3dbrew - User contributions [en]

Talk:News

2011-05-13T02:27:31Z

Matthew: huh what now?

Is the defective by designs campaign really relevant to 3dbrew? Should it really be on the news page? --[[User:Matthew|Matthew]] 06:27, 13 May 2011 (CEST)

Hardware

2011-05-02T09:44:59Z

Matthew: Added very basic wifi info

{{stub}}

== Specifications ==
According to iFixit.com ([http://www.ifixit.com/Teardown/Nintendo-3DS-Teardown/5029/1#s22696 source]):

{| class="wikitable"
! Type !! Name !! Datasheet !! Source
|-
| CPU || Nintendo 1048 0H 2x ARM11 266 || N/A || N/A
|-
| GPU || Digital Media Professionals Pica 200 || N/A || [http://en.wikipedia.org/wiki/PICA200]
|-
| RAM || Fujitsu MB82M8080-07L || [http://crediar.no-ip.com/sg_/download.php?id=d67d1c] || [http://www.ifixit.com/blog/blog/2011/03/28/nintendo-3ds-has-128mb-ram/]
|-
| Storage || Toshiba THGBM2G3P1FBAI8 1GB NAND Flash || N/A || N/A
|-
| Power Management || Texas Instruments PAIC3010B 0AA37DW || N/A || FCC filing
|-
| Gyroscope || Invensense ITG-3270 MEMS Gyroscope || [http://dl-web.dropbox.com/u/20520664/references/PS-ITG-3200-00-01.4.pdf] || --
|-
| Accelerometer || ST Micro 2048 33DH X1MAQ Accelerometer Model LIS331DH || [http://dl.dropbox.com/u/20520664/references/CD00213470.pdf] || --
|-
| Wifi || 802.11b/g Atheros AR6014 || N/A || N/A
|}

== Images ==

=== Front ===

[[Image:CTR_Front.jpg|600px]]

=== NAND pinout ===
[[Image:CTR_NAND_pinout.png]]

User talk:Erant

2011-04-26T01:32:54Z

Matthew:

Why did you delate my change?
I tryed to crash the game,but nothing happened.
So I reported.Though you don't like my edit,There are no meaning to delate the stuf.
And I may know how you search a game exploit.
write long name string or high score input,
and controll PC register.
jump to the address input you want to execute,then boot a bootloader.
bootloader reads data from SD card,which to run homebrew.
foooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooool.

I completely agree with the above user. Why so basement? --[[User:Matthew|Matthew]] 05:32, 26 April 2011 (CEST)

File Formats

2011-04-25T22:11:15Z

Matthew: started the format page

== MPO (Multi-Picture Format) ==
Document describing the file format used in mpo files:
http://www.cipa.jp/english/hyoujunka/kikaku/pdf/DC-007_E.pdf

News/Archive

2011-04-18T00:51:23Z

Matthew: Archiving news articles

*'''28 March 11''' Fixed 3DBrew wiki issues, now fully operational!
*'''18 March 11''' 3DBrew launched.

News

2011-04-18T00:50:37Z

Matthew: max of 4 entries

<noinclude>
==Adding an item==
* Log in to the wiki. Editing is disabled if you don't have an account.
* Add the news event to the top of the list, using this format for the date: <tt><nowiki>'''</nowiki>{{#time: d F y}}<nowiki>''' </nowiki></tt>. Please include the application's creator, version number, and a link to a page on 3DBrew about the application. No external links please.
* '''Move the last entry to the [[:News/Archive|news archive]]. There should be no more than 4 entrees in the list.'''

==Archives==
For older news, see the [[:News/Archive|news archive]].

=== News ===
</noinclude>
*'''16 April 11'''[[DSaveManager|DSaveManager v0.2]] released by [[User:Crediar|crediar]]
*'''6 April 11''' [[DSaveManager|DSaveManager v0.1]] released by [[User:Crediar|crediar]]
*'''4 April 11''' [[3DSaveTool|3DSaveTool v0.2b]] released by [[User:Crediar|crediar]]
*'''2 April 11''' [[3DSaveTool|3DSaveTool v0.1]] released by [[User:Crediar|crediar]]

Savegames

2011-04-17T21:47:16Z

Matthew: spelling mistake

=== Encryption ===

On the 3DS savegames are stored much like on the DS, that is on a FLASH chip in the gamecart. On the DS these savegames were stored in plaintext but on the 3DS a layer of encryption was added. This is highly likely a streamcipher, as the contents of several savegames exhibit the odd behaviour that xor-ing certain parts of the savegame together will result in the plaintext appearing.

The reason this works is because the streamcipher used has a period of 512 bytes. That is to say, it will repeat the same keystream after 512 bytes. The way you encrypt with a streamcipher is you XOR your data with the keystream as it is produced. Unfortunately, if your streamcipher repeats and you are encrypting a known plaintext (in our case, zeroes) you are basically giving away your valuable keystream.

So how do you use this to decrypt a savegame on a 3DS? First off, you chunk up the savegame into 512 byte chunks. Then, you bin these chunks by their contents, discarding any that contain only FF. Now look for the most common chunk. This is your keystream. Now XOR the keystream with your original savegame and you should have a fully decrypted savegame. XOR with the keystream again to produce an encrypted savegame.

=== Wearleveling ===

The 3DS employs a wearleveling scheme on the savegame FLASH chips. This is done through the usage of blockmaps and a journal. The blockmap is located at offset 0 of the flash chip, and is immediately followed by the journal. The initial state is dictated by the blockmap, and the journal is then applied to that.

The blockmap structure is simple:
<pre>
struct header_entry {
uint8_t chksums[8];
uint8_t phys_sec;
uint8_t alloc_cnt;
} __attribute__((__packed__));
</pre>

The journal structure is as follows:
<pre>
struct sector_entry {
uint8_t virt_sec; // Mapped to sector
uint8_t prev_virt_sec; // Physical sector previously mapped to
uint8_t phys_sec; // Mapped from sector
uint8_t prev_phys_sec; // Virtual sector previously mapped to
uint8_t phys_realloc_cnt; // Amount of times physical sector has been remapped
uint8_t virt_realloc_cnt; // Amount of times virtual sector has been remapped
uint8_t chksums[8];
} __attribute__((__packed__));

struct long_sector_entry{
struct sector_entry sector;
struct sector_entry dupe;
uint32_t magic;
}__attribute__((__packed__));
</pre>

With magic being a constant 0x080d6ce0.

=== Partitions ===

There can be multiple partitions on the chip. For some games one is a backup partition, some other games seem to use only one partition, yet other games actually use multiple partitions. Partitions are defined at the start of the de-wearleveled blob. At offset 0x200 into the image, the DIFI blobs start. These 0x130 large blobs describe the partitions. Every DIFI blob describes a partition. In order to find the partitions, you will need the uint32_t at 0x9C into the DIFI blob, and the uint32_t at 0xA4. The uint32_t at 0x9C describes the length of the hash table at the start of the partition, the uint32_t at 0xA4 is the length of the filesystem. Partitions are catted together, so the end of one partition is the beginning of the next. The first partition starts at 0x2000. The hashtable at the start of the partitions describe each in-use block in the partition with a SHA256 of the 0x1000 sized block.

=== Filesystem ===

Savefiles are stored on the FLASH in a custom filesystem called SAVE. SAVE has a header which describes where the various bits of the filesystem live. The most important is the FST or filesystem table. You can find the FST by first finding the file base offset which is the offset to which all the entries in the FST are relative. The file base offset is a uint16_t at 0x58 from the filesystem start. The FST offset is a uint32_t at 0x6C and is in blocks (which are 0x200 bytes large).

Once you've found the FST, parsing it is fairly straightforward.

<pre>
struct fs_entry {
u32 node_cnt;
u8 filename[0x10];
u32 index;
u32 unk1; // magic?
u32 block_offset;
u32 file_size;
u32 unk2;
u32 unk3; // flags and/or date?
u32 unk4;
}
</pre>

The first entry is the root directory, easily identifiable by the node_cnt being larger than 1. The node_cnt includes the root directory itself, so there are node_cnt - 1 files in the root directory. The entries that follow after the root directory are the actual files. Reading them out is as simple as taking the file base offset and adding (block_offset * 0x200) to it.

Example from Super MonkeyBall 3D:
<pre>
0003800: 04000000 21000000 00000000 00000000 ....!...........
0003810: 00000000 00000000 00000000 00000000 ................
0003820: 00000000 00000000 00000000 00000000 ................
0003830: 01000000 736d6233 64732e64 61740000 ....smb3ds.dat..
0003840: 00000000 00000000 d57b1100 05000000 .........{......
0003850: e4060000 00000000 c8cf0008 00000000 ................
0003860: 01000000 6d677265 706c6179 30302e64 ....mgreplay00.d
0003870: 61740000 01000000 d57b1100 09000000 at.......{......
0003880: 1c210000 00000000 cd331000 00000000 .!.......3......
0003890: 01000000 6d677265 706c6179 30312e64 ....mgreplay01.d
00038a0: 61740000 02000000 d57b1100 1a000000 at.......{......
00038b0: 1c210000 00000000 00000000 00000000 .!..............
</pre>
[[セーブデータ|Japanese]]

Home Menu

2011-04-17T20:43:21Z

Matthew:

{{Stub}}
The '''Home Menu''' is the heart of the Nintendo 3DS. From there one can start games, channels, and manage contacts and settings.

== Versions ==
{| class="wikitable"
|-
! Version
! JAP
! USA
! EUR
! Release date
! Changelog
! CDN Availability
! CDN Post Date
|-
| [[1.0.0-0|1.0.0-0]]
| 432
| 432
| 432
| February 26, 2011
| Shipped with 3DS on launch
| Available
| February 18, 2011
|-
| [[1.1.0-1|1.1.0-1]]
| 1472
| 1472
| 1472
| February ?, 2011
| General bug fixes
Added 3D Video title to menu. ("For a Limited Time Only")
| Available
| March 1, 2011
|}

[[Category:Nintendo Software]]

Hardware

2011-04-17T19:15:34Z

Matthew: heresay! (frequencies of cpu/gpu are not known to be fact)

{{stub}}

== Specifications ==
According to iFixit.com ([http://www.ifixit.com/Teardown/Nintendo-3DS-Teardown/5029/1#s22696 source]):

{| class="wikitable"
! Type !! Name !! Datasheet !! Source
|-
| CPU || Nintendo 1048 0H 2x ARM11 266 || N/A || N/A
|-
| GPU || Digital Media Professionals Pica 200 || N/A || [http://en.wikipedia.org/wiki/PICA200]
|-
| RAM || Fujitsu MB82M8080-07L || [http://crediar.no-ip.com/sg_/download.php?id=d67d1c] || [http://www.ifixit.com/blog/blog/2011/03/28/nintendo-3ds-has-128mb-ram/]
|-
| Storage || Toshiba THGBM2G3P1FBAI8 1GB NAND Flash || N/A || N/A
|-
| Power Management || Texas Instruments PAIC3010B 0AA37DW || N/A || FCC filing
|-
| Gyroscope || Invensense ITG-3270 MEMS Gyroscope || [http://dl-web.dropbox.com/u/20520664/references/PS-ITG-3200-00-01.4.pdf] || --
|-
| Accelerometer || ST Micro 2048 33DH X1MAQ Accelerometer Model LIS331DH || [http://dl.dropbox.com/u/20520664/references/CD00213470.pdf] || --
|}

== Images ==

=== Front ===

[[Image:CTR_Front.jpg|600px]]

=== NAND pinout ===
[[Image:CTR_NAND_pinout.png]]

User:Matthew

2011-04-17T08:56:11Z

Matthew: Created page with "My name is Matthew Parlane. I have a 3ds, I am from New Zealand and my friend code is 0344-9330-2337. If you add me, leave your friend code on my discussion page."

My name is Matthew Parlane.
I have a 3ds, I am from New Zealand and my friend code is 0344-9330-2337.

If you add me, leave your friend code on my discussion page.

User talk:Crediar

2011-04-17T08:55:22Z

Matthew:

Good stuff Crediar. I will post you my FC when I get home. Wesperino.

Moin,
würde mich freuen wenn du mich addest:
Simon
3909-7495-9525

Hi! My fc is
1891-1170-7648:
Also I would like to say thank you for all the homebrew you created over the years and I
cant wait to see what you will do with the 3ds;) keep up the amazing work!
Daniel.R
[[User:Smvb64|Smvb64]] 18:31, 10 April 2011 (CEST)

Hi there Crediar, I've been watching you succeed and succeed in the Wii hacking community,
I'm amazed by the things you have accomplished, if we would be able to do 30% of what can be done
to the Wii I'd be more then happy.
FC is 3523 - 2027 - 7900

Nickname is Linus.

Wow, you got a Save Tool out already?! Awesome!
[[User:MrZombax|MrZombax]] 22:57, 5 April 2011 (CEST)

Hi there, Crediar. I have been looking your work on the 3DS. Very good work. I was thinking if you could make a homebrew for DSi to extract and send data to the PC like you did with the Save Tool.

Oh yea, here is my Friend Code 2277-6646-9164

[[User:Kazuma|Kazuma]]

Hi thank you for your work.
My friend code: 1160-9718-1643, thanks
Aliak

The progression of early homebrew is always very interesting stuff.
My friend code is 0044-2836-4738
- SaltyPancakes

Hi,I'm [[メインページ|Matyapiro]].I am Japanese.
My friend code:4339-2455-6521
I confirmed 3DSaveTool ver.0.2b does not work for Japanese Game.
It may be able to find a key,but try to decrypt savefile,an exception has occured.
: Make sure syntax is correct. It crashes if the commandline isn't formatted correctly. You can place filenames in quotes if absolutely necessary.
: '''3dsavetool.exe -x gamesave.sav gamesave_out.sav xorkey.bin'''
: --[[User:Jl12|Jl12]] 13:39, 15 April 2011 (CEST)

I am ctr and your work is awesome. my friend code is 4511-0450-6568 --[[User:Ctr|Ctr]] 23:39, 15 April 2011 (CEST)

0344-9330-2337 --[[User:Matthew|Matthew]]