Difference between revisions of "Mysteries"

From 3dbrew
Jump to navigation Jump to search
(2 intermediate revisions by one other user not shown)
Line 21: Line 21:
  
 
=== Is there a secret message embedded in the 3DS keyscrambler constant? ===
 
=== Is there a secret message embedded in the 3DS keyscrambler constant? ===
'''Background:''' TWL key scrambler constant was Nintendo in Japanese ("任天堂株式会社"), UTF-8LE encoded, with byte order mark.  The 3DS key scrambler constant, by comparison, is random-looking.
+
'''Background:''' TWL key scrambler constant was "Nintendo Co., Ltd" in Japanese ("任天堂株式会社"), UTF-16LE encoded, with byte order mark.  The 3DS key scrambler constant, by comparison, is random-looking.
  
 
=== What is the PDN abbreviation? ===
 
=== What is the PDN abbreviation? ===
 
: Power distribution network
 
: Power distribution network
 +
 +
=== How does Nintendo reflash bricked systems? ===
 +
'''Background:''' The boot ROM will boot from SPI flash if the FIRM partitions are both corrupt.  But if, say, Home Menu gets deleted, the system is dead, and boot ROM would still see the NAND as valid.  How does Nintendo's refurbishing center reflash such systems?
  
 
== Software ==
 
== Software ==
Line 35: Line 38:
 
=== How is CTRAging launched during factory setup? ===
 
=== How is CTRAging launched during factory setup? ===
 
'''Background:''' No TestMenu version is capable of launching CTRAging directly: O3DS factory TestMenu can only launch DevMenu installed on NAND, the inserted cartridge and the TWL/AGB test apps; N3DS factory TestMenu can only launch DevMenu installed on NAND, the inserted cartridge and System Settings.
 
'''Background:''' No TestMenu version is capable of launching CTRAging directly: O3DS factory TestMenu can only launch DevMenu installed on NAND, the inserted cartridge and the TWL/AGB test apps; N3DS factory TestMenu can only launch DevMenu installed on NAND, the inserted cartridge and System Settings.
 +
=== Why are there 4 stubbed syscalls named SendSyncRequest1-4? ===

Revision as of 02:43, 10 February 2017

The following is a list of mysteries.

General

  • What is the CTR abbreviation?
C may stand for Chiheisen ("horizon" in Japanese, the O3DS's codename being "Project Horizon").
Not true, Horizon refers to the OS.

Hardware

Why are there two CTRCARD controllers?

Background: Also DSi SoC pinout shows evidence of dual NTRCARD controllers on the final DSi SoC. (This was a planned feature of the DSi before being axed later in development)

Why are there two EMMC controllers?

Theory: At some point during 3DS hardware development there was an idea to split up CTR and TWL nand into two different chips.

Is there a JTAG?

Is there more than one revision of the bootrom?

Background: Bootrom visible portion has been dumped on 3DS, 3DSXL, 2DS, New3DS. All matching exactly.

What is the EMMC controller @ 0x10100000 doing?

Background: There's dead code in NWM referencing it.

Why did they put NTRCARD accessible from ARM11?

Theory: At some point during 3DS hardware development there was a concept where ARM11 ran a menu with DS(i) icons while ARM9 was in TWL mode.

Is there a secret message embedded in the 3DS keyscrambler constant?

Background: TWL key scrambler constant was "Nintendo Co., Ltd" in Japanese ("任天堂株式会社"), UTF-16LE encoded, with byte order mark. The 3DS key scrambler constant, by comparison, is random-looking.

What is the PDN abbreviation?

Power distribution network

How does Nintendo reflash bricked systems?

Background: The boot ROM will boot from SPI flash if the FIRM partitions are both corrupt. But if, say, Home Menu gets deleted, the system is dead, and boot ROM would still see the NAND as valid. How does Nintendo's refurbishing center reflash such systems?

Software

What was the problem in "initial program loader" that was mentioned in an FCC filing by Nintendo for 2DS?

Background: http://www.neogaf.com/forum/showthread.php?t=814624&page=1

What did SVC 0x74 in the ARM11 kernel do before it got stubbed?

What is the PTM abbreviation?

Why is the DTCM not used anywhere except bootrom?

Background: Bootrom is known to use part of DTCM as state, memsetting it to 0 when it's done. After that, it is never used again.

How is CTRAging launched during factory setup?

Background: No TestMenu version is capable of launching CTRAging directly: O3DS factory TestMenu can only launch DevMenu installed on NAND, the inserted cartridge and the TWL/AGB test apps; N3DS factory TestMenu can only launch DevMenu installed on NAND, the inserted cartridge and System Settings.

Why are there 4 stubbed syscalls named SendSyncRequest1-4?