3dbrew - User contributions [en]

Bootloader

2023-07-04T19:03:39Z

Cooolgamer: added hardware failure indications

The bootloader is the binary code stored in the ARM9 and ARM11 boot ROMs and hence is ran when the 3DS is powered on. Its purpose is initializing hardware and loading the [[FIRM|system firmware]] from the internal [[Flash_Filesystem|NAND memory]]..

Besides NATIVE_FIRM, the bootloader is also capable of booting other firmwares (such as TWL_FIRM and AGB_FIRM). However, this will result either in a Japanese error screen or a system shutdown, directly after FIRM Launching.

== Boot ROM ==
Upon boot, parts of the ARM9 and ARM11 boot ROMs are protected by writing to [[CONFIG#CFG_SYSPROT9|CFG_SYSPROT9]] and [[CONFIG#CFG_SYSPROT11|CFG_SYSPROT11]], respectively. The ARM9 and ARM11 boot ROMs are identical for all 3DS consoles (3DS, 3DS XL, 2DS, New 3DS, New 3DS XL, New 2DS XL)

== NAND FIRM boot ==
Boot9 is not hardcoded to only handle 2 FIRM partitions: it parses all 8 NCSD partitions for this. Boot9 will attempt to use every partition listed in the NCSD which is an actual FIRM partition, in the same order listed in the NCSD, until booting one of them succeeds. Among the not-yet-processed partitions, the FIRM which has the highest value at u32 firmhdr+4 will have a FIRM-boot attempted first. Since that value is normally 0x0, the order of FIRM-partition processing is normally identical to the order of the NCSD partitions.

Boot9 is hard-coded for using [[AES_Registers|AES]] keyslot 0x6 for NAND crypto.

== Non-NAND FIRM boot ==
Boot9 can also boot from non-NAND. For this, a different set of RSA pubks are used(separate pubks for retail/devunit like NAND). The spiflash FIRM image for this is also encrypted with AES-CBC using a normal key stored in prot_boot9(separate for retail/devunit). This encryption is basically used instead of what is used for NAND-firm-partitions. This encryption is only used for the FIRM sections, the FIRM header is used raw. The AES keyslot for this is only overwritten afterwards when booting from non-NAND fails. AES keyslot 0x3F is used for this.

CTR_word[0] = firmimageoffset;//FIRM section offset from FIRM header
CTR_word[1] = outbufaddr;//FIRM section load addr
CTR_word[2] = readsize;//FIRM section size
CTR_word[3] = readsize;//FIRM section size

When booting from NAND fails, boot9 will then attempt to boot from Wifi SPI-flash(this only triggers when the wifi module hw is properly accessible/connected, which is normally the case). The base offset for spiflash FIRM is 0x400. Note that this region(all data prior to offset 0x1F300) is write-protected by the spiflash(not writable from 3DS-mode / DS-mode).

Additionally, if the shell is closed and a special key combination (Start + Select + X) is held, boot9 will attempt to boot from an inserted NTR cartridge before booting from NAND. Note: While normally on O3DS/2DS the console will not turn on if the shell is closed (or this is faked by holding a magnet to the console), when this special key combination is held holding down the power button will cause boot to occur anyway.

For non-NAND booting, NCSD / FIRM-backup is not used.

== SDMMC ==

Boot9 has code implemented for using SD(HC) cards, but the input deviceids used by boot9 for those functions are hard-coded for NAND. However, it is possible to use an SD(HC) card in place of the NAND if the NAND chip is first disconnected, and an SD card connected to the bus. Due to the CID being different, partitions will need to be re-encrypted and TWL mode will not work, due to the MBR being in the NCSD header. Using sighax, it may be possible to replace the NCSD header.

== Boot9 RSA keyslots ==

The following are initialized during main() startup, by initialize_rsakeyslots_pubk(). Each of these, for the ones which are actually set, have different keydata for retail/devunit.
* 0: Not set.
* 1: Used for the NAND FIRM signature.
* 2: Used for the non-NAND-FIRM signature.
* 3: Used for the NAND-NCSD FIRM signature.

When FIRM loading is successful, initialize_x07ffbd00_x07ffc100_rsakeyslotsprivk() is called, right before calling the final function in main(). Besides ITCM writing, this overwrites all 4 RSA keyslots with modulus + private-exponents loaded from boot9 data.

initialize_x07ffbd00_x07ffc100_rsakeyslotsprivk():
This initializes the 4 0x100-byte/0x200-byte chunks at 0x07ffb800+0x500(0x07ffbd00)/0x07ffb800+0x900(0x07ffc100). End address of the first section is 0x07ffc100(start addr of the second section), end address of the second section is 0x07ffc900. Hence, the first section total size is 0x400-bytes, while the second section total size is 0x800-bytes.

These are initialized using via the boot9 data image, with ptrs from DTCM. Seperate keydata is used for retail/devunit.

When initializing the first ITCM area: rsa_setkeyslot_privk() is called for all 4 RSA keyslots. The modulo for each one is also copied to (index*0x100) + 0x07ffb800 + 0x500. The private exponent is not copied into ITCM.

The second ITCM area is initialized by copying 4 0x200-byte entries in a loop. These are RSA pubks+privks, which Boot9 doesn't use itself at all besides this copy loop.

== Boot9 image data memory layout ==
0xffffb088 is the beginning of the boot9 image data section.

* 0xffffb088 size 0x38-bytes: This is the array used during FIRM-section-loading for the memory-range blacklist for FIRM sections.
* 0xffffb0c0(end-addr of the above area) size 0x20-bytes: Unknown.
* 0xffffb0e0(end-addr of the above area) size 0x2f80-bytes: This is *all* of the keys stored in the image.
* 0xffffe060(end addr of the above key-area) size 0x230-bytes: This is the initial DTCM image @ 0xFFF00000, see below.
* 0xffffe290(DTCM_image_end) - {boot9 image end}: All-zero.

Layout of the 0x2f80-byte key-area at 0xffffb0e0:
* 0xffffb0e0 size 0x2600-bytes: This is the RSA key-data, see below.
* 0xffffd6e0(end-addr of the above area) size 0x40-bytes: This is the keydata used for crypting the entire OTP with keyslot 0x3f, used by main(). The first 0x20-bytes is for retail, the remaining 0x20-bytes starting at 0xffffd700 is for devunit. Chunk+0(retail=0xffffd6e0 devunit=0xffffd700) is the normalkey, chunk+0x10(retail=0xffffd6f0 devunit=0xffffd710) is the AES-IV.
* ...
* 0xffffd760: size 0x100-bytes: First 0x80-bytes is for retail, the remaining 0x80-bytes at 0xffffd7e0 is for devunit. This 0x80-byte block is copied to 0x07ffcd00 by a Boot9 function, however, that code actually does the copy in two 0x40-bytes chunks.
* 0xffffd860(end-addr of the above area) size 0x400-bytes: This is the bootrom_dataptr passed to the aes-keyinit function for retail. See the below Tools section for how this is processed.
* 0xffffdc60(end-addr of the above area) size 0x400-bytes: This is the devunit version of the above the 0x400-byte chunk. This is very last chunk of data in the boot9 data-section key-area: end addr for this area is 0xffffe060.

Layout of the 0x2600-byte RSA key-data at 0xffffb0e0:
First 0x1300-bytes is for retail, the remaining 0x1300-bytes starting at 0xffffc3e0 is for devunit.
* +0x0 retail=0xffffb0e0 devunit=0xffffc3e0: RSA modulo for keyslot3, initialized by initialize_rsakeyslots_pubk().
* +0x100 retail=0xffffb1e0 devunit=0xffffc4e0: RSA modulo for keyslot1, initialized by initialize_rsakeyslots_pubk().
* +0x200 retail=0xffffb2e0 devunit=0xffffc5e0: RSA modulo for keyslot2, initialized by initialize_rsakeyslots_pubk().
* +0x300 size 0x200, retail=0xffffb3e0 devunit=0xffffc6e0: First 0x100-bytes is the RSA modulo, then the following 0x100-bytes is the RSA privk(private-exponent). This is for RSA-engine keyslot0 with initialize_x07ffbd00_x07ffc100_rsakeyslotsprivk(), which also copies this modulo to the array starting at 0x07ffbd00.
* +0x500 size 0x200, retail=0xffffb5e0 devunit=0xffffc8e0: Used the same as the above block except for slot1.
* +0x700 size 0x200, retail=0xffffb7e0 devunit=0xffffcae0: Used the same as the above block except for slot2.
* +0x900 size 0x200, retail=0xffffb9e0 devunit=0xffffcce0: Used the same as the above block except for slot3.
* +0xb00 size 0x200, retail=0xffffbbe0 devunit=0xffffcee0: First 0x100-bytes is the RSA modulo, then the following 0x100-bytes is the RSA privk(private-exponent). The 0x200-bytes here is copied to slot0 in the array at 0x07ffc100 by initialize_x07ffbd00_x07ffc100_rsakeyslotsprivk().
* +0xd00 size 0x200, retail=0xffffbde0 devunit=0xffffd0e0: Used the same as the above block except for slot1.
* +0xf00 size 0x200, retail=0xffffbfe0 devunit=0xffffd2e0: Used the same as the above block except for slot2.
* +0x1100 size 0x200, retail=0xffffc1e0 devunit=0xffffd4e0: Used the same as the above block except for slot3.

== Boot9 DTCM layout ==
Most of this is just ptrs / other unknown data, not actual keys. However, there is an unknown 0x10-byte block @ +0x124(there's a ptr initialized for this block elsewhere).

== Boot11 image data memory layout ==
* 0x0001817c..0x000181f4 size 0x78-bytes: This is the bootrom error screen font gfx data. This begins at the exact end-address of the crt0 code, the rest of the protected boot11 code begins at this end-address(0x000181f4). To extract the font gfx data from there, the 30 dwords at this address need to be converted to big endian. The correct resolution (when displayed as raw) is 32x30x1. The bootrom font looks very similar to [https://robey.lag.net/2010/01/23/tiny-monospace-font.html this font].
* 0x00019400 is the beginning of the boot11 data area, the first 8-bytes here are unknown.
* 0x00019408..0x0001b498 size 0x2090-bytes: This is the blowfish keydata which gets copied to arm9itcm_twlkeydata+0x3e0 later.
* 0x0001c498..0x0001c4f8 size 0x60-bytes: This is the data which eventually gets copied to arm9itcm_twlkeydata+0x380.
* 0x0001c4f8..0x0001c538 size 0x40-bytes: This is the data which eventually gets copied to arm9itcm_twlkeydata+0x340.
* 0x0001c538..0x0001c578 size 0x40-bytes: This is the data which eventually gets copied to arm9itcm_twlkeydata+0x300.
* 0x0001c578..0x0001c5f8 size 0x80-bytes: This is the data which eventually gets copied to arm9itcm_twlkeydata+0x280.
* 0x0001c5f8..0x0001c678 size 0x80-bytes: This is the data which eventually gets copied to arm9itcm_twlkeydata+0x0.
* 0x0001c678..0x0001c878 size 0x200-bytes: This is the data which eventually gets copied to arm9itcm_twlkeydata+0x80.
* 0x0001c878..0x0001d078 size 0x800-bytes: These are the 3DS RSA-2048 modulus which are eventually copied to arm9_itcm+0x4900: on retail the first 4 are copied there by boot9, on devunit the last 4 are copied to itcm.
* 0x0001d078 size 0x120-bytes is the initial data for the .data section @ 0x1ffe8000, this is the very end of the protected arm11-bootrom.

== AES keys ==
See the Tools section for how Boot9 initializes the keyslots.

See also [[AES_Registers|here]].

For an issue with console-unique key-init, see [[OTP_Registers|here]].

== BootROM Errors ==
Sample error-screen(where firm0+firm1 RSA signatures were corrupted):

BOOTROM 8046
ERRCODE: 00F800FF
DEDEFFFF FFFFFFFF
00000000 00000000

* 1st line is: <code>print_string(..., "BOOTROM %X", 0x8046);//This last param comes from the .pool.</code>
* 2nd line is: <code>print_string(..., "ERRCODE: %08X", *((unsigned int*)(0x1FFFE000+0xC)));//See below memory notes.</code>
* 3rd line is: <code>print_string(..., "%08X %08X", *((unsigned int*)(0x1FFFE000+0x10))`, `*((unsigned int*)(0x1fffe000+0x14)));//See below memory notes.</code>
* 4th line is: <code>print_string(..., "%08X %08X",*((unsigned int*)(0x1FFFE000+0x18))`, `*((unsigned int*)(0x1fffe000+0x1C)));//See below memory notes.</code>

== 0x1FFFE000 memory ==
This memory is used by boot9 mainly for sending info to the arm11 for the error-screen. The data in this region is still stored in memory by the time the ARM9+ARM11 jumps to FIRM.

Among boot9/boot11, the 3 words at 0x1FFFE000 seem to be ''only'' accessed by the boot11 function initializing those words.

* u32 0x1FFFE000+0: ARM11 MPCore "Cycle Counter Register (CCNT)".
* u32 0x1FFFE000+4: ARM11 MPCore "Count Register 0 (PMN0)".
* u32 0x1FFFE000+8: ARM11 MPCore "Count Register 1 (PMN0)".
* 8bit-entry-array 0x1FFFE000+0xC: 8bit status-codes initialized by boot9 main(), for the FIRM-boot devices. +0 is NAND, +1 is NTRCARD and +2 is wifi-spiflash.
* ...
* 8bit-entry-array 0x1FFFE000+0x10: Status-codes originally from nand_findfirmpartition_loadfirm(), for each of the 8 NCSD partitions.

== BootROM Status Codes ==
{| class="wikitable" border="1"
|-
! Value
! Description
|-
| 0x00
| Success
|-
| 0xEE(~17)
| NCSD header validation function failed: NCSD magicnum is invalid or RSA verification failed.
|-
| 0xDE(~33)
| FIRM header validation function failed: FIRM magicnum is invalid or RSA verification failed.
|-
| 0xDF(~32)
| Failed to read sector data from the device.
|-
| 0xCF(~48)
| FIRM section validation function failed: FIRM section is invalid.
|-
| 0xF7(~8)
| A NAND FIRM from another partition was already found with a priority(firmhdr+4) >= to the value for the current partition's FIRM priority.
|-
| 0xF8(~7)
| The FIRM magicnum(firmhdr+0) is invalid.
|-
| 0xFF(~0)
| Initial value for each entry in the 8-entry array of status-codes for the NAND NCSD partitions. Indicates that the partition is not a FIRM partition(partition fs type isn't 0x3 or partition fs crypt-type isn't 0x2).
|}

== Boot9 startup ==

0xffff0000 jumps to 0xffff8000. 0xffff8000 is crt0:
* Very first thing this does is clear u8 register 0x10000002 ([[CONFIG_Registers#CFG_RST11|CFG_RST11]]) bit 0 to zero.
* Then sp is initialized for each cpumode, IRQs/FIQs are disabled during the first mode-switch.
* Order of mode-switches + sp initialization: svc-mode = 0xfff04000, irq-mode = 0xfff03f00, system-mode = 0xfff03b00. Hence, the rest of the code following this runs in system-mode.
* Then L_ffff80cc/mpu_init() is called.
* Then L_ffff0038() is called, which initializes the exception-handler addresses @ 0x08000000.
* Then L_ffff81b8() is called(r4 + lr are saved on the DTCM stack), which after calling a memclear function which doesn't do anything, it then clears 0x08000030 size 0x10. Here the DTCM at 0xfff00000 size 0x4000 is cleared.
* Then L_ffff81b4() is called, which branches to DTCM_init(). This copies the initial DTCM data from the Boot9 data image into boot9, then it clears 0xFFF00230 - 0xFFF01AC0.
* Then LT_ffff8228/main is jumped to, with LR set to the address of an infinite-branch-loop instruction.

mpu_init():
* Bitmask 0x000f9005 is cleared in the cp15 control register. MCR instructions which do then following are then executed: flush entire instruction cache, flush entire data cache, and drain write buffer.
* Then the 8 [[Memory_layout|MPU]] memregions are initialized.
* ITCM memregion reg = 0x24: baseaddr=0x0, size = 128MB(0x08000000).
* DTCM memregion reg = 0xfff0000a: baseaddr=0xfff00000, size=16KB(0x00004000).
* Then instruction cachable and data cachable/bufferable bits for the MPU regions are setup.
* Then the instruction/data access permissions for the MPU regions are setup.
* Lastly bitmask 0x0005707d is orred in the cp15 control register.

== Boot9 main() ==

The following functions are called: LT_ffff2024(), LT_ffff1ff8(), pxi_init(), rsa_init(), initialize_rsakeyslots_pubk(), crypto_initialize(), and aesengine_reset().
Then AES keyslot 0x3F is setup: aesengine_setnormalkey(0x3f, 5, ptr) is called. ptr on retail(CFG_UNITINFO check) is 0xffffd6e0, 0xffffd700 for devunit. Then essentially, aesengine_setctr(5, ptr+0x10) is executed.
Then AES keyslot 0x3f is selected.
When calling the following functions, if any of them return zero, it will immediately jump to setting ptr to 0x10012000(otp), otherwise when all of them return non-zero ptr = sp+0x94. otp_decrypt(sp+4), otp_verify(sp+4), initialize_consoleunique_itcm(sp+4, 0x07ffb800).
Then the following is executed: initialize_aeskeys_wrap(ptr, 0x70);
Then sp+4 size 0x100 is cleared to zero.

...

NAND firm-boot code-block is described below. Note that boot9 is basically hard-coded to use deviceid NAND, not SD.
{
timer_updatestoredstate() is called, then the AES keyslot for NAND-FIRM is selected(0x6).
Then LT_ffff56c8() is called, if that returns non-zero the statuscode variable is set to ~2 then it jumps to NAND_BOOTEND.
Then LT_ffff5774(0x201) is called, if that returns non-zero the statuscode variable is set to ~1 then it jumps to NAND_BOOTEND.
Then fsdriver_setup_mmc() is called. Then nand_findfirmpartition_loadfirm(0) is called, with the statuscode variable set to the retval.
Executes a loop which runs 8 times: write the output from get_errorcode_arrayentry_xfff005e8(loopindex) to u8 0x1fffe000+0x10+loopindex(copy the array of 32bit error-codes for all 8 NCSD partitions initialized by nand_findfirmpartition_loadfirm() to the array of 8bit entries at 0x1fffe000+0x10).

NAND_BOOTEND:
Then the statuscode variable is written to u8 0x1fffe000+0xc.
Then LT_ffff5690(0x201, 0x1fffe018, 0x1fffe01c) is called.
Then LT_ffff5644() is called.
Then timer_updatestoredstate() is called.
When statuscode==0 for success, it jumps to FIRMLOAD_END. Otherwise, it continues to the next code-block.
}

Wifi spi-flash firm-boot code-block, executed when no FIRM was loaded successfully so far.
{
timer_updatestoredstate() is called.

Then spi_wififlash_cmdgetstatusreg(sp+0x100) is executed. When bit0 of the output u8 at sp+0x100 is clear, it will continue this code-block, otherwise it will set the statuscode variable to ~1 then jump to SPIFLASH_BOOTEND.
Then fsdriver_setup_wififlash() is called.
Here read_firmhdr_validate_loadfirm(0, 2) is called, with the statuscode variable set to the retval.

SPIFLASH_BOOTEND:
Then the statuscode variable is written to u8 0x1fffe000+0xe.
Then timer_updatestoredstate() is called.
When statuscode==0 for success, it jumps to FIRMLOAD_END. Otherwise, it executes writenormalkey_keyslot3f(), then jumps to FIRMLOAD_FAILURE.
}

FIRMLOAD_END:
Here it calls firmhdr_getarm11_entrypoint() and firmhdr_getarm9_entrypoint(). Immediately after calling each function it checks if the retval is 0, if so it then jumps to FIRMLOAD_FAILURE.
After calling initialize_x07ffbd00_x07ffc100_rsakeyslotsprivk(), it jumps to FIRMLOAD_EXIT.

FIRMLOAD_FAILURE:
Here it clears 0x07ffb800 size 0x3c70 to zero, endaddr = 0x07fff470.
Then it continues to FIRMLOAD_EXIT.

FIRMLOAD_EXIT:
Here firmboot() is called, which should never return. The instruction after this bl is a call for panic().

== Boot11 ==

* ...

main():
LT_1263c();
...
LT_13944()
...
pxi_init();
initializefuncptr_firmboot_start(firmbootbegin_funcptr);
firmboot();
return;

LT_12220/initializefuncptr_firmboot_start
inr0=funcptr
This writes inr0 to address 0x1ffe8028, then returns.
This initializes the funcptr which firmboot() can call after the very first func-call.

LT_13944
if([[I2C_Registers|i2cmcu_readregf]](sp+0)==0)
{
return (*((u8*)0x10147000) >> 4) & 1;//Reads [[GPIO_Registers|GPIO]] when reading I2C fails.
}
Here it basically does "return <byte loaded from sp+0> ^ 0x2". Hence in this case, it will return 0x2 when the system shell is closed(sleep-mode), otherwise 0x0 is returned.

LT_12454/firmboot
This is the arm11 version of the boot9 firmboot() function, like boot9 this is the final function called from main(). The functionality for these two functions are identical, minus addresses.
ptr = firmboot_loadentrypoint11();
funcptr = *(0x1ffe8028);
if(funcptr)funcptr(ptr);
LT_11ffc(ptr);
return;

== Boot Procedure ==

* 0 seconds - unit is powered on. The ARM9 and ARM11 [[Memory_layout|bootroms]] begin execution.
* <= ~1 second - BootROMs fully run, load FIRM, etc. The loaded FIRM begins running.
**The ARM11 sysmodules included with FIRM are launched by ARM11-kernel, etc.
**The [[Process_Manager_Services|PM]] module launches [[NS]].
**If [[Home_Menu#Auto-Boot_Function|auto-booting]] is needed, NS will [[NS#Auto-boot|auto-boot]] titles.
**Otherwise, NS will instead launch [[ErrDisp]] and the [[Configuration Memory#ACTIVEMENUTID|current active menu]] via the PM module. For retail units, this menu is usually the [[Home Menu]]. Note that the PM module first launches the module dependencies when launching a process, prior to actually launching the process.
**The further Home Menu startup process is described [[Home_Menu#Home_Menu_startup|here]]. This includes Home Menu manually launching various sysmodules.

* 4 seconds - the LCD screens are initialized.

* 7 seconds - [[Home Menu]] is fully initialized/loaded.

== NAND Reads during Boot ==
During a successful boot on 6.x, the bootloader (and firm) reads the following sectors from NAND (in this order):
00000000 (NCSD Partition Table)

Only verify 'FIRM' magic? (A second Header-read will be attempted even if everything except the magic is 0xFF...)
0B130000 (FIRM Partition)
0B530000 (Secondary FIRM Partition)

Verify RSA signature and parse Header:
0B130000 (FIRM: Header)
0B130200 (FIRM: Section 1)
0B163E00 (FIRM: Section 2)
0B193E00 (FIRM: Section 3)

00013000 .. Below is probably NATIVE_FIRM booting ..
00014000
00015000
00016000
00017000

09011A00
09011C00
09012000
09012400
...

== Error Codes ==
When the 3DS does not find the NAND chip, the following error is displayed:

[[Image:CTR_Bootrom_Error.jpg|240px]]

{| class="wikitable" border="1"
|-
! Error
! Description
|-
| <tt>00F800FE 00000000 00000000 00000200 00000000</tt>
| Error when having SD-card reader connected to NAND during boot.
|-
| <tt>00F800FE 00000000 00000000 00000400 00000000</tt>
| NAND not found error (?)
|-
| <tt>00F800FE FFFFFFFF FFFFFFFF 00000080 00800000</tt>
| NAND error when DAT1 was used as DAT0.
|-
| <tt>00F800FE FFFFFFFF FFFFFFFF 00000005 00800000</tt>
| NAND error when DAT2 was used as DAT0.
|-
| <tt>00F800FE FFFFFFFF FFFFFFFF 00000005 00000000</tt>
| NAND error when DAT3 was used as DAT0.
|-
| <tt>00F800FF F8F8FFFF FFFFFFFF 00000000 00000000</tt>
| Both the firm0 and firm1 partitions are corrupt (failed signature checks).
|-
| <tt>00F800FF DEDEFFFF FFFFFFFF 00000000 00000000</tt>
| Both the firm0 and firm1 partitions are corrupt (possibly related to certain flags missing?)
|-
| <tt>00F800FF CFCFFFFF FFFFFFFF 00000000 00000000</tt>
| Both the firm0 and firm1 partitions are corrupt
|-
| <tt>00F800EE FFFFFFFF FFFFFFFF 00000000 00000000</tt>
| [[NCSD]] header in sector 0 is corrupt (failed signature check).
|}

== Hardware Failure indications ==
When a hardware failure is detected, a LED indicator is shown.

If you try to replace the screen with the one of a other model, the console will power on, and the screens stays black, but after a minute, the wireless LED will blink four times, stay on for a second, then power off. The blue led is still on, though.

We do not have much info about this as usually, when a hardware failure is detected, crashes or instant power off happens.

== Tools ==
* [https://github.com/yellows8/boot9_tools boot9_tools]

User:Michiru

2023-02-26T09:53:14Z

Cooolgamer: Report

Fake account, this is an impersonation of Michiru, not the real one.

3DS Development Unit GUI

2023-02-26T09:50:27Z

Cooolgamer: Undo revision 21869 by Michiru (talk)

[[File:dev_3ds.jpg|250px|thumb|left|Developer 3ds]]
A Developer (or Test) 3DS has two GUIs which can be used as a primary interface. Description of homemenu interface was taken from observations of a PAL 3DS Development Unit with Firmware 0.15.8 (revision 37901). Description of testmenu was taken from testmenu v0.24.3 (revision 60260) cia.

== Home Menu ==
The simple fact of the matter is that every aspect of the retail mimicking software on a developer 3DS, is that they can be updated at the will of the developer. It will run any revision of any system software provided it is compatible with the 3DS' revision and signed properly. The Home Menu revisions for developer 3DS' are usually identical in format to the retail 3DS Home Menu, however, the developer Home Menu differs from its retail counter-part in the following ways:

* There is no set list of application on the home menu, with the exception of the reserved slot for game cartridges
* All applications like Nintendo 3DS Sound, and System Settings have to be installed manually
* There are dedicated system updaters for both o3ds and n3ds dev units
* All system applications can* be deleted. *Only older revisions of the Dev Menu were capable of managing system applications, allowing for their deletion. Later revisions have this functionality removed. Note while in later revisions of the Dev Menu System applications cannot be seen, they can be imported.

== Debug functions ==
* Pressing X+Y toggles HOME Menu's region, language, creation date/time, revision information, and percentage bars used to measure application banners processing. The first bar indicates how much can be processed in a single frame; the second bar indicates CPU processing; the third bar indicates GPU.
If those buttons are held during start-up, the icon database & cache are deleted.
* Pressing X+B when the bars are visible, lets the user cycles between regions displayed for the banner and the title name.

== Test Menu ==
The Test Menu is a menu alternative to the Home Menu and has minimal functionality. It can be enabled by changing the 'Menu' option under "Other Setting" in the Config Menu to 'Test Menu', or by using the CTR Menu Selector (this is also a Developer App). Apart from its appearance, it has a number of restrictions that do not apply to the actual HOME Menu. Application region-checking is not performed by the Test Menu.

[[File:dev_testmenu_screenshot.png|250px|thumb|right|Test Menu for firmware 0.24.3 (r60260)]]
[[File:dev_testmenu.jpg|250px|thumb|right|Test Menu for firmware 0.15.8 (r37901)]]

In the latest Test Menu, those informations are displayed on the upper screen:
* Firmware version, CTR-SDK version
* System Mode (see [[3DS Development Unit Software#Config|here]])
* Debug Mode enabled/disabled
* SD Card information
* EULA version
* User name
* Remaining battery life
* Screen capture statut (Maybe for ctr debuggers?)
And on the lower screen:
* Test Menu status
* Explanation of Test Menu functions

The Test menu, can only launch Dev menu (,system settings on newer versions) and slot 1 device. When the HOME Button is pressed while an application is running, that application is suspended and this menu is displayed;
however, to return to the Test Menu, the application must handle a press of the HOME Button.
Note this is not possible where the developer has intentionally disabled the functionality of the home button, like in trade show sample.

When an application is suspended, pressing the L button takes a screenshot of the upper and lower screens, storing it into the Capture folder of the SD Card. This function won't work if no SD Card is inserted.
Files are generated in the following manner: [YYYYMMDD_HHMM date format]_[Screen]_[Index].bmp.
[Screen]: UL = upper screen, left eye image; UR = upper screen, right eye image; LO = lower screen
[Index]: the number starting at 00000 and going up by 1 for every screenshot taken within the same minute.

For example, a screen shot taken from the top screen for the left eye at 9:25 am on the 31/10/12 would look like this "20121031_0925_UL_00000.BMP".
[[Category:3DS Development Unit Related Pages]]

Anti Savegame Restore

2022-02-19T18:58:08Z

Cooolgamer: /* Applications using this feature */

=Summary=
Anti Savegame Restore (internally referred to as ''Save Data Rollback Prevention'') is a feature originally implemented in [[Filesystem_services|FS]] module with [[4.0.0-7]], which prevents the user from restoring previous versions of a savegame image. This feature is not used for gamecard games. When an old version of the save is detected, the application will display an error regarding old savegame version, then delete+recreate the save(similar to when the savegame is corrupted).

=Implementation=
When creating the SD savedata, the application generates a random u64 value, then stores it in an arbitary savefile in the savegame FS. The application then uses the anti-savegame-restore [[Filesystem_services|FS]] commands to verify the stored u64(with the u64 loaded by FS module), and to update the u64 used by FS module. The u64 used by FS module is stored in the FS module [[System_SaveData]].

Each time the application writes to the savegame, the u64 value stored in the savefile should be updated(and the command for updating the NAND u64 value should be used as well). Usually applications update this value by incrementing it, however generating a new random-number or other methods of updating it can be used as well.

=Remove the secure value=
It is possible to remove the secure value easily by using [[FS:ControlSecureSave|ControlSecureSave]], from the [[Filesystem_services#Filesystem_service_.22fs:USER.22|fs:USER]] service, with the [[FS:ControlSecureSave#Action|SECURESAVE_ACTION_DELETE]] action.

=Applications using this feature=
* Animal Crossing: New Leaf
* Pokemon X & Y
* Pokemon Omega Ruby & Alpha Sapphire
* Pokemon Omega Ruby & Alpha Sapphire Demo
* Pokemon Shuffle
* Super Smash Bros
* Pokemon Red,Blue and Yellow (GB(C) VC)
* Rusty's Real Deal Baseball
* Megami Meguri

Cooolgamer: 3DS dev homemenu with "debug" showing

== Summary ==
3DS dev homemenu with "debug" showing

3DS Development Unit Software

2021-11-24T14:40:44Z

Cooolgamer: /* EcDevTool */

The following is a description of the functions what is possible with the applications unique to 3DS Development Units.

For information on 3DS Development Hardware see [http://gbatemp.net/topic/327858-3ds-development-hardware/]
[[File:CTR_HMN_DEV.png|300px|thumb|right|Beautifully clear picture of the Dev Apps + Home Menu. Click to view in great quality. - Xcution]]

=System Updaters=
[[File:CSUscrnshot.png|300px|thumb|right|CSU Screenshot]]

There are two kinds of system updaters for dev (panda) units, CTR System Updater (CSU) and SNAKE System Updater. As the names imply, the former is for original 3DS and the latter is for New 3DS. They are used to update the panda unit's 'firmware'/SDK Version. The romfs of the CSU contains the contents that will be installed to NAND. They contain all system titles as well as Devmenu and Config.

== Dev Menu ==
[[File:Devmenuicon.png|||left]]

[[File:Devmenscnsht.jpg|250px|thumb|right|Dev Menu Screenshots]]
[[File:Old_Dev_Menu.png|200px|thumb|right|Old Dev Menu Screenshot]]

This NAND application (00040000-0ff40002) on the top screen displays the firmware and revision of the Dev Menu, the free space available on the [[Flash Filesystem#TWL partition|TWL(DSi) NAND partition]] and [[SD Filesystem|SD card]] if present. It also provides information on the current file or device selected, as well as navigation instructions for the bottom screen.The bottom screen has three different windows, which are:

*Program - From this tab, applications can be loaded from the [[Flash Filesystem|NAND]], the [[SD Filesystem|SD card]] and the slot 1 card (only a select scope of applications, see below for Dev Menu revisions and their corresponding scope of applications). Installed software can be uninstalled by pressing X on it.

*Import - From this tab, the SD card can be browsed to select and install a .[[CIA]] file. In later revisions this was renamed to ''SDMC''. In addition to the marked controls, also pressing X while requesting the installation of one or more CIA will delete them after a successful installation.

*HIO - "Host IO" A tab available in later revisions of the Dev Menu. Used for installing CIAs stored on the host PC, this is supported by hio services, and hio daemon on the host PC. Only usable on PARTNER-CTR (Capture+)Debugger, as HIO requires a direct USB connection with the console.

*ExtData - From this tab, the 3DS's [[Extdata]] (except NAND shared extdata) can be deleted.

*SExtData - "Shared Extdata", this feature was removed early on in the history of this app.

Titles are shown in the Program tab by [[Titles|Unique ID]] and by their [[Product code]] (CTR)/name in header (TWL); some other non-executable special titles (applets or CFAs), explicitly programmed in the specific version of DevMenu, are displayed in red.

To perform a manual update with CIAs on a dev unit, pressing Start + Y while highlighting the NATIVE_FIRM CIA will trigger an option to update firmware, thus allowing a downgrade.

Pressing L + R + Left + B + Start will, after confirmation, bulk uninstall all SDK tools. DevMenu itself will crash a few seconds later.

{| class="wikitable" border="1"
|-
! SDK Version
! Titles Accessible
|-
| 0.9.2 - 0.13.2
| Applications(NAND), System Applications , TWL Titles
|-
| 0.14.0 - 1.1.0
| Dev NAND Applications, System Applications , TWL Titles
|-
| 1.2.0 - 2.0.0
| Dev NAND Applications, DSiWare
|-
| 2.1.0 - 2.4.0
| Applications(SD), Dev NAND Applications, DSiWare
|-
| 3.0.0 - 3.1.0
| Applications(SD), Dev NAND Applications, Demos, DSiWare
|-
| 3.2.0
| Applications(SD), Dev NAND Applications, Demos, DSiWare, WebBrowser
|-
| 3.3.0 - ?
| Applications(SD), Dev NAND Applications, Demos, DSiWare, WebBrowser, TwlNandFiler
|-
| 11.4 (0.24.67)
| Applications(SD), Dev NAND Applications, Demos, DSiWare, WebBrowser, eShop, Miiverse, TwlNandFiler, dummy CFA
|}

== Config ==
[[File:Configicon.png|||left]]

[[File:3DS_dev_configmenu.JPG|250px|thumb|right|Config Menu Screenshot]]
[[File:Dev config.jpg|250px|thumb|right|Newer Config Menu Screenshot]]

This NAND application (00040000-0ff40102) is a text-mode advanced configuration menu for the 3DS.

When open, similarly to the regular [[System Settings]], the Home menu is not accessible, and the console is forced to be rebooted on exit (accomplished by pressing the Power button).

The functionality and menu layout of this app has changed a lot over its continuous development; some features include:

*Menu - (Home Menu/Test Menu) This function edits the [[Config_Savegame|configuration]] field containing the menu TID for dev units, allowing the user to choose between the [[Home Menu]] or the [[3DS Development Unit GUI#Test Menu|Test Menu]], as the menu loaded by the [[NS]] module.

*Language - same options found in the Language section of [[System Settings]] but also has an "invalid" option

*System Mode - [[Memory_layout#FCRAM_memory-regions_layout|Changes the memory mode]] for the Home/Test Menu. (Launching applications will be able to override this setting)
:*Prod - 64MB Memory mode ([[Home Menu]] can usually only run in this mode and ''most'' retail-looking units cannot switch out of this mode)
:*Dev1 - 96MB Memory mode (No browser/Miiverse)
:*Dev2 - 80MB Memory mode
:*Dev3 - 72MB Memory mode
:*Dev4 - 32MB Memory mode
:*snake Prod - 124MB for New-3DS
:*snake dev1 - 178MB for New-3DS (No browser/Miiverse)
:*snake dev2 - 124MB for New-3DS
:All CTR Debuggers/Prototype units can change memory allowance. For Developer Test Units, the ability to change Memory Allowance, appears to be dependent on an option when buying the Test Unit (similar to having a choice to purchase IS-Nitro's Wireless/USG options when buying an IS-Nitro from Nintendo). If anything other than prod or dev2 is selected, menu settings are automatically changed to test menu.
:On some Test Units, it's possible to run the [[Home Menu]] outside of Prod. However, software with limited memory (such as the web browser) cannot be launched from the home menu if the home menu is outside of Prod.

*Exception handler - Selects whether to enable or disable the application's handling of exceptions that arise in the non-debug environment.
:If the application is not set to handle exceptions, the application quits when an exception occurs. - enable/disable

*Break Stop - (enable/disable) - Selects whether to enable or disable stopping the application when a break is encountered in the non-debug environment. If the application is not made to stop, it quits on a break.

*Debug Mode - (enable/disable) - Select enable or disable to enable and disable debugging functions.
:Debugging is always disabled for retail products.

*Dlp Force Child Import/Dlp Debug - (enable/disable) - normally the 3ds caches downloaded "Download Play (Dlp)" applications on the nand and only re-downloads, overwriting the cached copy if the version application being requested to downloaded is higher than what is currently present on the nand. Enabling this option forces the 3ds to download and overwrite the cached copy on the nand, regardless of the version of the application being downloaded. This is of course for testing purposes.

*Fangate Failure Emulation - Unknown, related to the [[NFC adapter|external Amiibo receiver]]?

*Nup - Enable/disable online check for updates? Such a feature exists on WiiU

*FS Latency Emulation - Filesystem Latency, in milliseconds (0ms-2550ms). Selection is in increments of 10. (ie 0ms->10ms->20ms...)

*User Name - Console owner's "profile" nickname, unrelated to the Personal Mii

*NG Name Flag - declares whether the name is "not good", i.e. contains a banned word. Normally automatically set by System Settings after a warning; effect unknown.

*CountryId - Changes 3DS between installed countries. It can also be set to an undefined ID (255).

*RegionId - Selects the sub-location (region, state, county), if supported by the selected country. Unidentified is displayed when RegionId is set to 255.

*Hid Setting - (human interface device) Calibrates touch screen and Analog stick.

*FLICKER TOP - Bias voltage for top screen (the misattributed "contrast" or "scanline" control found as potentiometers in the battery compartment in previous color-display Nintendo portables)

*FLICKER BOTTOM - Bias voltage for bottom screen

* ABL ENABLE - "Power Save mode", adjusts backlight according to displayed image. Can also be enabled on 2DS, on which it is fully functional but the single backlight design may bring questionable results.

* LUMINANCE LEVEL - Brightness. In older versions of Config, it could be set above 5, with no further increment and resulting in crashes of the Home Menu's quick settings.

* BACKLIGHT DIMMING - Camera-controlled automatic backlight of New-3DS

*RTC Setting - (real time clock) Sets system time, with equivalent results to System Settings.

*Raw RTC Setting - Adjusts time directly on [[MCU Services|the hardware RTC]]. The resulting time is also displayed as a convenience. If the application being tested uses GetUserTimeOffset() to [[Anti Time-Travel|detect if the user has changed the clock]], this can be used to change the clock without the application detecting it.

*Eula Setting - Input the "Agree Version", a 2-byte number representing the latest accepted version (major and minor) of the online services agreement. 00.00 is used to mean "not accepted". This setting is commonly adjusted to its maximum value, ff.ff, to bypass issues with playing foreign region games online caused by mismatching latest agreement versions.

*Sound Mode - mono/stereo/surround

*Coppacs Setting - In the U.S., a law called the Children's Online Privacy Protection Act (COPPA) requires consent from the parent or guardian for collection and use of personal information from children under the age of 13. Canada has a nearly identical law. This setting is [[Cfg:GetRegionCanadaUSA|only enabled for software for the Americas region, and when the country in System Settings is set to the US or Canada]].

*Olv Access Key - Related to Olive/OLV/Miiverse. Always appears to be 0 on retail units. WiiU titles have numbers also called OLV access keys in their metadata XMLs.

*Test Setting - Verify operation and calibration of touchscreen and joystick.

*Stereo Camera Cal for Check - Apparently writes incorrect calibration data for the camera.

*Gyro / Accel Cal for Check - Apparently writes incorrect calibration data for the motion sensors.

*Ctr Info Setting - Loads settings from a ctrsetting.txt present on the SD. Such a sample file is provided in the resources/configtool folder of the SDK.
:The feature set of this option is only in most part the same as the interactive UI's, for instance ctrsetting.txt can also configure the DS Profile and [[Parental Controls]].

*Reset Settings - Resets all settings to default. The initial configuration will be run again, but installed applications or their data will not be deleted unlike in a [[System Settings|System Format]].

=CTR-SDK=
Descriptions Derived from SDK 2.3.4 except where notified otherwise.

== Downloadplay Client ==
[[File:Dlpcliscnsht.jpg|250px|thumb|right|Downloadplay Client Screenshots]]
[[File:Dlpcliicon.png|||left]]

Even though a Developer 3DS has a "Download Play" application visually identical to the retail 3DS [[Download Play|application]], the text-mode "Downloadplay Client" NAND application (00040000-0ff40402) can be installed as an alternative to the regular Download Play application.

(A Developer 3DS cannot receive software from a Retail 3DS and viceversa due to different encryption keys.)

This application is used for easy testing of 3DS-mode download play 'child' apps (DS Download Play is not implemented), without the hassle of constantly re-navigating the normal Download Play interface

== Network Settings ==
[[File:Netsetscnsht.jpg|250px|thumb|right|Network Settings Screenshots]]
[[File:Netseticon.png|||left]]

This developer NAND application (00040000-0ff40702) allows the users to directly modify the following from any of the three possible network setting 'slots'

*Security Mode :(the wireless encryption the network is using) OPEN/WEP 40bit/WEP 104bit/128bit/WPA TKIP/WPA2 TKIP/WPA AES/WPA2 AES

*SSID :(self-explanitory) maximum 32 characters

*KEY :(the key for the encrytion is here in plain text) the maximum length depends on encryption type

*AutoDNS :(whether the 3DS obtains the DNS automatically or not) |True-3DS obtains the DNS automatically|False-3DS uses the DNS server address provided by the user(it is possible to edit this here)|

At the bottom of the setting options there are two choices:

*Write Setting & Connect Test To AP - Applies the settings above and performs a connection test(note any settings made in system settings for this connection, which are not present in the above settings will be nullified, for example any proxy server settings)

*Remove Setting - removes all settings for this 'slot'

The system must be rebooted to exit this app.

== SaveDataFiler ==
[[File:Saveflicon.png|||left]]
[[File:Saveflscnsht.jpg|250px|thumb|right|SaveDataFiler Screenshots]]

This 3DS developer NAND application (00040000-0ff40a02) allows save files and extdata to be exported and imported from an SD Card. The window has three tabs:

*User - This is where saves for 3DS-mode installed and cartridge applications can be exported to the SD Card. After the initial release, button combinations for deleting the entire save archive or resetting the [[Anti Savegame Restore|secure value system]] for the selected title were added. The selected save archive can also be browsed by pressing A.
The entire save or individual files can be deliberately corrupted.

*ExtData - This is where application extdata can be deleted or exported to the SD Card for later use

*SD - This is where backups created through the first two tebs can be re-imported (with the options of an automatic target selection, or explicitly choosing the SD or the Game Card). Exported data can also be deleted here.

Applications are listed only by Unique Id. TWL-mode software is ignored by this application, while GBA-mode apps will always be shown as not ever having saved ("broken" and highlighted in red).

User save data is exported to sdmc:/filer/UserSaveData/YYYYMMDD(Hour)(Minute)(Second)

It creates a folder in that path and 3 files. The 2 files exported to the above path are <uniqueID>.dat and <uniqueID>_.dat while a folder named /<uniqueID>/ in that path contains <ExHeader Name>.dat

Pressing L+R+Start will, after confirmation, delete all [[Shared Extdata]]. Home Menu will crash if returned to before rebooting.

== CTR MenuSelector ==
[[File:MenuSelector.png|120px|thumb|right|Menu Selector Screenshot]]
[[File:Menuselectoricon.jpg|||left]]

This system NAND application (00040010-0ff40b02) when loaded can change the current 'Active Menu'(being used at the moment) by editing the menu TID [[Config_Savegame|configuration]] field, allowing the user to choose between the [[Home Menu]] or the [[3DS Development Unit GUI#Test Menu|Test Menu]], as the menu loaded by the [[NS]] module.

It also features a basic [[System Font|font]] test.

With the release of SDK 1.1.0, this application was superseded by the introduction of the "Menu" choice in the [[3DS Development Unit Software#Config|Config Menu]] and consequently removed as a standard application.

== CecBoxTool ==

[[Image:devCECBoxTool.jpg|thumb|200px|CECBoxTool screenshot ]]

Streetpass backup and restore tool, can also delete boxes (disable [[StreetPass]] for a given software), check the number of contents of the inbox and outbox for any given box (or all of them), or reset the MAC filter.

NAND application (00040000-0ff41602)

== CecLotCheckTool ==
[[File:Ceclotscnsht.jpg|250px|thumb|right|CecLotcheckTool Screenshot]]
[[File:Cecloticon.png|||left]]

This NAND application (00040000-0f800902) is used to manage CECs (Chance Encounter Communications, AKA StreetPass) for any of the twelve possible applications registered for StreetPass, if there are any.

The BOXes are individual applications which are permitted by the user to use CECs, such as StreetPass Mii Plaza or Nintendo 3DS Sound. And as such, the boxes in this application correspond to the applications in 'StreetPass Management', in 'System Settings' (StreetPass Management is accessible from retail 3DSs). The functions of this application:

*<Y> BOX Options - this opens up a sub menu with the following options(when hovering over Nintendo 3DS Sounds BOX - the only one I can test the app with):

*Box Info - Gives the Out-Box parameters [[File:Boxinf.jpg|250px|]]

*Message Info (OUT-BOX) - Gives the Message Parameters For the current BOX [[File:Mesinf.jpg|250px|]]

*Dummy Message Settings - Not quite sure what the options do here [[File:Dummesinf.jpg|250px|]]

*<A> Create Dummy BOXes - Creates dummy BOXes to fill any unused slots. (does not overwrite any present slots)

*<X> Delete BOXes - Deletes all of the BOXes from the slots.

*<START> CEC Filter Reset - Resets 8-hour per source rate limit. The [[CECD|StreetPass driver]] runs a [[Configuration_Memory#ENVINFO|ENVINFO]] check to verify independently whether the console is not retail before applying this.

== BossLotCheckTool ==
[[File:Bosslcscnsht.png|100px|thumb|right|BossLotCheckTool Screenshot]]
[[File:Bosslcicon.png|||left]]

This application (00040000-0ff40e00) is used to manage BOSS (SpotPass) tasks/data for 3DS titles which utilise BOSS communications. 'Pokedex' is an application which utilizes BOSS comunications. This application also displays the 3DS's friend code, although this code is not to be confused with the 3DS's Friend Card code found in 'Friends List'. The user can browse by unique ID the 3DS titles(excluding system titles) registered to use BOSS. For each title you can view details about the downloaded 'NsData' which accompanies BOSS downloads, view the BOSS task lists (implies applications can perform more than one BOSS task). You can also view various details about each BOSS task, including:

TaskStatus : DONE?
TaskExecCount : How many times the BOSS task has been executed
TaskExecInterval : Period of time (in seconds) in the task is to be executed, in intervals
TaskPriority : Is a number value
URL : The URL to the BOSS content
AP Info : NONE?
TaskResultCode : Success or not
HTTP_StatusCode : Self explanatory
DataSize : Size of Content (in bytes)
Last_Modified : Last time the BOSS content (on server) was modified
StartTime : when the BOSS task was registered
OptOut : Whether the user can/has opted out of BOSS communication for this task

It also possible to manually execute the BOSS task from here

== Stereo Camera Calibrator ==
[[File:Stecamscnsht.png|100px|thumb|right|Stereo Camera Calibrator Screenshot]]
[[File:Stecamicon.png|||left]]

The Stereo Camera Calibrator (00040000-0ff40600), in a nutshell, allows the user to adjust the configuration of the outer cameras in relation to each other. It can be configured automatically by positioning the 3DS a set distance away from a special chart. It can also be configured manually, by setting the rotation of each camera image and the size of the right eye camera. The 3D effect can be perceived by superimposing the right eye camera image translucently with the left eye camera image or by viewing the 3D image directly by use of the parallax barrier in the 3DS Screen.

== SdCardDebugUtility ==

A multipurpose application (00040000-07fffa00) which can:

* Fill most free space on the SD card.
* Create some sample 2D or 3D pictures.
* Create empty [[Nintendo 3DS Sound|voice memos]].
* Launch the picker applets for the former media (neither canceling nor actually selecting a file have any effect).
* Create dummy SpotPass tasks.

== FragDisk ==
This SD application (00040000-0ff41800) creates many small files on the SD card, then deletes one out of every two to fragment the free space.

== Friend Add Tool ==

The purposes of this tool (00040000-0fe04000) are deleting all friends and/or filling the Friend List with dummy FCs, or with ones loaded from friend_code.txt on the root of the SD card.

This file must contain 1-100 friend codes, one per line. Digits may be grouped at the user's discretion with spaces, dashes, or nothing.

== Friend Testing Partner ==
[[File:Ftestpscnsht.png|250px|thumb|right|Friend Testing Partner Screenshot]]
[[File:Ftestpicon.png|||left]]

The Friend Testing Partner application (00040000-0fe00c00) is used to test/monitor the 3DS's Friend List function. It allows the user to test various functions of the 3DS's out-going Friend Card, by giving the following options:
*Master Control - (RUN/STOP) (STOP is the default setting) when ‘STOP’ is selected the 3DS Friend Card uses the user’s settings/data. When ‘RUN’ is selected the 3DS Friend Card uses the dummy settings/data chosen to test from the settings bellow.

*Login/Logout - (ON/OFF) (ON is the default setting) What effect this has on the Friend Card is not known

*Playing Title - (ON/OFF) (ON is the default setting) When ‘ON’ is selected the currently used title is ignored and a dummy applications are cycled through as the ‘Playing Title’ approximately every ten seconds in its place. The dummy applications used are the applications found in Firmware version 1.0.0-0 of a retail 3DS including the ‘Nintendo Zone viewer’ app. When ‘OFF’ is selected the currently used title (which is the Friend Testing Partner app) is used as the ‘Playing Title’

*Mode Description - (ON/OFF) (ON is the default setting) When ‘ON’ is selected the Software in Use(Playing Title) is accompanied by the Date and Time found on that user’s 3DS. The Mode Description is refreshed every ten or so seconds. When ‘OFF’ is selected the date and time on the user’s 3DS is not displayed.

*Message - (ON/OFF) (ON is the default setting) When ‘ON’ is selected the message made by the user is replaced(not overwritten as it reverts back to the user’s choice when this is ‘OFF’) by the current date and time in the format “YYYYMMDD HHMMSS”, this is refreshed every ten or so seconds.

*Mii - (ON/OFF) (ON is the default setting) When 'ON' the currently used Mii is replaced with one of 4 dummy Miis and cycles them through every ten seconds with a new dummy mii. This effect can only be seen from another 3DS not the host

*Favorite Title (ON/OFF) (ON is the default setting) When 'ON' is selected, the user’s favorite title is replaced with a dummy, which is replaced every 10 or so seconds.
Also this application allows the user to monitor the whether the 3DS is online or not and whether the 3DS’s Friend Presence is online or offline. Every time a dummy setting is refreshed it is displayed on the top screen with a time stamp.

== Game Coin Setter ==
[[File:Coinsticon.png|||left]]
[[File:Coinstscnsht.png|100px|thumb|right|Game Coin Setter Screenshot]]

This application (00040000-0ff40d00) is used to set the Play Coin count on the 3DS. Obviously this was created so a developer can test parts of their game in which the player can exchange earned play coins for in-game content or similar. It has a very simple interface showing the current play coin count and the adjustable option, the target coin count. These are the controls with explanation of each:

*LEFT/RIGHT - using the D-pad only to adjust the 'Target Count' to a number between 0-300.

*A - Sets the 'Current Count' (amount of play coins the system has) to the user selected 'Target Count' (the user specified amount of play coins)

*L+R+X - "Preclude today's Increment" Sets byte 6 of [[Extdata#Shared_Extdata_0xf000000b_gamecoin.dat|the play coin database]] so that no coins will be earned through walking for the current day anymore.

== PedometerHistoryChanger ==
A tool (00040000-0ff30300) to preview on-screen, or export to SD, pedometer data.

The format of PedometerExport.csv is: year,month,day,hour,steps during that hour.

Data can be read from an equally formatted PedometerImport.csv, replacing the entire pre-existing history or only conflicting hours at the user's discretion. History on internal storage can be cleared, too.

== IR Communication Checker ==
This application has title ID 00040000-0f804900 and cannot be closed (apart from forcing a power cycle).

Counts data seen by the infrared port. It doesn't have to be valid, as it happily measures a camera flash...

== EcDevTool ==

This multipurpose tool (00040000-0ff41b00) provides several features propedeutical to simulating software sales:

* Add balance: self explanatory, not functional on the production eShop server
* Delete title right: Local and (apparently) server-side [[ticket]] uninstaller
* Delete eshop account: self explanatory, sometimes functional on the production eShop server
* Change country - apply a country change without going through the multiple warnings present in the retail eShop app
* Change tax address - zipcode entry (USA and Canada only).

== Dummy Nintendo eShop ==
This region-specific application exists to debug <code>API( JumpToEshop() )</code> on the 3DS. This was created so a developer can test parts of their game in which the player can preview or purchase titles within a game. It is mainly used in conjunction with Downloadable content. It has a very simple interface showing the reason for its existence and controls for exiting to the home menu or finalizing the Dummy Shop. The Dummy Nintendo eShop also shares the same Title ID and Unique ID as the Retail Nintendo E-Shop.
[[File:INdummyshop.png|100px|thumb|right|SDK 7 DummyEshop Screenshot]]
[[File:dummyshop.png]]

== FangateFwUpdater ==

00040000-0ff41f00 is a tool for updating or destroying (thus enabling downgrade of) the external NFC reader/writer's firmware. This tool cannot be used with SNAKE development devices or SNAKE development tools. It operates only with CTR development devices and CTR development tools.

== NoftWriter ==

(00040000-0f807f00) Browse the SD card for Amiibo images, and flash them to non-locked tags. After programming, the tag may be left locked or not at the user's discretion.

== NfpSdmcTool ==
(00040000-0ff42100) Can read, write, and modify NFP tag data.

== NfpManager ==

A multipurpose Amiibo tool, having the title ID of 00040000-0ff41e00.

The eventual connection to an external NFC adapter, to the Amiibo, and to its contents can all be enabled or disabled separately.

Amiibo data (owner, save file, or both) can be deleted or replaced.

The local NAND backup of scanned Amiibos can be deleted too.

== NfpUtility ==

A simplified, bulk Amiibo checker (00040000-0ff42000): just hold a supported tag over the NFC reader to view a summary of its character identity and owner info.

== UdsLocalIdChecker ==
A scanner for local, console-to-console networks. Its title ID is 00040000-0ff3ff00.

== TWL Development Tools ==

These are DSi/DS mode development tools repackaged into a [[CIA]], for installing to the TWL NAND.

=== NINTENDO DS - WMtest ===
[[File:Wmtestscnsht.jpg|300px|thumb|right|WMtest Screenshot]]
[[File:Wmtesttool.png|||left‎]]

This application is a TWL(DSi) application compiled for use on the 3DS. It is an wireless test tool with its uses explained below:

*Scan Test - Scans Wireless channels 1-13 (can be focused on one specific channel) for broadcasting stations. It can detect two types of broadcasting stations:

:Wifi Access Points - Giving the Mac Address, Broadcasting Channel, 'c', and the SSID

:DS Stations such as DS Download stations and Pokemon distributors - Giving the Mac Address, Brodcasting Channel, TGID and GGID

*ScanEx Test - and has two Scan Types. Passive which lets you individually scan channels 1-13 (only one at at time) and the DS distribution channels (1,7,13 all at once). And Active which scans all 13 channels at once. when it finds a channel it prints on the bottom screen next to 'Found' 'bssDescCount='

*MeasureChannel Test - not quite sure what this does but it for a given channel it gives a ratio(in percentage form), which it finds in its allocated test time ranging from 10ms to 1000ms. And for every interval of time which is specified, it tests and gives a ratio.

*Noise Mode - Seeks wireless channels in which to make wireless noise (This is not made very clear on the app). You can specify the:

Channel where the scanner will seek to make noise

Noise Rate, ranging from 0% to 100%

Frequency, ranging from 10ms to 50ms

Seek Mode, ranging from 1000ms to 1500ms

When the settings are chosen the top screen has two counters which display 'Noise ON count' and 'Noise OFF count' the counters are affected by the noise rate. Starting at 0% the 'Noise ON count' does not change but as the Noise rate gets closer to 100% the count moves and gets faster as Noise rate reaches 100%. For 'Noise OFF count' it is the exact opposite to the ' Noise ON count' in regards to counting.

=== TWLNandFiler ===

Browse, export, delete and import save archives from TWL Nand. Includes a basic hex viewer.

=NW4C=
NintendoWare for CTR is comprised of tools that deal with creating effects, fonts, models, layouts, sound, and text. There are CTR versions of some of the viewers.

==H3D Model Viewer==
[[File:H3Dscrnshot.png|180px|thumb|right|H3D Viewer Screenshot]]
[[File:H3Dicon.png|||left]]
[[File:ModelViewericon.png|||left]]
[[File:ModelViewer.png|100px|thumb|right|3DS Model Viewer Screenshot]]

Used for viewing Binary CTR Models (.bcmdl): the model can be viewed from any angle or scale, the perspective is controlled by the circle pad and directional buttons.

Models need to be loaded into memory through Host IO, so this application is only usable for its intended purpose on a CTR-PARTNER (Capture-)Debugger; on a CTR-PARTNER Capture or Test Units, the model is restricted to three coloured lines depicting the 3 dimensions (x,y,z).

There is also a Windows port of this program, running in a specialized proprietary emulator.

==Layout Viewer==
[[File:LYTscrnshot.png|180px|thumb|right|Layout Viewer bottom screen]]
[[File:LYTicon.png|||left]]

Used for viewing Binary CTR Layouts (.bclyt). It is used with CTR-PARTNER to load layouts into RAM.

==Effect Viewer==
[[File:EFTscrnshot.png|180px|thumb|right|EffectViewer4C Screenshot]]
[[File:EFTicon.png|||left]]

=Mobiclip suite=
Along with (but separately from) the Mobiclip encoder, Nintendo offers to developers:

==3D Movie Player==
A simple but polished gamecard or SD application (00040000-00036A00) that, comparably to retail multi-video titles (such as "Shaun The Sheep"), allows its user to select moflex files directly from the root of the SD card, then watch them (complete with seek bar, FF/pause/REW buttons, and an auto-dimming user interface!)
----
[[Category:3DS Development Unit Related Pages]]