Mysteries: Difference between revisions

(13 intermediate revisions by 9 users not shown)

Line 5:

: C may stand for Chiheisen ("horizon" in Japanese, the O3DS's codename being "Project Horizon").

:: Not true, Horizon refers to the OS.

: CTR stands for Citrus.

== Hardware ==

Line 14:

Line 15:

=== Is there a JTAG? ===

=== Is there more than one revision of the bootrom? ===

'''Background:''' Bootrom visible portion has been dumped on 3DS, 3DSXL, 2DS, New3DS. All matching exactly.

'''Background:''' Bootrom visible portion has been dumped on the entire 3DS Family (3DS, 3DSXL, 2DS, New3DS, New3DSXL, New2DSXL), and even a prototype board from April(?) 2010. All matching exactly.

=== What is the EMMC controller @ 0x10100000 doing? ===

'''Background:''' There's dead code in NWM referencing it.

Line 24:

Line 26:

=== What is the PDN abbreviation? ===

: ~~Power distribution network~~

: PowerDowN

=== How does Nintendo reflash bricked systems? ===

~~'''Background:''' The boot ROM will~~ boot from ~~SPI flash if~~ the ~~FIRM partitions are both corrupt. But~~ if, ~~say, Home Menu gets deleted,~~ the ~~system~~ is ~~dead~~, ~~and~~ boot ~~ROM would still see the NAND as valid~~. ~~How does~~ Nintendo~~'s refurbishing center~~ reflash ~~such systems?~~

Before trying to boot from NAND, the bootrom checks to see if a key combination (Start + Select + X) is being held, and whether the shell is closed. If so, it tries to boot from an inserted NTR (Nintendo DS) cartridge.

This allows to execute a FIRM that is probably used by Nintendo to reflash the system.

== Software ==

=== What was the problem in "initial program loader" that was mentioned in an FCC filing by Nintendo for 2DS? ===

'''Background:''' http://www.neogaf.com/forum/showthread.php?t=814624&page=1

This could be referring to the ROM on the AR6K wireless chip:

* Some 2DS units have the WiFi chip soldered directly to the board (such as the 2DS in this FCC filing: https://fccid.link/BKE/FTR001N), and some do not.

* The AR6K ROM only acts as an initial loader.

* Maybe some AR6K-family devices allow signature checks on the firmware? Or maybe some registers weren't write-once but should have been?

=== What did SVC 0x74 in the ARM11 kernel do before it got stubbed? ===

=== What is the PTM abbreviation? ===

: PlayTime Management

=== Why is the DTCM not used anywhere except bootrom? ===

'''Background:''' Bootrom is known to use part of DTCM as state, memsetting it to 0 when it's done. After that, it is never used again.

=== How is CTRAging launched during factory setup? ===

'''Background:''' No TestMenu version is capable of launching CTRAging directly: O3DS factory TestMenu can only launch DevMenu installed on NAND, the inserted cartridge and the TWL/AGB test apps; N3DS factory TestMenu can only launch DevMenu installed on NAND, the inserted cartridge and System Settings.

'''Theory:''' NtrBoot another time

=== Why are there 4 stubbed syscalls named SendSyncRequest1-4? ===

=== Is there a deterministic formula for calculating the Movable.sed KeyY high u64? ===

'''Background:''' We know now that the high 4 bytes of KeyY can be reliably estimated to be 1/5th of the LocalFriendCodeSeed (low 8 bytes of KeyY), which is close enough to brute force. However, the actual value is usually about 0-4000 units off the actual high u32 of the KeyY (called msed3 in the seedminer implementation). Could there possibly be a deterministic formula given this 1/5 ratio is so close to the correct value? It's difficult to imagine this is just a coincidence.

@@ Line 5: / Line 5: @@
 : C may stand for Chiheisen ("horizon" in Japanese, the O3DS's codename being "Project Horizon").
 :: Not true, Horizon refers to the OS.
+: CTR stands for Citrus.
 == Hardware ==
@@ Line 14: / Line 15: @@
 === Is there a JTAG? ===
 === Is there more than one revision of the bootrom? ===
-'''Background:''' Bootrom visible portion has been dumped on 3DS, 3DSXL, 2DS, New3DS. All matching exactly.
+'''Background:''' Bootrom visible portion has been dumped on the entire 3DS Family (3DS, 3DSXL, 2DS, New3DS, New3DSXL, New2DSXL), and even a prototype board from April(?) 2010. All matching exactly.
 === What is the EMMC controller @ 0x10100000 doing? ===
 '''Background:''' There's dead code in NWM referencing it.
@@ Line 24: / Line 26: @@
 === What is the PDN abbreviation? ===
-: Power distribution network
+: PowerDowN
 === How does Nintendo reflash bricked systems? ===
-'''Background:''' The boot ROM will boot from SPI flash if the FIRM partitions are both corrupt.  But if, say, Home Menu gets deleted, the system is dead, and boot ROM would still see the NAND as valid.  How does Nintendo's refurbishing center reflash such systems?
+Before trying to boot from NAND, the bootrom checks to see if a key combination (Start + Select + X) is being held, and whether the shell is closed. If so, it tries to boot from an inserted NTR (Nintendo DS) cartridge.
+This allows to execute a FIRM that is probably used by Nintendo to reflash the system.
 == Software ==
 === What was the problem in "initial program loader" that was mentioned in an FCC filing by Nintendo for 2DS? ===
 '''Background:''' http://www.neogaf.com/forum/showthread.php?t=814624&page=1
+This could be referring to the ROM on the AR6K wireless chip:
+* Some 2DS units have the WiFi chip soldered directly to the board (such as the 2DS in this FCC filing: https://fccid.link/BKE/FTR001N), and some do not.
+* The AR6K ROM only acts as an initial loader.
+* Maybe some AR6K-family devices allow signature checks on the firmware? Or maybe some registers weren't write-once but should have been?
 === What did SVC 0x74 in the ARM11 kernel do before it got stubbed? ===
 === What is the PTM abbreviation? ===
+: PlayTime Management
 === Why is the DTCM not used anywhere except bootrom? ===
 '''Background:''' Bootrom is known to use part of DTCM as state, memsetting it to 0 when it's done. After that, it is never used again.
 === How is CTRAging launched during factory setup? ===
 '''Background:''' No TestMenu version is capable of launching CTRAging directly: O3DS factory TestMenu can only launch DevMenu installed on NAND, the inserted cartridge and the TWL/AGB test apps; N3DS factory TestMenu can only launch DevMenu installed on NAND, the inserted cartridge and System Settings.
+'''Theory:''' NtrBoot another time
 === Why are there 4 stubbed syscalls named SendSyncRequest1-4? ===
+=== Is there a deterministic formula for calculating the Movable.sed KeyY high u64? ===
+'''Background:''' We know now that the high 4 bytes of KeyY can be reliably estimated to be 1/5th of the LocalFriendCodeSeed (low 8 bytes of KeyY), which is close enough to brute force. However, the actual value is usually about 0-4000 units off the actual high u32 of the KeyY (called msed3 in the seedminer implementation). Could there possibly be a deterministic formula given this 1/5 ratio is so close to the correct value? It's difficult to imagine this is just a coincidence.