes of KeyY), which is close enough to brute force. However, the actual value is usually about 0-4000 units off the actual high u32 of the KeyY (called msed3 in the seedminer implementation). Could there possibly be a deterministic formula given this 1/5 ratio is so close to the correct value? It's difficult to imagine this is just a coincidence.

Safan41: /* Not theory anymore */

2018-02-25T00:19:17Z

Not theory anymore

← Older revision		Revision as of 03:19, 25 February 2018
Line 28:		Line 28:

	=== How does Nintendo reflash bricked systems? ===		=== How does Nintendo reflash bricked systems? ===
	~~'''Theory:'''~~ Before trying to boot from NAND, the bootrom checks to see if a key combination (Start + Select + X) is being held, and whether the shell is closed. If so, it tries to boot from an inserted NTR (Nintendo DS) cartridge.		Before trying to boot from NAND, the bootrom checks to see if a key combination (Start + Select + X) is being held, and whether the shell is closed. If so, it tries to boot from an inserted NTR (Nintendo DS) cartridge.
	This allows to execute a FIRM that is probably used by Nintendo to reflash the system.		This allows to execute a FIRM that is probably used by Nintendo to reflash the system.

EvilFlight: /* Is there more than one revision of the bootrom? */

2017-10-18T21:24:06Z

Is there more than one revision of the bootrom?

← Older revision		Revision as of 01:24, 19 October 2017
Line 14:		Line 14:
	=== Is there a JTAG? ===		=== Is there a JTAG? ===
	=== Is there more than one revision of the bootrom? ===		=== Is there more than one revision of the bootrom? ===
	'''Background:''' Bootrom visible portion has been dumped on 3DS, 3DSXL, 2DS, New3DS, ~~New 2DS~~, and even a prototype board from April(?) 2010. All matching exactly.		'''Background:''' Bootrom visible portion has been dumped on the entire 3DS Family (3DS, 3DSXL, 2DS, New3DS, New3DSXL, New2DSXL), and even a prototype board from April(?) 2010. All matching exactly.

	=== What is the EMMC controller @ 0x10100000 doing? ===		=== What is the EMMC controller @ 0x10100000 doing? ===

Riley at 22:14, 18 October 2017

2017-10-18T20:14:41Z

← Older revision		Revision as of 00:14, 19 October 2017
Line 14:		Line 14:
	=== Is there a JTAG? ===		=== Is there a JTAG? ===
	=== Is there more than one revision of the bootrom? ===		=== Is there more than one revision of the bootrom? ===
	'''Background:''' Bootrom visible portion has been dumped on 3DS, 3DSXL, 2DS, New3DS, New 2DS, and even ~~the Tegra-based unit~~. All matching exactly.		'''Background:''' Bootrom visible portion has been dumped on 3DS, 3DSXL, 2DS, New3DS, New 2DS, and even a prototype board from April(?) 2010. All matching exactly.

	=== What is the EMMC controller @ 0x10100000 doing? ===		=== What is the EMMC controller @ 0x10100000 doing? ===

LinkSoraZelda: /* Is there more than one revision of the bootrom? */

2017-10-18T19:41:41Z

Is there more than one revision of the bootrom?

← Older revision		Revision as of 23:41, 18 October 2017
Line 14:		Line 14:
	=== Is there a JTAG? ===		=== Is there a JTAG? ===
	=== Is there more than one revision of the bootrom? ===		=== Is there more than one revision of the bootrom? ===
	'''Background:''' Bootrom visible portion has been dumped on 3DS, 3DSXL, 2DS, New3DS. All matching exactly.		'''Background:''' Bootrom visible portion has been dumped on 3DS, 3DSXL, 2DS, New3DS, New 2DS, and even the Tegra-based unit. All matching exactly.

	=== What is the EMMC controller @ 0x10100000 doing? ===		=== What is the EMMC controller @ 0x10100000 doing? ===
	'''Background:''' There's dead code in NWM referencing it.		'''Background:''' There's dead code in NWM referencing it.