游戏卡带

From 3dbrew
Jump to: navigation, search
一张N3DS游戏卡
印刷电路板特写

译自Gamecards

物理接口[edit]

3ds游戏卡带拥有与DS和DSi有一样的物理接口。他们的区别只有3DS游戏卡带的塑料壳右上角有一个防呆槽,它能阻止3DS卡带插入到旧的Nintendo DS或DSi主机中。

即使去除防呆槽并把卡带插入DS或DSi主机中,系统也会拒绝检测卡带,并且不能显示标题图标。

引脚 名称 描述
1 GND 接地。
2 CLK 时钟信号。DS/DSi游戏卡带频率分别为6.7MHz和4.2MHz,3DS游戏卡带高达16.6MHz(用于SPI和ROM传输)。
3 NC 未连接。可能用于编程卡(program card?翻译待查证)。
4 RCS ROM选择,低电平有效。送低电平开始传输ROM。
5 RST 重置信号。低电平有效。
6 ECS 存游戏芯片(Savegame chip)选择,低电平有效。送低电平开始存游戏SPI传输(savegame SPI transfer)。
7 IRQ 移除检测。
8 VCC 提供3.3V电压。
9 DAT0 双向数据总线。
10 DAT1 双向数据总线。
11 DAT2 双向数据总线。
12 DAT3 双向数据总线。
13 DAT4 双向数据总线 /存游戏芯片上的NC/SIO3引脚。
14 DAT5 双向数据总线 /存游戏芯片上的WP#/SIO2引脚。
15 DAT6 双向数据总线 /存游戏芯片上的SO/SIO1引脚。
16 DAT7 双向数据总线 /存游戏芯片上的SI/SIO0引脚。
17 GND 接地。


SPI闪存[edit]

目前为止,只有存游戏闪存芯片(savegame FLASH chip)被识别了。这块芯片被识别为0xC22211。JEDEC制造ID为Macronix,此外芯片标签为25L1001,与 MX25L1021E相符。 数据表位于:http://www.macronix.com/QuickPlace/hq/PageLibrary4825740B00298A3B.nsf/$defaultview/3F21BAC2E121E17848257639003A3146/$File/MX25L1021E%2C%203V%2C%201Mb%2C%20v1.1.pdf?OpenElement
http://www.beilenet.com/download/MX25L1021E,%203V,%201Mb,%20v0.01.pdf(old version mirror)
。不论如何,MX25L1021E不支持3DS用于与SPI闪存(SPI flash)交换数据的4位宽传输。因此,这可能是一块定制闪存芯片。

格式[edit]

Cartridge及系统更新存放在为此预留的区块内。 在ROM里,能找到小于1GB的CART_SIZE_MAX-( 0x280000*(CART_SIZE_MAX/CART_SIZE_128MB) )-0x2000000的更新区块。该区块为0x2000000字节。

通信协议[edit]

与DS和DSi游戏卡带相比,3DS系统与3DS游戏卡带的通信协议几乎完全改变了。

在第6个传输以后,命令从8 byte变为16 byte。可能使用了新的加密手段,比如AES CTR。 发送16 byte命令之后,卡带准备好并发送一个单字节数据0x01之前,数据总线一直为0x00直到。接下来是实际数据。每0x200-byte 实际数据块之后,是4-byte该字节块的标准CRC32码(未加密)。

下面是一个3DS主机给3DS游戏卡带的发送的命令样本:

大小 命令 解码命令 描述
2000 9F00000000000000 Reset
0000 71C93FE9BB0A3B18 Unknown
0004 9000000000000000 Get gamecard ID, response=9000FEC2
0004 9000000000000000 Get gamecard ID, response=9000FEC2
0004 A000000000000000 Unknown, response=00000000
0000 3E00000000000000 Enter 16-byte command mode.
0200 82000000000000000000000000000000 Get header
0000 F32C92D85C9D44DED3E0E41DBE7C90D9 8300000000000000708DF1A731717D0B Seed
0004 696B9D8582FB55D31B68CAFE70C74A95 A200000000000000708DF1A731717D0B Get secured gamecard ID, response=9000FEC2
0004 BAA4812CA0AC9C5D19399530E3ACCCAB A300000000000000708DF1A731717D0B Unknown
0000 178E427C22D87ADB86387249A97D321A C500000000000000708DF1A731717D0B Unknown
0004 E06019B1BD5C9130ED6A4D9F4A9E7193 A200000000000000708DF1A731717D0B Get secured gamecard ID, response=9000FEC2
0004 4E0D224862523BBFE2E6255F80E15F37 A200000000000000708DF1A731717D0B Get secured gamecard ID, response=9000FEC2
0004 4CDF93D319FB62D0DB632A45E3E8D84C A200000000000000708DF1A731717D0B Get secured gamecard ID, response=9000FEC2
0004 9AA5D80551002F955546D296A57F0FEF A200000000000000708DF1A731717D0B Get secured gamecard ID, response=9000FEC2
0004 C12BA81AEF30DDDBD93FAD5D544C6334 A200000000000000708DF1A731717D0B Get secured gamecard ID, response=9000FEC2
0200 62EC5FB7F420AE1DC6253AE18AFA5BB3 BF000000000000000000000000000000 Read address 0
0200 E3FA23AA016BE0C93430D1F42FF41324 BF000000000040000000000000000000 Read address 0x4000

头部命令有一些无用的初始字节,最后返回一个0x200字节的头部。下面是乐高星球大战3( Lego Starwars 3)的样本:

(The header command has some initial dummy bytes, and eventually responds with a 0x200 byte header. Here's an example for Lego Starwars 3:)

0000000: 00 8c 03 00 00 00 04 00 00 00 00 00 00 00 00 00  ................
0000010: b3 cf fb c6 6a b1 cb 20 32 af ce 35 d4 1c 74 c9  ....j.. 2..5..t.
0000020: 8e 6b 27 2f 08 01 28 3b d4 30 de 44 37 f5 b0 46  .k'/..(;.0.D7..F
0000030: 91 59 d7 38 33 48 df 83 fd 71 84 2c 00 00 00 00  .Y.83H...q.,....
0000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0000080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0000090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0000100: 4e 43 43 48 7a 7f 0e 00 00 8c 03 00 00 00 04 00  NCCHz...........
0000110: 36 34 02 00 00 00 00 00 00 8c 03 00 00 00 04 00  64..............
0000120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0000130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0000140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0000150: 43 54 52 2d 50 2d 41 4c 47 50 00 00 00 00 00 00  CTR-P-ALGP......
0000160: 0c 27 e3 c1 de 7b 2a e2 d3 11 4f 32 a4 ee bf 46  .'...{*...O2...F
0000170: 9a fd 0c f3 52 c1 1d 49 84 c2 a9 f1 d2 14 4c 63  ....R..I......Lc
0000180: 00 04 00 00 00 00 00 00 00 00 00 00 01 03 00 00  ................
0000190: 05 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00  ................
00001a0: 06 00 00 00 1c 0a 00 00 01 00 00 00 00 00 00 00  ................
00001b0: 22 0a 00 00 58 75 0e 00 01 00 00 00 00 00 00 00  "...Xu..........
00001c0: 13 0c 04 26 15 f6 47 c4 c6 32 25 ea 9e 67 f8 a2  ...&..G..2%..g..
00001d0: 7b 15 24 6b 88 fb c7 a9 27 25 7b 84 97 7b 78 7b  {.$k....'%{..{x{
00001e0: a6 5b ee 10 60 bb 6a 68 21 bb ce c6 00 03 5b 7e  .[..`.jh!.....[~
00001f0: 64 fb 6e ac a7 f0 96 0c fb 1f 5a 37 08 77 28 f7  d.n.......Z7.w(.