3dbrew - User contributions [en]

EMMC Registers

2016-12-20T00:14:49Z

Gelex: SD card insertion status timing, empirically timed by profi200

These registers are used to access the system [[Flash_Filesystem|NAND]] and the inserted SD card. Both devices use the same interface.

=Registers=

{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! Used by
|-
| style="background: green" | Yes
| EMMC_CMD
| 0x10006000
| 2
|
|-
| style="background: green" | Yes
| ?
| 0x10006002
| 2
|
|-
| style="background: green" | Yes
| EMMC_CMDARG0
| 0x10006004
| 2
|
|-
| style="background: green" | Yes
| EMMC_CMDARG1
| 0x10006006
| 2
|
|-
| style="background: green" | Yes
| EMMC_STOP
| 0x10006008
| 2
|
|-
| style="background: green" | Yes
| EMMC_BLKCOUNT
| 0x1000600a
| 2
|
|-
| style="background: green" | Yes
| EMMC_RESP0-7
| 0x1000600c
| 2*8
|
|-
| style="background: green" | Yes
| EMMC_STATUS0
| 0x1000601c
| 2
|
|-
| style="background: green" | Yes
| EMMC_STATUS1
| 0x1000601e
| 2
|
|-
| style="background: green" | Yes
| ?
| 0x10006020
| 2
|
|-
| style="background: green" | Yes
| ?
| 0x10006022
| 2
|
|-
| style="background: green" | Yes
| EMMC_CLKCTL
| 0x10006024
| 2
|
|-
| style="background: green" | Yes
| EMMC_BLKLEN
| 0x10006026
| 2
|
|-
| style="background: green" | Yes
| EMMC_OPT
| 0x10006028
| 2
|
|-
| style="background: green" | Yes
| EMMC_FIFO
| 0x10006030
| 2
|
|-
| style="background: green" | Yes
| EMMC_RESET
| 0x100060E0
| 2
|
|-
|}

The IO interface for SDMC/NAND seems to be very similar to the DSi; see libnds for [https://github.com/devkitPro/libnds/blob/master/source/arm7/sdmmc.c sample code] and [https://github.com/devkitPro/libnds/blob/master/include/nds/arm7/sdmmc.h documentation], and GBATEK for [http://problemkaputt.de/gbatek.htm#dsisdmmcioportscommandparamresponsedata better documentation].

3DS SDMC/NAND IO registers are located at 0x10006000 and apparently mirrored at 0x10007000. It seems the 0x10007000 mirror is never used on retail units.

==EMMC_STATUS0==

{| class="wikitable" border="1"
! Bit
! Description
|-
| 3
| SD card removal flag (Set to 1 when SD card is removed)
|-
| 4
| SD card insertion flag (Set to 1 when SD card is inserted)
|-
| 5
| SD card insertion status (0 = missing, 1 = inserted)
|-
|}

===SD card insertion status===
Assertion happens around 250 ms after SD card insertion and/or enabling the EMMC hardware (delay could possibly be due to an SD bus timeout?).

CONFIG9 Registers

2016-07-02T18:34:35Z

Gelex: /* 0x10000010 */ Was unable to confirm 0x80 detected when the cart is inserted (reading this register just returned 0x00). 0x01 was detected when the cart was removed.

= Registers =
{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! Used by
|-
| style="background: green" | Yes
| [[#CFG_SYSPROT9|CFG_SYSPROT9]]
| 0x10000000
| 1
| Boot9
|-
| style="background: green" | Yes
| [[#CFG_SYSPROT11|CFG_SYSPROT11]]
| 0x10000001
| 1
| Boot9
|-
| style="background: green" | Yes
| CFG_DEBUGUNIT
| 0x10000004
| 4
|
|-
| style="background: green" | Yes
| ?
| 0x10000008
| 1
| TwlProcess9
|-
| style="background: green" | Yes
| [[#CFG_CARDCONF|CFG_CARDCONF]]
| 0x1000000C
| 2
|
|-
| style="background: green" | Yes
|
| 0x10000010
| 1
|
|-
| style="background: green" | Yes
| ?
| 0x10000011
| 1
|
|-
| style="background: green" | Yes
| ?
| 0x10000012
| 2
|
|-
| style="background: green" | Yes
| ?
| 0x10000014
| 2
|
|-
| style="background: green" | Yes
| ?
| 0x10000020
| 2
|
|-
| style="background: green" | Yes
| ?
| 0x10000100
| 2
|
|-
| style="background: red" | No
| [[#CFG_EXTMEMCNT9|CFG_EXTMEMCNT9]]
| 0x10000200
| 1
| NewKernel9
|-
| style="background: green" | Yes
| [[#CFG_MPCORECFG|CFG_MPCORECFG]]
| 0x10000FFC
| 4
|
|-
| style="background: green" | Yes
| [[#CFG_BOOTENV|CFG_BOOTENV]]
| 0x10010000
| 4
|
|-
| style="background: green" | Yes
| [[#CFG_UNITINFO|CFG_UNITINFO]]
| 0x10010010
| 1
| Process9
|-
| style="background: green" | Yes
| [[#CFG_TWLUNITINFO|CFG_TWLUNITINFO]]
| 0x10010014
| 1
| Process9
|}

==CFG_SYSPROT9 ==
CFG_SYSPROT9 is used to permanently disable certain security-sensitive ARM9 memory areas until the next hard reset.

{| class="wikitable" border="1"
! Bit
! Description
|-
| 0
| Disables ARM9 [[Memory_layout|bootrom]](+0x8000) when set to 1. Cannot be cleared to 0 once set to 1.
|-
| 1
| Disables [[OTP_Registers|OTP area]] when set to 1. Cannot be cleared to 0 once set to 1.
|}

On Old 3DS, NATIVE_FIRM reads CFG_SYSPROT9 to know whether it has previously initialized the TWL console-unique keys using the OTP data. After setting the TWL console-unique keys, NATIVE_FIRM sets CFG_SYSPROT9 bit 1 to disable the OTP area. In subsequent FIRM launches prior to the next reset, NATIVE_FIRM will see that the OTP area is disabled, and skip this step.

On New 3DS, the above is instead done by the [[FIRM#New_3DS_FIRM|Kernel9 loader]]. In addition to using the OTP data for initializing the TWL console-unique keys, the Kernel9 loader will generate the decryption key for NATIVE_FIRM. The final keyslot for NATIVE_FIRM is preserved, so that at a non-reset FIRM launch, the keyslot can be reused, since the OTP would then be inaccessible.

It is not possible to set any other bits.

== CFG_SYSPROT11 ==
ARM11 bootrom (+0x8000) is disabled by writing bit0. It is not possible to set any other bits.

== CFG_CARDCONF ==
{| class="wikitable" border="1"
! Bit
! Description
|-
| 1-0
| Gamecard active controller select (0=NTRCARD, 1=?, 2=CTRCARD1, 3=CTRCARD2)
|-
| 8
| ?
|}

Depending on the gamecard controller that has been selected, one of the following gamecard registers will become active:
* Selecting NTRCARD will activate the register space at [[NTRCARD|0x10164000]].
* Selecting CTRCARD1 will activate the register space at [[CTRCARD|0x10004000]].
* Selecting CTRCARD2 will activate the register space at [[CTRCARD|0x10005000]].

== 0x10000010 ==
When a gamecard isn't inserted, this register value is 0x01.

== CFG_EXTMEMCNT9 ==
This register is presumably New3DS-only. Only bit0 is writable: 0 = disable New3DS ARM9 memory at 0x08100000 size 0x80000, 1 = enable.

This bit is set by New3DS ARM9-kernel crt0.

The data in this extended memory doesn't change when disabling the memory, then re-enabling the memory. Reading this extended memory while disabled results in zeros.

== CFG_MPCORECFG ==
Identical to [[PDN#PDN_MPCORE_CFG|PDN_MPCORE_CFG]].

== CFG_BOOTENV ==
This register is used to determine what the previous running FIRM was. Its value is kept following an MCU reboot. Its initial value (on a cold boot) is 0. NATIVE_FIRM [[Development_Services_PXI|sets it to 1]] on shutdown/FIRM launch. [[Legacy_FIRM_PXI|LGY FIRM]] writes value 3 here when launching a TWL title, and writes value 7 when launching an AGB title.

NATIVE_FIRM will only launch titles if this is not value 0, and will only save the [[Flash_Filesystem|AGB_FIRM savegame]] to SD if this is value 7.

== CFG_UNITINFO ==
This 8-bit register is value zero for retail, non-zero for dev/debug units.

== CFG_TWLUNITINFO ==
In the console-unique TWL key-init/etc function the ARM9 copies the u8 value from REG_UNITINFO to this register.

This is also used by TWL_FIRM Process9.

NCSD

2016-06-15T23:10:01Z

Gelex: /* NCSD header */

[[Category:File formats]]
This page documents the format of NCSD.

== Overview ==
There are two known specialisations of the NCSD container format. The CTR Cart Image (CCI) format and the 3DS' raw [[Flash Filesystem#NAND structure|NAND format]]. CCI is the format of game ROM images.

'''CTR System Update (CSU)''' is a variant of CCI, where the only difference is in the file extension. This is used with developer System Updates and associated [[3DS Development Unit Software|Tools]].

NCSD images start with a NCSD header, followed by up to a maximum of 8 [[NCCH]] partitions.

For CCI images, the partitions are reserved as follows:

{| class="wikitable" border="1"
|-
! [[NCCH]] Index
! Reserved Use
|-
| 0
| Executable Content ([[NCCH#CXI|CXI]])
|-
| 1
| E-Manual ([[NCCH#CFA|CFA]])
|-
| 2
| [[Download Play]] Child container ([[NCCH#CFA|CFA]])
|-
| 6
| New3DS [[System_Update_CFA|Update Data]] ([[NCCH#CFA|CFA]])
|-
| 7
| [[System_Update_CFA|Update Data]] ([[NCCH#CFA|CFA]])
|}

The format of partitions can be determined from the partition FS flags (normally these are zero for CCI/CSU NCSD Images).

== NCSD header ==
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x000
| 0x100
| RSA-2048 SHA-256 signature of the NCSD header
|-
| 0x100
| 4
| Magic Number 'NCSD'
|-
| 0x104
| 4
| Size of the NCSD image, in media units (1 media unit = 0x200 bytes)
|-
| 0x108
| 8
| Media ID
|-
| 0x110
| 8
| Partitions FS type (0=None, 1=Normal, 3=FIRM, 4=AGB_FIRM save)
|-
| 0x118
| 8
| Partitions crypt type (each byte corresponds to a partition in the partition table)
|-
| 0x120
| 0x40=(4+4)*8
| Offset & Length partition table, in media units
|-
| 0x160
| 0xA0
| ...
|}

For carts,
{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x160
| 0x20
| Exheader SHA-256 hash
|-
| 0x180
| 0x4
| Additional header size
|-
| 0x184
| 0x4
| Sector zero offset
|-
| 0x188
| 8
| Partition Flags (See Below)
|-
| 0x190
| 0x40=8*8
| Partition ID table
|-
| 0x1C0
| 0x30
| Reserved
|-
| 0x1F0
| 0xE
| Reserved?
|-
| 0x1FE
| 0x1
| Support for this was implemented with [[9.6.0-24|9.6.0-X]] FIRM. Bit0=1 enables using bits 1-2, it's unknown what these two bits are actually used for(the value of these two bits get compared with some other value during NCSD verification/loading). This appears to enable a new, likely hardware-based, antipiracy check on cartridges.
|-
| 0x1FF
| 0x1
| Support for this was implemented with [[9.6.0-24|9.6.0-X]] FIRM, see below regarding save crypto.
|}

For NAND,

{| class="wikitable" border="1"
|-
! Offset
! Size
! Description
|-
| 0x160
| 0x5E
| Unknown
|-
| 0x1BE
| 0x42
| Encrypted MBR partition-table, for the TWL partitions(key-data used for this keyslot is console-unique).
|}

=== NCSD Signature ===
The RSA pubk used for gamecard NCSD is stored in [[Memory_layout|ITCM]]. The separate pubk used for NAND NCSD is stored in Process9 .(ro)data instead of ITCM.

=== Partition Flags ===
{| class="wikitable" border="1"
|-
! Byte Index
! Description
|-
| 0
| Backup Write Wait Time (The time to wait to write save to backup after the card is recognized (0-255 seconds)).NATIVE_FIRM loads this flag from the gamecard NCSD header starting with [[6.0.0-11]].
|-
| 3
| Media Card Device (1 = NOR Flash, 2 = None, 3 = BT) (SDK 3.X+)
|-
| 4
| Media Platform Index (1 = CTR)
|-
| 5
| Media Type Index (0 = Inner Device, 1 = Card1, 2 = Card2, 3 = Extended Device)
|-
| 6
| Media Unit Size i.e. u32 MediaUnitSize = 0x200*2^flags[6];
|-
| 7
| Media Card Device (1 = NOR Flash, 2 = None, 3 = BT) (Only SDK 2.X)
|}

=== Partition Flags (In Terms of Save Crypto Determination) ===
{| class="wikitable" border="1"
|-
! Byte Index
! Description
|-
| 1
| Starting with [[6.0.0-11]] NATIVE_FIRM will use this flag to determine the gamecard [[Savegames|savegame]] keyY method, when flag[3] is set. 0 = [[2.0.0-2]] hashed keyY, 1 = [[Savegames|new]] keyY method implemented with [[6.0.0-11]]. 0x0A = implemented with [[9.3.0-21|9.3.0-X]]. On Old3DS this is identical to the [[2.2.0-4]] crypto. On New3DS this is identical to the [[2.2.0-4]] crypto, except with New3DS-only gamecard savedata [[AES|keyslots]].
Starting with [[9.6.0-24|9.6.0-X]] FIRM, Process9 now sets <savecrypto_stateval> to partitionflag[1] + <the u8 value from NCSD+0x1FF>, instead of just setting it to partitionflag[1].
|-
| 3
| Support for this flag was implemented in NATIVE_FIRM with [[2.0.0-2]]. When this flag is set the hashed gamecard [[Savegames|savegame]] keyY method is used, this likely still uses the repeating-CTR however. With [[6.0.0-11]] the system will determine the gamecard savegame keyY method via flag[1], instead of just using the hashed keyY via this flag.
|-th
| 7
| This flag enables using the hashed gamecard [[Savegames|savegame]] keyY method, support for this flag was implemented in NATIVE_FIRM with [[2.2.0-4]]. All games with the NCSD image finalized since [[2.2.0-4]](and contains [[2.2.0-4]]+ in the system update partition) have this flag set, this flag also enables using new CTR method as well.
|}

Starting with [[9.6.0-24|9.6.0-X]] FIRM, Process9 will just write val0 to a state field then return 0, instead of returning an error when the save crypto type isn't recognized. This was the *only* actual functionality change in the Old3DS Process9 function for gamecard savedata crypto init.

== Card Info Header ==
{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0x200
| 4
| CARD2: Writable Address In Media Units (For 'On-Chip' Savedata). CARD1: Always 0xFFFFFFFF.
|-
| 0x204
| 4
| Card Info Bitmask
|-
| 0x208
| 0xDF8
| Reserved1
|-
| 0x1000
| 0x10
| Card seed keyY (first u64 is Media ID (same as first NCCH partitionId))
|-
| 0x1010
| 0x10
| Encrypted card seed (AES-CCM, keyslot 0x3B for retail cards, see [[CTRCARD_Registers|CTRCARD_SECSEED]])
|-
| 0x1020
| 0x10
| Card seed AES-MAC
|-
| 0x1030
| 0xC
| Card seed nonce
|-
| 0x103C
| 0xC4
| Reserved
|-
| 0x1100
| 0x100
| Copy of first NCCH header (excluding RSA signature)
|}

== Development Card Info Header Extension ==
{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0x1200
| 0x200
| CardDeviceReserved1
|-
| 0x1400
| 0x10
| TitleKey
|-
| 0x1410
| 0xF0
| CardDeviceReserved2
|}

Note that a particular flashcard vendor puts what many refer to as "private headers" here in place of actual development card information. This header is constituted by a cartridge-unique Id obtained from [[Process_Services_PXI|pxi:ps9::GetRomId]] and the title-unique cart ID (identical for all carts of the same title; can be retrieved using the NTR gamecard protocol command 0x90 or through the CTR protocol commands 0x90 or 0xA2).

== Tools ==

[https://github.com/3dshax/ctr/tree/master/ctrtool ctrtool] - (CMD)(Windows/Linux) Parsing NCSD files

[[3DSExplorer]] - (GUI)(Windows Only) Parsing NCSD files

EMMC Registers

2016-02-28T04:55:20Z

Gelex: /* Registers */

These registers are used to access the system [[Flash_Filesystem|NAND]] and the inserted SD card. Both devices use the same interface.

=Registers=

{| class="wikitable" border="1"
! Old3DS
! Name
! Address
! Width
! Used by
|-
| style="background: green" | Yes
| EMMC_CMD
| 0x10006000
| 2
|
|-
| style="background: green" | Yes
| ?
| 0x10006002
| 2
|
|-
| style="background: green" | Yes
| EMMC_CMDARG0
| 0x10006004
| 2
|
|-
| style="background: green" | Yes
| EMMC_CMDARG1
| 0x10006006
| 2
|
|-
| style="background: green" | Yes
| EMMC_STOP
| 0x10006008
| 2
|
|-
| style="background: green" | Yes
| EMMC_BLKCOUNT
| 0x1000600a
| 2
|
|-
| style="background: green" | Yes
| EMMC_RESP0-7
| 0x1000600c
| 2*8
|
|-
| style="background: green" | Yes
| EMMC_STATUS0
| 0x1000601c
| 2
|
|-
| style="background: green" | Yes
| EMMC_STATUS1
| 0x1000601e
| 2
|
|-
| style="background: green" | Yes
| ?
| 0x10006020
| 2
|
|-
| style="background: green" | Yes
| ?
| 0x10006022
| 2
|
|-
| style="background: green" | Yes
| EMMC_CLKCTL
| 0x10006024
| 2
|
|-
| style="background: green" | Yes
| EMMC_BLKLEN
| 0x10006026
| 2
|
|-
| style="background: green" | Yes
| EMMC_OPT
| 0x10006028
| 2
|
|-
| style="background: green" | Yes
| EMMC_FIFO
| 0x10006030
| 2
|
|-
| style="background: green" | Yes
| EMMC_RESET
| 0x100060E0
| 2
|
|-
|}

The IO interface for SDMC/NAND seems to be very similar to the DSi; see libnds for [https://github.com/devkitPro/libnds/blob/master/source/arm7/sdmmc.c sample code] and [https://github.com/devkitPro/libnds/blob/master/include/nds/arm7/sdmmc.h documentation], and GBATEK for [http://problemkaputt.de/gbatek.htm#dsisdmmcioportscommandparamresponsedata better documentation].

3DS SDMC/NAND IO registers are located at 0x10006000 and apparently mirrored at 0x10007000. It seems the 0x10007000 mirror is never used on retail units.

==EMMC_STATUS0==

{| class="wikitable" border="1"
! Bit
! Description
|-
| 3
| SD card removal flag (?) (Set to 1 when SD card is removed)
|-
| 4
| SD card insertion flag (?) (Set to 1 when SD card is inserted)
|-
| 5
| SD card insertion status (0 = missing, 1 = inserted)
|-
|}