3dbrew - User contributions [en]

3DS Virtual Console

2020-05-24T21:40:23Z

Owowhatsthis:

There are several types of VC titles: NES/GB/GBC VC titles, SNES VC titles, GameGear VC titles and GBA VC titles.
Except for GBA VC, the games are ran using emulators.

=NES/GB/GBC VC=
An emulator application + VC ROM in the NCCH [[RomFS]] (among other things in the RomFS).

The original emulator builds include support for all these three platforms, not specific to just the included ROM platform. However, releases intended for NES games have a red menu, optional switching between the two controllers, a different X button mapping (B instead of menu), optional [[Download Play]] support, and [http://s27.postimg.org/60v4yuw8z/IMG_20140921_001103.jpg a never used multi-rom support]; while Game Boy versions have a green theme and optional 3D border.

Early builds (of Ambassador NES games at least) did not support savestates.

The emulator officially used for Pokemon games removes savestate support in favor of a Link Cable "implementation" involving hooking the games' network functions according to the patch files. ([https://gbatemp.net/attachments/vc-wireless-link-patch-documentation-txt.72966/ Partial documentation of the patch format])

This emulator includes GBA support, however the GBA emulation for this this is somewhat slow. This was presumably implemented before AGB_FIRM was.

Unlike Wii VC, the 3DS VC ROMs for NES use [http://pastebin.com/KLeWt2W3 the "TNES" header].

==RomFS==
* "rom:/rom/" This directory contains the ROM file(s). Filenames used under here don't matter: the filename is determined by the emulator app by doing a directory read.
* "rom:/shaders/" This directory contains GPU shaders used by the emulator app: .shbin, .csdr, and .obj.
* "rom:/VCM/" This directory contains graphics, audio, and text used by the emulator app.
* "rom:/agb.bin" GBA BIOS.
* "rom:/buildtime.txt" Emulator app build timestamp.
* "rom:/config.ini" Emulator configuration .ini, contains sections for all supported 3DS VC platforms.
* "rom:/<rom_name>.patch" rom_name = filename from the rom directory. This .ini contains patches for the ROM.
* "rom:/shader.shbin" GPU shader.

==Savedata==
The savedata can contain:
* "rsm1.dat": Same format as the below rsm2.dat. Probably used for the "restore-point".
* "rsm2.dat": Current emulator save-state, for storing/loading state at VC-title launch/exit.
* "sav.dat": The actual savedata used by the emulated ROM.
* "SecureValue": The random number used by [[Anti Savegame Restore]]. No known version of the emulator implements both savestates and secure value.
Overwriting sav.dat with 0xFF-bytes doesn't have any affect on the actual emulator. Doing that with most of the rsm*.dat data doesn't crash anything.

=SNES VC=
An emulator application + VC ROM in the NCCH [[RomFS]] (among other things in the RomFS).
SNES VC titles are New 3DS exclusive.

==RomFS==
* "rom:/ErrorMessage/" This directory contains text used by the emulator app.
* "rom:/shader/" This directory contains .shbin GPU shaders used by the emulator app.
* "rom:/VCM/" This directory contains text used by the emulator app.
* "rom:/caravel.bcsar" This file contains audio used by the emulator app.
* "rom:/ctrl_change.arc" This file contains graphics used by the emulator app.
* "rom:/data.bin" This file contains the ROM and other data. See below for documentation.
* "rom:/ErrorMessage.arc" This file contains graphics used by the emulator app.
* "rom:/KTR-XXXX.icn" Copy of the SMDH of the game.
* "rom:/shader.shbin" GPU shader.
* "rom:/nnfont_RectDrawerShader.shbin" GPU shader.
* "rom:/VCM.arc" This file contains graphics used by the emulator app.

===data.bin structure===
The file begins with a header (all values are little-endian):
{| class="wikitable" border="1"
|-
! START
! SIZE
! DESCRIPTION
|-
| 0x00
| 0x4
| Always 0x00000100
|-
| 0x04
| 0x4
| File size
|-
| 0x08
| 0x4
| Always 0x00000030
|-
| 0x0C
| 0x4
| Always 0x00000050
|-
| 0x10
| 0x4
| Start of the ROM (always 0x00000060 in official VC)
|-
| 0x14
| 0x4
| End of the ROM
|-
| 0x18
| 0x4
| Start of the footer region (presumably an index for the PCM audio samples). Matches end of file/file size if PCM data is missing
|-
| 0x1C
| 0x4
| Always 0
|-
| 0x20
| 0x4
| Start of decompressed SDD-1 graphics data region. Matches end of file/file size if no SDD-1 chip is present
|-
| 0x24
| 0x8
| Product ID (KTR-XXXX), determines filenames in savedata
|-
| 0x2C
| 0x4
| Always 0
|-
| 0x30
| 0x1
| Emulation speed in FPS (always 0x3C in official VC)
|-
| 0x31
| 0x3
| ROM size
|-
| 0x34
| 0x1
| Always 0
|-
| 0x35
| 0x3
| Size of the converted PCM audio samples region (starting after ROM). 0 if PCM data is missing
|-
| 0x38
| 0x1
| Always 0
|-
| 0x39
| 0x2
| Footer region size. 0 if PCM data is missing
|-
| 0x3B
| 0x2
| Always 0
|-
| 0x3D
| 0x2
| Preset ID (varies for each game). A full list of know Preset IDs (shared by WiiU/SNESC/Switch SNES emulators) can be found [https://docs.google.com/spreadsheets/d/1PbIPVA4NpFEXs1zk249aR3FSuBTY3r-ajpTq3dP3GnQ here]
|-
| 0x3F
| 0x1
| Always 0x2
|-
| 0x40
| 0x1
| Sound volume
|-
| 0x41
| 0x1
| ROM type (0x15 == HiROM/0x14 == LoROM)
|-
| 0x42
| 0xE
| Always 0
|-
| 0x50
| 0x4
| Always 0x00000003
|-
| 0x54
| 0x4
| Always 0x00000001
|-
| 0x58
| 0x8
| Always 0
|}

The 0x60 header is followed by the SNES ROM, often altered to replace audio samples with pointers to external PCM audio files converted from the game, presumably to speed up emulation (these pointers can be found by looking for "PCMF" in the ROM, as seen on [https://github.com/Plombo/vcromclaim/blob/master/snesrestore.py Wii VC]).
The ROM is then optionally followed by the PCM audio files, by the SDD-1 decompressed graphics data (the emulator doesn't properly emulate the chip, presumably because of hardware constraints) and by a footer which appears to be an index for the PCM audio data.
There are no setting fields for specific cart features, with the exception of Special Chip, and it appears that the emulator has "game presets" stored in its own code, which determines more game-specific settings. The Special Chip can also be enabled by the game Preset ID. Each official VC release has [https://docs.google.com/spreadsheets/d/1PbIPVA4NpFEXs1zk249aR3FSuBTY3r-ajpTq3dP3GnQ/edit#gid=490971147 a different preset ID] in the header. The supported Special Chips are: DSP1, C4 and DSP2.

A similar structure can be found on Wii U, SNES Classic and Switch Mini emulator [https://gist.github.com/anpage/c1085055db0242ea3c7558dab56712a5]

==Savedata==
The savedata contains:
* "KTR-XXXX.cfg": Appears to contain the "preset ID" and possibly more game/save information.
* "KTR-XXXX.vea": Current emulator save-state, for storing/loading state at VC-title launch/exit.
* "KTR-XXXX.ves": The actual savedata used by the emulated ROM.

Filenames are determined in the ROM header.

=GBA VC=
GBA VC is run by [[FIRM|AGB_FIRM]]. RomFS isn't used for GBA VC titles, but can be found empty within GBA VC titles. The NCCH [[ExeFS]] contains the same files as a normal application. The [[ExeFS]]:/.code contains the GBA VC ROM followed by a 0x360 byte long footer.

===Footer===
All values in the GBA VC footer and related structures are little-endian.
{| class="wikitable" border="1"
|-
! START
! SIZE
! DESCRIPTION
|-
| 0x00
| 0x4
| Magic '.CAA'
|-
| 0x04
| 0x4
| Must be 1
|-
| 0x08
| 0x4
| Offset to array of config descriptors
|-
| 0x0C
| 0x4
| Number of config descriptors << 4
|}

====Config descriptor====

{| class="wikitable" border="1"
|-
! START
! SIZE
! DESCRIPTION
|-
| 0x0
| 0x4
| If 1, then this config descriptor is used. If 0, and the following value is not 0, then the GBA VC load fails outright (causes result 0xC900464F). Otherwise, this config descriptor is skipped.
|-
| 0x4
| 0x4
| Offset to config
|-
| 0x8
| 0x4
| Size of config (unused by the function that parses this, which hardcodes the config size (0x324) to memcpy)
|-
| 0xC
| 0x4
| Padding
|}

====Config====

{| class="wikitable" border="1"
|-
! START
! SIZE
! DESCRIPTION
|-
| 0x004
| 0x4
| GBA ROM Filesize
|-
| 0x008
| 0x4
| Save type (see below for supported values and [[ARM7_Registers#ARM7_SAVE_MODE|here]] for details)
|-
| 0x00E
| 0x2
| Sleep mode button combo (utilizes the same bit masks as the [[HID_Registers#HID_PAD|HID_PAD register]], with flipped bits).<br/>If the GBA title supports a button-combo based sleep mode and it's set here, Agbbg spoofs this combo when closing the 3DS' lid to enter proper sleep mode.
|-
| 0x010
| 0x10
| Flash and EEPROM configuration (see the target registers [[ARM7_Registers|here]])
|-
| 0x020
| 0x4
| LCD ghosting (01-FF, lower values equal more ghosting)
|-
| 0x024
| 0x300
| Video LUT (black to full, rgbrgbrgb...)?,<br/>three different types of this data have been observed.
|}

Save types:
* 0x0: EEPROM 8k for < 256 Mbit titles
* 0x1: EEPROM 8k for 256 Mbit titles
* 0x2: EEPROM 64k for < 256 Mbit titles
* 0x3: EEPROM 64k for 256 Mbit titles
* 0x4: Flash 512k (Atmel, ID: 0x3D1F) + RTC
* 0x5: Flash 512k (Atmel, ID: 0x3D1F)
* 0x6: Flash 512k (SST, ID: 0xD4BF) + RTC
* 0x7: Flash 512k (SST, ID: 0xD4BF)
* 0x8: Flash 512k (Panasonic, ID: 0x1B32) + RTC
* 0x9: Flash 512k (Panasonic, ID: 0x1B32)
* 0xA: Flash 1Mbit (Macronix, ID: 0x09C2) + RTC
* 0xB: Flash 1Mbit (Macronix, ID: 0x09C2)
* 0xC: Flash 1Mbit (Sanyo, ID: 0x1362) + RTC
* 0xD: Flash 1Mbit (Sanyo, ID: 0x1362)
* 0xE: SRAM/FRAM 256k

Everything above 0xE results in no save chip and nothing being saved to NAND.

===NAND Savegame===
AGB_FIRM saves its active save memory to NAND on exit, this is then immediately picked up by NATIVE_FIRM on reboot by checking [[CONFIG_Registers#CFG_BOOTENV|CFG_BOOTENV]]. From there, this is verified and copied out to SD (also see below). The savegame format is as follows:
{| class="wikitable" border="1"
|-
! START
! SIZE
! DESCRIPTION
|-
| 0x0
| 0x4
| Magic ('.SAV')
|-
| 0x4
| 0xC
| Always 0xFF
|-
| 0x10
| 0x10
| AES-CMAC of the SHA256 hash of 0x30..0x200 + the entire save itself, keyslot 0x24, keyY from process9 .rodata
|-
| 0x20
| 0x10
| Always 0xFF
|-
|-
| 0x30
| 0x4
| Always 0x1
|-
| 0x34
| 0x4
| Number of times saved (unused?)
|-
| 0x38
| 0x8
| AGB TitleID
|-
| 0x40
| 0x10
| SD card CID from the console the save was made on (verified on load)
|-
| 0x50
| 0x4
| Save start addr (always 0x200)
|-
| 0x54
| 0x4
| Save size
|-
| 0x58
| 0x8
| Always 0xFF (?)
|-
| 0x60
| 0x4
| See [[ARM7_Registers|here]]
|-
| 0x64
| 0x4
| See [[ARM7_Registers|here]]
|-
| 0x68
| 0x198
| Always 0xFF
|}

===NAND Savegame on SD===
A NAND savegame copied to the SD by process9 is identical to its counterpart on the NAND partition, save for the CMAC. For SD copies on retail units, the CMAC is recalculated as the AES-CMAC of the (SHA256 hash of ("CTR-SIGN" + AGB TitleID (little endian) + SHA256 hash of ("CTR-SAV0" + SHA256 hash of (0x30..0x200 + the entire save itself)))), using keyslot 0x30 set up with the keyY from movable.sed. For SD copies on devkit units, the CMAC is recalculated using the SHA256 hash of 0x30..0x200 + the entire save itself, using a different key from process9 .rodata.

3DS Virtual Console

2020-05-24T20:17:26Z

Owowhatsthis: Fix GBA VC savedata info

There are several types of VC titles: NES/GB/GBC VC titles, SNES VC titles, GameGear VC titles and GBA VC titles.
Except for GBA VC, the games are ran using emulators.

=NES/GB/GBC VC=
An emulator application + VC ROM in the NCCH [[RomFS]] (among other things in the RomFS).

The original emulator builds include support for all these three platforms, not specific to just the included ROM platform. However, releases intended for NES games have a red menu, optional switching between the two controllers, a different X button mapping (B instead of menu), optional [[Download Play]] support, and [http://s27.postimg.org/60v4yuw8z/IMG_20140921_001103.jpg a never used multi-rom support]; while Game Boy versions have a green theme and optional 3D border.

Early builds (of Ambassador NES games at least) did not support savestates.

The emulator officially used for Pokemon games removes savestate support in favor of a Link Cable "implementation" involving hooking the games' network functions according to the patch files. ([https://gbatemp.net/attachments/vc-wireless-link-patch-documentation-txt.72966/ Partial documentation of the patch format])

This emulator includes GBA support, however the GBA emulation for this this is somewhat slow. This was presumably implemented before AGB_FIRM was.

Unlike Wii VC, the 3DS VC ROMs for NES use [http://pastebin.com/KLeWt2W3 the "TNES" header].

==RomFS==
* "rom:/rom/" This directory contains the ROM file(s). Filenames used under here don't matter: the filename is determined by the emulator app by doing a directory read.
* "rom:/shaders/" This directory contains GPU shaders used by the emulator app: .shbin, .csdr, and .obj.
* "rom:/VCM/" This directory contains graphics, audio, and text used by the emulator app.
* "rom:/agb.bin" GBA BIOS.
* "rom:/buildtime.txt" Emulator app build timestamp.
* "rom:/config.ini" Emulator configuration .ini, contains sections for all supported 3DS VC platforms.
* "rom:/<rom_name>.patch" rom_name = filename from the rom directory. This .ini contains patches for the ROM.
* "rom:/shader.shbin" GPU shader.

==Savedata==
The savedata can contain:
* "rsm1.dat": Same format as the below rsm2.dat. Probably used for the "restore-point".
* "rsm2.dat": Current emulator save-state, for storing/loading state at VC-title launch/exit.
* "sav.dat": The actual savedata used by the emulated ROM.
* "SecureValue": The random number used by [[Anti Savegame Restore]]. No known version of the emulator implements both savestates and secure value.
Overwriting sav.dat with 0xFF-bytes doesn't have any affect on the actual emulator. Doing that with most of the rsm*.dat data doesn't crash anything.

=SNES VC=
An emulator application + VC ROM in the NCCH [[RomFS]] (among other things in the RomFS).
SNES VC titles are New 3DS exclusive.

==RomFS==
* "rom:/ErrorMessage/" This directory contains text used by the emulator app.
* "rom:/shader/" This directory contains .shbin GPU shaders used by the emulator app.
* "rom:/VCM/" This directory contains text used by the emulator app.
* "rom:/caravel.bcsar" This file contains audio used by the emulator app.
* "rom:/ctrl_change.arc" This file contains graphics used by the emulator app.
* "rom:/data.bin" This file contains the ROM and other data. See below for documentation.
* "rom:/ErrorMessage.arc" This file contains graphics used by the emulator app.
* "rom:/KTR-XXXX.icn" Copy of the SMDH of the game.
* "rom:/shader.shbin" GPU shader.
* "rom:/nnfont_RectDrawerShader.shbin" GPU shader.
* "rom:/VCM.arc" This file contains graphics used by the emulator app.

===data.bin structure===
The file begins with a header (all values are little-endian):
{| class="wikitable" border="1"
|-
! START
! SIZE
! DESCRIPTION
|-
| 0x00
| 0x4
| Always 0x00000100
|-
| 0x04
| 0x4
| File size
|-
| 0x08
| 0x4
| Always 0x00000030
|-
| 0x0C
| 0x4
| Always 0x00000050
|-
| 0x10
| 0x4
| Start of the ROM (always 0x00000060 in official VC)
|-
| 0x14
| 0x4
| End of the ROM
|-
| 0x18
| 0x4
| Start of the footer region (presumably an index for the PCM audio samples). Matches end of file/file size if PCM data is missing
|-
| 0x1C
| 0x4
| Always 0
|-
| 0x20
| 0x4
| Start of decompressed SDD-1 graphics data region. Matches end of file/file size if no SDD-1 chip is present
|-
| 0x24
| 0x8
| Product ID (KTR-XXXX), determines filenames in savedata
|-
| 0x2C
| 0x4
| Always 0
|-
| 0x30
| 0x1
| Emulation speed in FPS (always 0x3C in official VC)
|-
| 0x31
| 0x3
| ROM size
|-
| 0x34
| 0x1
| Always 0
|-
| 0x35
| 0x3
| Size of the converted PCM audio samples region (starting after ROM). 0 if PCM data is missing
|-
| 0x38
| 0x1
| Always 0
|-
| 0x39
| 0x2
| Footer region size. 0 if PCM data is missing
|-
| 0x3B
| 0x2
| Always 0
|-
| 0x3D
| 0x2
| Preset ID (varies for each game). A full list of know Preset IDs (shared by WiiU/SNESC/Switch SNES emulators) can be found [https://docs.google.com/spreadsheets/d/1PbIPVA4NpFEXs1zk249aR3FSuBTY3r-ajpTq3dP3GnQ here]
|-
| 0x3F
| 0x1
| Always 0x2
|-
| 0x40
| 0x1
| Sound volume
|-
| 0x41
| 0x1
| ROM type (0x15 == HiROM/0x14 == LoROM)
|-
| 0x42
| 0xE
| Always 0
|-
| 0x50
| 0x4
| Always 0x00000003
|-
| 0x54
| 0x4
| Always 0x00000001
|-
| 0x58
| 0x8
| Always 0
|}

The 0x60 header is followed by the SNES ROM, often altered to replace audio samples with pointers to external PCM audio files converted from the game, presumably to speed up emulation (these pointers can be found by looking for "PCMF" in the ROM, as seen on [https://github.com/Plombo/vcromclaim/blob/master/snesrestore.py Wii VC]).
The ROM is then optionally followed by the PCM audio files, by the SDD-1 decompressed graphics data (the emulator doesn't properly emulate the chip, presumably because of hardware constraints) and by a footer which appears to be an index for the PCM audio data.
There are no setting fields for specific cart features, with the exception of Special Chip, and it appears that the emulator has "game presets" stored in its own code, which determines more game-specific settings. The Special Chip can also be enabled by the game Preset ID. Each official VC release has [https://docs.google.com/spreadsheets/d/1PbIPVA4NpFEXs1zk249aR3FSuBTY3r-ajpTq3dP3GnQ/edit#gid=490971147 a different preset ID] in the header. The supported Special Chips are: DSP1, C4 and DSP2.

A similar structure can be found on Wii U, SNES Classic and Switch Mini emulator [https://gist.github.com/anpage/c1085055db0242ea3c7558dab56712a5]

==Savedata==
The savedata contains:
* "KTR-XXXX.cfg": Appears to contain the "preset ID" and possibly more game/save information.
* "KTR-XXXX.vea": Current emulator save-state, for storing/loading state at VC-title launch/exit.
* "KTR-XXXX.ves": The actual savedata used by the emulated ROM.

Filenames are determined in the ROM header.

=GBA VC=
GBA VC is run by [[FIRM|AGB_FIRM]]. RomFS isn't used for GBA VC titles, but can be found empty within GBA VC titles. The NCCH [[ExeFS]] contains the same files as a normal application. The [[ExeFS]]:/.code contains the GBA VC ROM followed by a 0x360 byte long footer.

===Footer===
All values in the GBA VC footer and related structures are little-endian.
{| class="wikitable" border="1"
|-
! START
! SIZE
! DESCRIPTION
|-
| 0x00
| 0x4
| Magic '.CAA'
|-
| 0x04
| 0x4
| Must be 1
|-
| 0x08
| 0x4
| Offset to array of config descriptors
|-
| 0x0C
| 0x4
| Number of config descriptors << 4
|}

====Config descriptor====

{| class="wikitable" border="1"
|-
! START
! SIZE
! DESCRIPTION
|-
| 0x0
| 0x4
| If 1, then this config descriptor is used. If 0, and the following value is not 0, then the GBA VC load fails outright (causes result 0xC900464F). Otherwise, this config descriptor is skipped.
|-
| 0x4
| 0x4
| Offset to config
|-
| 0x8
| 0x4
| Size of config (unused by the function that parses this, which hardcodes the config size (0x324) to memcpy)
|-
| 0xC
| 0x4
| Padding
|}

====Config====

{| class="wikitable" border="1"
|-
! START
! SIZE
! DESCRIPTION
|-
| 0x004
| 0x4
| GBA ROM Filesize
|-
| 0x008
| 0x4
| Save type (see below)
|-
| 0x020
| 0x4
| LCD ghosting (01-FF, lower values equal more ghosting)
|-
| 0x024
| 0x300
| Video LUT (black to full, rgbrgbrgb...)?,<br/>three different types of this data have been observed.
|}

Save types:
* 0x0: EEPROM 8k for < 256 Mbit games
* 0x1: EEPROM 8k for 256 Mbit games
* 0x2: EEPROM 64k for < 256 Mbit games
* 0x3: EEPROM 64k for 256 Mbit games
* 0x4: Flash 512k (Atmel, ID: 0x3D1F) + RTC
* 0x5: Flash 512k (Atmel, ID: 0x3D1F)
* 0x6: Flash 512k (SST, ID: 0xD4BF) + RTC
* 0x7: Flash 512k (SST, ID: 0xD4BF)
* 0x8: Flash 512k (Panasonic, ID: 0x1B32) + RTC
* 0x9: Flash 512k (Panasonic, ID: 0x1B32)
* 0xA: Flash 1Mbit (Macronix, ID: 0x09C2) + RTC
* 0xB: Flash 1Mbit (Macronix, ID: 0x09C2)
* 0xC: Flash 1Mbit (Sanyo, ID: 0x1362) + RTC
* 0xD: Flash 1Mbit (Sanyo, ID: 0x1362)
* 0xE: SRAM/FRAM 256k

Everything above 0xE results in no save chip and nothing being saved to NAND.

===NAND Savegame===
AGB_FIRM saves its active save memory to NAND on exit, this is then immediately picked up by NATIVE_FIRM on reboot by checking [[CONFIG_Registers#CFG_BOOTENV|CFG_BOOTENV]]. From there, this is verified and copied out to SD (also see below). The savegame format is as follows:
{| class="wikitable" border="1"
|-
! START
! SIZE
! DESCRIPTION
|-
| 0x0
| 0x4
| Magic ('.SAV')
|-
| 0x4
| 0xC
| Always 0xFF
|-
| 0x10
| 0x10
| AES-CMAC of the SHA256 hash of 0x30..0x200 + the entire save itself, keyslot 0x24, keyY from process9 .rodata
|-
| 0x20
| 0x10
| Always 0xFF
|-
|-
| 0x30
| 0x4
| Always 0x1
|-
| 0x34
| 0x4
| Number of times saved (unused?)
|-
| 0x38
| 0x8
| AGB TitleID
|-
| 0x40
| 0x10
| SD card CID from the console the save was made on (verified on load)
|-
| 0x50
| 0x4
| Save start addr (always 0x200)
|-
| 0x54
| 0x4
| Save size
|-
| 0x58
| 0x8
| Always 0xFF (?)
|-
| 0x60
| 0x4
| See [[ARM7_Registers|here]]
|-
| 0x64
| 0x4
| See [[ARM7_Registers|here]]
|-
| 0x68
| 0x198
| Always 0xFF
|}

===NAND Savegame on SD===
A NAND savegame copied to the SD by process9 is identical to its counterpart on the NAND partition, save for the CMAC. For SD copies on retail units, the CMAC is recalculated as the AES-CMAC of the (SHA256 hash of ("CTR-SIGN" + AGB TitleID (little endian) + SHA256 hash of ("CTR-SAV0" + SHA256 hash of (0x30..0x200 + the entire save itself)))), using keyslot 0x30 set up with the keyY from movable.sed. For SD copies on devkit units, the CMAC is recalculated using the SHA256 hash of 0x30..0x200 + the entire save itself, using a different key from process9 .rodata.

ARM7 Registers

2020-05-24T19:59:11Z

Owowhatsthis: Fix ARM7 AGB-related info

The 3DS utilizes an onboard ARM7 core to handle <code>TWL_FIRM</code> and <code>AGB_FIRM</code>'s ARM7 requirements. This is due to the fact that much of the hardware used by both ARM7 and ARM9 is (evidently) not physically hooked up to ARM11. Thus, ARM11 cannot simply emulate ARM7.

ARM7 has the GBA BIOS implemented in hardware. The BIOS is completely identical to the original GBA BIOS. The system is booted silently by calling <code>SWI 0x1</code> (a.k.a. <code>RegisterRamReset</code>), followed by jumping to the code that does <code>SWI 0x0</code> (a.k.a. <code>SoftReset</code>) to finish booting. The boot splash is still in BIOS, however, and can be seen by calling or replacing one of the previous interrupts with <code>SWI 0x26</code> (a.k.a. <code>HardReset</code>).

==Registers==
ARM9 interfaces with the ARM7 through the following registers:

{| class="wikitable"
|-
! Type
! Address
! Name
! Size (bytes)
|-
| <code>u8</code>
| <code>0x10018000</code>
| <code>ARM7_CNT</code>
| 1
|-
| Code
| <code>0x10018080</code>
| <code>ARM7_CODE</code>
| 32
|-
| <code>u16</code>
| <code>0x10018100</code>
| <code>ARM7_SAVE_MODE</code>
| 2
|-
| <code>u16</code>
| <code>0x10018104</code>
| <code>ARM7_SAVE_MEMORY_CNT</code>
| 2
|-
| <code>u16</code>
| <code>0x10018108</code>
| <code>ARM7_RTC_CNT</code>
| 2
|-
| <code>u32</code>
| <code>0x10018110</code>
| <code>ARM7_RTC_VAL_DATE</code>
| 4
|-
| <code>u32</code>
| <code>0x10018114</code>
| <code>ARM7_RTC_VAL_TIME</code>
| 4
|-
| <code>u32</code>
| <code>0x10018118</code>
| <code>ARM7_RTC_VAL_SETTINGS</code>
| 4
|-
| <code>u32</code>
| <code>0x1001811C</code>
| <code>ARM7_RTC_VAL_ADJUST</code>
| 4
|-
| <code>u32</code>
| <code>0x10018120</code>
| <code>ARM7_SAVE_FLASH_CHIP_ERASE_CYCLES</code>
| 4
|-
| <code>u32</code>
| <code>0x10018124</code>
| <code>ARM7_SAVE_FLASH_SECTOR_ERASE_CYCLES</code>
| 4
|-
| <code>u32</code>
| <code>0x10018128</code>
| <code>ARM7_SAVE_FLASH_PROGRAM_CYCLES</code>
| 4
|-
| <code>u32</code>
| <code>0x1001812C</code>
| <code>ARM7_SAVE_EEPROM_WRITE_CYCLES</code>
| 4
|}

===ARM7_CNT===
This seems to control the mode of the ARM7. 1 = TWL, 2 = GBA.

===ARM7_CODE===
This region is an arm7 bootrom overlay, over the vector table at address 0. Once the ARM7 is taken out of reset by <code>TwlProcess9</code>, the reset vector will be jumped to, beginning execution. <code>TwlProcess9</code> uses this to put ARM7 in a loop (TWL), and to set the <code>POSTFLG</code> and branch to more copied code (GBA). Execution is started by writing <code>0x8001</code> to [[CONFIG11_Registers#CFG11_TWLMODE_0|CFG11_TWLMODE_0]] after setting the mode via <code>ARM7_CNT</code>. Later, this overlay is disabled by the ARM7 via the "biosprot" register (0x04000308).

Reading uninitialized data in this 32-byte region leads to both screens displaying solid green (exception), and the CPU locking up.

===ARM7_SAVE_MODE===
This tells the save storage emulation hardware which device type to emulate (64k EEPROM, a 512k Flash chip model, and SRAM are all that have been used officially; several other 512k Flash chip models, two 1 Mbit Flash chip models and 4k EEPROM are also supported). This comes directly from the [[3DS_Virtual_Console#Footer|ROM footer]].

===ARM7_SAVE_MEMORY_CNT===
This register controls whether the GBA save memory region located at <code>0x08080000</code> is accessible to ARM9 or to the ARM7 (via the emulated save chip). When it's set to 0x0 ARM7 has access, while ARM9 has access when it's set to 0x1.

===ARM7_RTC_CNT===
This register controls the emulated RTC hardware and access to some of its registers.
To set or read the data from ARM7_RTC_VAL_SETTINGS or ARM7_RTC_VAL_ADJUST, first <code>ARM7_RTC_CNT</code>'s bit 15 is waited on. Next <code>ARM7_RTC_CNT</code> is set to zero.

For a write: the two registers are written, a 1 is written to <code>ARM7_RTC_CNT</code>, and it is waited on the same as before. Afterwards if bit 14 is not set in <code>ARM7_RTC_CNT</code>, the value was set successfully. This also starts the emulated RTC.

For a read: a 2 is written to <code>ARM7_RTC_CNT</code>, it's waited on again. Afterwards, if bit 14 is not set, the aforementioned registers can be read. Presumably the hardware can be re-enabled by writing a zero to <code>ARM7_RTC_CNT</code> at this point, but <code>AGB_FIRM</code> does not.

===ARM7_RTC_VAL_DATE / ARM7_RTC_VAL_TIME===
These registers are set to the current LgyP9 date+time before the other RTC-related registers are used.
They contain the following structure, set up on the stack then both u32 registers are written one after the other:

s8 year_since_2000_bcd;
s8 month_bcd;
s8 day_bcd;
s8 day_of_week;
s8 hour_bcd;
s8 minute_bcd;
s8 second_bcd;

===ARM7_RTC_VAL_SETTINGS===
This register appears to contain the emulated RTC chip's configuration (accessible via the "control" register on real hardware), containing settings like 12/24-hour mode. Access is controlled by <code>ARM7_RTC_CNT</code> (see above).

===ARM7_RTC_VAL_ADJUST===
This register appears to contain the emulated RTC chip's time difference, relative to <code>ARM7_RTC_VAL_DATE</code> / <code>ARM7_RTC_VAL TIME</code>, in seconds. Access is controlled by <code>ARM7_RTC_CNT</code> (see above).

===ARM7_SAVE_FLASH_CHIP_ERASE_CYCLES===
This register seems to configure the emulated Flash chip to take a specified amount of time to complete a chip erase operation (relative to the DS' ARM7/bus speed). Two variations exist in officially released games, one meant for 512k Flash chips and one for 1 Mbit Flash chips. It is copied from from rom footer + <code>0x10</code>.

===ARM7_SAVE_FLASH_SECTOR_ERASE_CYCLES===
This register seems to configure the emulated Flash chip to take a specified amount of time to complete a sector erase operation (relative to the DS' ARM7/bus speed). Two variations exist in officially released games, one meant for 512k Flash chips and one for 1 Mbit Flash chips. It is copied from from rom footer + <code>0x14</code>.

===ARM7_SAVE_FLASH_PROGRAM_CYCLES===
This register seems to configure the emulated Flash chip to take a specified amount of time to complete a program operation (relative to the DS' ARM7/bus speed). Two variations exist in officially released games, one meant for 512k Flash chips and one for 1 Mbit Flash chips. It is copied from from rom footer + <code>0x18</code>.

===ARM7_SAVE_EEPROM_WRITE_CYCLES===
This register seems to configure the emulated EEPROM chip to take a specified amount of time to complete a write operation (relative to the DS' ARM7/bus speed). Two variations exist in officially released games, one meant for 64k EEPROM chips and one for 4k EEPROM chips. It is copied from from rom footer + <code>0x1C</code>.

==Memory map==
The virtual memory mapping for the ARM7 is the same as for the [[Memory_layout#TWL_FIRM_Userland_Memory|other core]]. However, it has additional internal memory mapped to it. Interestingly enough, much of this memory seems to lie within ARM9's own internal memory.

* <code>0x08060000</code> → <code>0x03800000</code>, ARM7 WRAM (64KiB)
* <code>0x080B0000</code> → <code>0x03000000</code>, GBA IWRAM (32KiB)
* <code>0x08080000</code> → EEPROM/SRAM/Flash 512k/Flash 1Mbit (the 2 512k banks are contiguous in memory). Access is controlled by <code>ARM7_SAVE_MEMORY_CNT</code> (see above). <code>0x080C0000</code> holds a mirror which is used by LgyP9 on boot to read the SD savedata before the mode switch, the data is then copied.
* <code>0x01FFC000</code> → <code>0x01000000</code>, ARM9 ITCM under TWL (16KiB)