Mysteries: Difference between revisions

(4 intermediate revisions by 3 users not shown)

Line 15:

=== Is there a JTAG? ===

=== Is there more than one revision of the bootrom? ===

'''Background:''' Bootrom visible portion has been dumped on the entire 3DS Family (3DS, 3DSXL, 2DS, New3DS, New3DSXL, New2DSXL), and even a prototype board from April(?) 2010. All matching exactly.

'''Background:''' Bootrom visible portion has been dumped on the entire 3DS Family (3DS, 3DSXL, 2DS, New3DS, New3DSXL, New2DSXL, iQue3DSXL), and even a prototype board from April(?) 2010. All matching exactly.

=== What is the EMMC controller @ 0x10100000 doing? ===

Line 26:

=== What is the PDN abbreviation? ===

: ~~Power distribution network~~

: PowerDowN

=== How does Nintendo reflash bricked systems? ===

Line 35:

=== What was the problem in "initial program loader" that was mentioned in an FCC filing by Nintendo for 2DS? ===

'''Background:''' http://www.neogaf.com/forum/showthread.php?t=814624&page=1

This could be referring to the ROM on the AR6K wireless chip:

* Some 2DS units have the WiFi chip soldered directly to the board (such as the 2DS in this FCC filing: https://fccid.link/BKE/FTR001N), and some do not.

* The AR6K ROM only acts as an initial loader.

* Maybe some AR6K-family devices allow signature checks on the firmware? Or maybe some registers weren't write-once but should have been?

=== What did SVC 0x74 in the ARM11 kernel do before it got stubbed? ===

=== What is the PTM abbreviation? ===

: ~~Power/time management~~

: PlayTime Management

=== Why is the DTCM not used anywhere except bootrom? ===

Line 46:

Line 52:

'''Theory:''' NtrBoot another time

=== Why are there 4 stubbed syscalls named SendSyncRequest1-4? ===

=== Is there a deterministic formula for calculating the Movable.sed KeyY high u64? ===

'''Background:''' We know now that the high 4 bytes of KeyY can be reliably estimated to be 1/5th of the LocalFriendCodeSeed (low 8 bytes of KeyY), which is close enough to brute force. However, the actual value is usually about 0-4000 units off the actual high u32 of the KeyY (called msed3 in the seedminer implementation). Could there possibly be a deterministic formula given this 1/5 ratio is so close to the correct value? It's difficult to imagine this is just a coincidence.

'''Answer:''' No. Both LFCS and the second half of key Y are monotonically increasing:

* The former increases by a random value between [1, 4], thus the average increase is 2.5.

* The latter increases by a random value between [1, 2^32], thus the average increase is 2^31.

After X increases, the LFCS assumes a value of roughly X * 2.5, the second half of key Y assumes a value roughly of X * 2^31, which means msed3 becomes roughly (X >> 1) -> X / 2. Thus the correlation: LFCS/msed3 = (X * 2.5) / (X / 2) -> (X * 2.5) * (2 / X) = 2.5 * 2 = 5.

@@ Line 15: / Line 15: @@
 === Is there a JTAG? ===
 === Is there more than one revision of the bootrom? ===
-'''Background:''' Bootrom visible portion has been dumped on the entire 3DS Family (3DS, 3DSXL, 2DS, New3DS, New3DSXL, New2DSXL), and even a prototype board from April(?) 2010. All matching exactly.
+'''Background:''' Bootrom visible portion has been dumped on the entire 3DS Family (3DS, 3DSXL, 2DS, New3DS, New3DSXL, New2DSXL, iQue3DSXL), and even a prototype board from April(?) 2010. All matching exactly.
 === What is the EMMC controller @ 0x10100000 doing? ===
@@ Line 26: / Line 26: @@
 === What is the PDN abbreviation? ===
-: Power distribution network
+: PowerDowN
 === How does Nintendo reflash bricked systems? ===
@@ Line 35: / Line 35: @@
 === What was the problem in "initial program loader" that was mentioned in an FCC filing by Nintendo for 2DS? ===
 '''Background:''' http://www.neogaf.com/forum/showthread.php?t=814624&page=1
+This could be referring to the ROM on the AR6K wireless chip:
+* Some 2DS units have the WiFi chip soldered directly to the board (such as the 2DS in this FCC filing: https://fccid.link/BKE/FTR001N), and some do not.
+* The AR6K ROM only acts as an initial loader.
+* Maybe some AR6K-family devices allow signature checks on the firmware? Or maybe some registers weren't write-once but should have been?
 === What did SVC 0x74 in the ARM11 kernel do before it got stubbed? ===
 === What is the PTM abbreviation? ===
-: Power/time management
+: PlayTime Management
 === Why is the DTCM not used anywhere except bootrom? ===
@@ Line 46: / Line 52: @@
 '''Theory:''' NtrBoot another time
 === Why are there 4 stubbed syscalls named SendSyncRequest1-4? ===
 === Is there a deterministic formula for calculating the Movable.sed KeyY high u64? ===
 '''Background:''' We know now that the high 4 bytes of KeyY can be reliably estimated to be 1/5th of the LocalFriendCodeSeed (low 8 bytes of KeyY), which is close enough to brute force. However, the actual value is usually about 0-4000 units off the actual high u32 of the KeyY (called msed3 in the seedminer implementation). Could there possibly be a deterministic formula given this 1/5 ratio is so close to the correct value? It's difficult to imagine this is just a coincidence.
+'''Answer:''' No. Both LFCS and the second half of key Y are monotonically increasing:
+* The former increases by a random value between [1, 4], thus the average increase is 2.5.
+* The latter increases by a random value between [1, 2^32], thus the average increase is 2^31.
+After X increases, the LFCS assumes a value of roughly X * 2.5, the second half of key Y assumes a value roughly of X * 2^31, which means msed3 becomes roughly (X >> 1) -> X / 2. Thus the correlation: LFCS/msed3 = (X * 2.5) / (X / 2) -> (X * 2.5) * (2 / X) = 2.5 * 2 = 5.