5
edits
Changes
Jump to navigation
Jump to search
Line 5:
Line 5: + Line 28:
Line 29: − '''Theory:''' Before trying to boot from NAND, the bootrom checks to see if a key combination (Start + Select + X) is being held, and whether the shell is closed. If so, it tries to boot from an inserted NTR (Nintendo DS) cartridge.+ Line 45:
Line 46: + +
no edit summary
: C may stand for Chiheisen ("horizon" in Japanese, the O3DS's codename being "Project Horizon").
: C may stand for Chiheisen ("horizon" in Japanese, the O3DS's codename being "Project Horizon").
:: Not true, Horizon refers to the OS.
:: Not true, Horizon refers to the OS.
: CTR stands for Citrus.
== Hardware ==
== Hardware ==
=== How does Nintendo reflash bricked systems? ===
=== How does Nintendo reflash bricked systems? ===
Before trying to boot from NAND, the bootrom checks to see if a key combination (Start + Select + X) is being held, and whether the shell is closed. If so, it tries to boot from an inserted NTR (Nintendo DS) cartridge.
This allows to execute a FIRM that is probably used by Nintendo to reflash the system.
This allows to execute a FIRM that is probably used by Nintendo to reflash the system.
'''Theory:''' NtrBoot another time
'''Theory:''' NtrBoot another time
=== Why are there 4 stubbed syscalls named SendSyncRequest1-4? ===
=== Why are there 4 stubbed syscalls named SendSyncRequest1-4? ===
=== Is there a deterministic formula for calculating the Movable.sed KeyY high u64? ===
'''Background:''' We know now that the high 4 bytes of KeyY can be reliably estimated to be 1/5th of the LocalFriendCodeSeed (low 8 bytes of KeyY), which is close enough to brute force. However, the actual value is usually about 0-4000 units off the actual high u32 of the KeyY (called msed3 in the seedminer implementation). Could there possibly be a deterministic formula given this 1/5 ratio is so close to the correct value? It's difficult to imagine this is just a coincidence.