Difference between revisions of "游戏卡带"

From 3dbrew
Jump to navigation Jump to search
(Translated from Gamecards,Not NOT complated.)
 
(continue to translate.)
Line 63: Line 63:
 
|  13
 
|  13
 
|  DAT4
 
|  DAT4
−
|  双向数据总线 /存游戏芯片未上的NC/SIO3引脚。
+
|  双向数据总线 /存游戏芯片上的NC/SIO3引脚。
 
|-
 
|-
 
|  14
 
|  14
 
|  DAT5
 
|  DAT5
−
|  双向数据总线 /存游戏芯片未上的WP#/SIO2引脚。
+
|  双向数据总线 /存游戏芯片上的WP#/SIO2引脚。
 
|-
 
|-
 
|  15
 
|  15
 
|  DAT6
 
|  DAT6
−
|  双向数据总线 /存游戏芯片未上的SO/SIO1引脚。
+
|  双向数据总线 /存游戏芯片上的SO/SIO1引脚。
 
|-
 
|-
 
|  16
 
|  16
 
|  DAT7
 
|  DAT7
−
|  双向数据总线 /存游戏芯片未上的SI/SIO0引脚。
+
|  双向数据总线 /存游戏芯片上的SI/SIO0引脚。
 
|-
 
|-
 
|  17
 
|  17
Line 81: Line 81:
 
|  接地。
 
|  接地。
 
|}
 
|}
 +
 +
 +
== SPI闪存 ==
 +
目前为止，只有存游戏闪存芯片(savegame FLASH chip)被识别了。这块芯片被识别为0xC22211。JEDEC制造ID为Macronix，此外芯片标签为25L1001，与 MX25L1021E相符。
 +
数据表位于：http://www.macronix.com/QuickPlace/hq/PageLibrary4825740B00298A3B.nsf/h_Index/3F21BAC2E121E17848257639003A3146/$File/MX25L1021E,%203V,%201Mb,%20v0.01.pdf 。不论如何，MX25L1021E不支持3DS用于与SPI闪存（SPI flash）交换数据的4位宽传输。因此，这可能是一块定制闪存芯片。
 +
 +
== 格式 ==
 +
Cartridge及系统更新存放在为此预留的区块内。
 +
在ROM里，能找到小于1GB的CART_SIZE_MAX-( 0x280000*(CART_SIZE_MAX/CART_SIZE_128MB) )-0x2000000的更新区块。该区块为0x2000000字节。
 +
 +
== 通信协议 ==
 +
与DS和DSi游戏卡带相比，3DS系统与3DS游戏卡带的通信协议几乎完全改变了。
 +
 +
在第6个传输以后，命令从8字节变为16字节。可能使用了新的加密手段，比如AES CTR。
 +
使用16字节命令后，数据总线维护0x00直到卡带返回表示准备好的单字节数据0x01，接着是实际数据。每0x200字节块实际数据后，是4字节的（未加密的）该字节块的标准CRC32码。
 +
 +
(
 +
After the sixth transfer, commands change size from 8 bytes to 16 bytes. Possibly a new encryption is used, such as AES CTR.
 +
When 16-byte commands are used, the data bus maintains the value 0x00 until the card signals it is ready by clocking a single byte 0x01, followed by the actual data. After each 0x200-byte block of actual data, a 4-byte standard CRC32 of the block data (before encryption) follows.
 +
)
 +
 +
下面是3DS发送给3DS游戏卡带的一组游戏卡带命令样本:
 +
 +
Here's a set of sample gamecard commands that a 3DS sends to a 3DS gamecard:
 +
 +
{| class="wikitable" border="1"
 +
|-
 +
!  大小
 +
!  命令
 +
!  解码命令
 +
!  描述
 +
|-
 +
|<tt>2000</tt>
 +
|<tt>9F00000000000000</tt>
 +
|
 +
|Reset
 +
|-
 +
|<tt>0000</tt>
 +
|<tt>71C93FE9BB0A3B18</tt>
 +
|
 +
|Unknown
 +
|-
 +
|<tt>0004</tt>
 +
|<tt>9000000000000000</tt>
 +
|
 +
|Get gamecard ID, response=9000FEC2
 +
|-
 +
|<tt>0004</tt>
 +
|<tt>9000000000000000</tt>
 +
|
 +
| Get gamecard ID, response=9000FEC2
 +
|-
 +
|<tt>0004</tt>
 +
|<tt>A000000000000000</tt>
 +
|
 +
| Unknown, response=00000000
 +
|-
 +
|<tt>0000</tt>
 +
|<tt>3E00000000000000</tt>
 +
|
 +
| Enter 16-byte command mode.
 +
|-
 +
|<tt>0200</tt>
 +
|<tt>82000000000000000000000000000000</tt>
 +
|
 +
| Get header
 +
|-
 +
|<tt>0000</tt>
 +
|<tt>F32C92D85C9D44DED3E0E41DBE7C90D9</tt>
 +
|<tt>8300000000000000708DF1A731717D0B</tt>
 +
| Seed
 +
|-
 +
|<tt>0004</tt>
 +
|<tt>696B9D8582FB55D31B68CAFE70C74A95</tt>
 +
|<tt>A200000000000000708DF1A731717D0B</tt>
 +
| Get secured gamecard ID, response=9000FEC2
 +
|-
 +
|<tt>0004</tt>
 +
|<tt>BAA4812CA0AC9C5D19399530E3ACCCAB</tt>
 +
|<tt>A300000000000000708DF1A731717D0B</tt>
 +
| Unknown
 +
|-
 +
|<tt>0000</tt>
 +
|<tt>178E427C22D87ADB86387249A97D321A</tt>
 +
|<tt>C500000000000000708DF1A731717D0B</tt>
 +
| Unknown
 +
|-
 +
|<tt>0004</tt>
 +
|<tt>E06019B1BD5C9130ED6A4D9F4A9E7193</tt>
 +
|<tt>A200000000000000708DF1A731717D0B</tt>
 +
| Get secured gamecard ID, response=9000FEC2
 +
|-
 +
|<tt>0004</tt>
 +
|<tt>4E0D224862523BBFE2E6255F80E15F37</tt>
 +
|<tt>A200000000000000708DF1A731717D0B</tt>
 +
| Get secured gamecard ID, response=9000FEC2
 +
|-
 +
|<tt>0004</tt>
 +
|<tt>4CDF93D319FB62D0DB632A45E3E8D84C</tt>
 +
|<tt>A200000000000000708DF1A731717D0B</tt>
 +
| Get secured gamecard ID, response=9000FEC2
 +
|-
 +
|<tt>0004</tt>
 +
|<tt>9AA5D80551002F955546D296A57F0FEF</tt>
 +
|<tt>A200000000000000708DF1A731717D0B</tt>
 +
| Get secured gamecard ID, response=9000FEC2
 +
|-
 +
|<tt>0004</tt>
 +
|<tt>C12BA81AEF30DDDBD93FAD5D544C6334</tt>
 +
|<tt>A200000000000000708DF1A731717D0B</tt>
 +
| Get secured gamecard ID, response=9000FEC2
 +
|-
 +
|<tt>0200</tt>
 +
|<tt>62EC5FB7F420AE1DC6253AE18AFA5BB3</tt>
 +
|<tt>BF000000000000000000000000000000</tt>
 +
| Read address 0
 +
|-
 +
|<tt>0200</tt>
 +
|<tt>E3FA23AA016BE0C93430D1F42FF41324</tt>
 +
|<tt>BF000000000040000000000000000000</tt>
 +
| Read address 0x4000
 +
|}
 +
 +
头部命令有一些无用的初始字节，最后返回一个0x200字节的头部。下面是乐高星球大战3( Lego Starwars 3)的样本:
 +
 +
（The header command has some initial dummy bytes, and eventually responds with a 0x200 byte header. Here's an example for Lego Starwars 3:）
 +
0000000: 00 8c 03 00 00 00 04 00 00 00 00 00 00 00 00 00  ................
 +
0000010: b3 cf fb c6 6a b1 cb 20 32 af ce 35 d4 1c 74 c9  ....j.. 2..5..t.
 +
0000020: 8e 6b 27 2f 08 01 28 3b d4 30 de 44 37 f5 b0 46  .k'/..(;.0.D7..F
 +
0000030: 91 59 d7 38 33 48 df 83 fd 71 84 2c 00 00 00 00  .Y.83H...q.,....
 +
0000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 +
0000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 +
0000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 +
0000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 +
0000080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 +
0000090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 +
00000a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 +
00000b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 +
00000c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 +
00000d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 +
00000e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 +
00000f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 +
0000100: 4e 43 43 48 7a 7f 0e 00 00 8c 03 00 00 00 04 00  NCCHz...........
 +
0000110: 36 34 02 00 00 00 00 00 00 8c 03 00 00 00 04 00  64..............
 +
0000120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 +
0000130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 +
0000140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 +
0000150: 43 54 52 2d 50 2d 41 4c 47 50 00 00 00 00 00 00  CTR-P-ALGP......
 +
0000160: 0c 27 e3 c1 de 7b 2a e2 d3 11 4f 32 a4 ee bf 46  .'...{*...O2...F
 +
0000170: 9a fd 0c f3 52 c1 1d 49 84 c2 a9 f1 d2 14 4c 63  ....R..I......Lc
 +
0000180: 00 04 00 00 00 00 00 00 00 00 00 00 01 03 00 00  ................
 +
0000190: 05 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00  ................
 +
00001a0: 06 00 00 00 1c 0a 00 00 01 00 00 00 00 00 00 00  ................
 +
00001b0: 22 0a 00 00 58 75 0e 00 01 00 00 00 00 00 00 00  "...Xu..........
 +
00001c0: 13 0c 04 26 15 f6 47 c4 c6 32 25 ea 9e 67 f8 a2  ...&..G..2%..g..
 +
00001d0: 7b 15 24 6b 88 fb c7 a9 27 25 7b 84 97 7b 78 7b  {.$k....'%{..{x{
 +
00001e0: a6 5b ee 10 60 bb 6a 68 21 bb ce c6 00 03 5b 7e  .[..`.jh!.....[~
 +
00001f0: 64 fb 6e ac a7 f0 96 0c fb 1f 5a 37 08 77 28 f7  d.n.......Z7.w(.

Revision as of 19:37, 11 March 2012

A 3DS gamecard
Close-up of PCB

物理接口

3ds游戏卡带拥有与通常DS或DSi一样的物理接口。它们的区别只有塑料卡壳右上角的一个装饰槽，它能阻止卡带插入到旧的Nintendo DS或DSi系统中。

当去除装饰槽以使卡带适于插入DS或DSi系统中时，它们拒绝检测卡带，并无法显示标题图标。

引脚 名称 描述
1 GND 接地。
2 CLK 时钟信号。DS/DSi游戏卡带频率分别为6.7MHz和4.2MHz，3DS游戏卡带上升到16.6MHz（用于SPI和ROM传输）。
3 NC 未连接。可能用于编程卡(program card?翻译待查证)。
4 RCS ROM选择，低电平有效。送低电平开始传输ROM。
5 RST 重置信号。低电平有效。
6 ECS 存游戏芯片（Savegame chip）选择，低电平有效。送低电平开始存游戏SPI传输（savegame SPI transfer）。
7 IRQ 移除检测。
8 VCC 提供3.3V电压。
9 DAT0 双向数据总线。
10 DAT1 双向数据总线。
11 DAT2 双向数据总线。
12 DAT3 双向数据总线。
13 DAT4 双向数据总线 /存游戏芯片上的NC/SIO3引脚。
14 DAT5 双向数据总线 /存游戏芯片上的WP#/SIO2引脚。
15 DAT6 双向数据总线 /存游戏芯片上的SO/SIO1引脚。
16 DAT7 双向数据总线 /存游戏芯片上的SI/SIO0引脚。
17 GND 接地。


SPI闪存

目前为止，只有存游戏闪存芯片(savegame FLASH chip)被识别了。这块芯片被识别为0xC22211。JEDEC制造ID为Macronix，此外芯片标签为25L1001，与 MX25L1021E相符。 数据表位于：http://www.macronix.com/QuickPlace/hq/PageLibrary4825740B00298A3B.nsf/h_Index/3F21BAC2E121E17848257639003A3146/$File/MX25L1021E,%203V,%201Mb,%20v0.01.pdf 。不论如何，MX25L1021E不支持3DS用于与SPI闪存（SPI flash）交换数据的4位宽传输。因此，这可能是一块定制闪存芯片。

格式

Cartridge及系统更新存放在为此预留的区块内。 在ROM里，能找到小于1GB的CART_SIZE_MAX-( 0x280000*(CART_SIZE_MAX/CART_SIZE_128MB) )-0x2000000的更新区块。该区块为0x2000000字节。

通信协议

与DS和DSi游戏卡带相比，3DS系统与3DS游戏卡带的通信协议几乎完全改变了。

在第6个传输以后，命令从8字节变为16字节。可能使用了新的加密手段，比如AES CTR。 使用16字节命令后，数据总线维护0x00直到卡带返回表示准备好的单字节数据0x01，接着是实际数据。每0x200字节块实际数据后，是4字节的（未加密的）该字节块的标准CRC32码。

( After the sixth transfer, commands change size from 8 bytes to 16 bytes. Possibly a new encryption is used, such as AES CTR. When 16-byte commands are used, the data bus maintains the value 0x00 until the card signals it is ready by clocking a single byte 0x01, followed by the actual data. After each 0x200-byte block of actual data, a 4-byte standard CRC32 of the block data (before encryption) follows. )

下面是3DS发送给3DS游戏卡带的一组游戏卡带命令样本:

Here's a set of sample gamecard commands that a 3DS sends to a 3DS gamecard:

大小 命令 解码命令 描述
2000 9F00000000000000 Reset
0000 71C93FE9BB0A3B18 Unknown
0004 9000000000000000 Get gamecard ID, response=9000FEC2
0004 9000000000000000 Get gamecard ID, response=9000FEC2
0004 A000000000000000 Unknown, response=00000000
0000 3E00000000000000 Enter 16-byte command mode.
0200 82000000000000000000000000000000 Get header
0000 F32C92D85C9D44DED3E0E41DBE7C90D9 8300000000000000708DF1A731717D0B Seed
0004 696B9D8582FB55D31B68CAFE70C74A95 A200000000000000708DF1A731717D0B Get secured gamecard ID, response=9000FEC2
0004 BAA4812CA0AC9C5D19399530E3ACCCAB A300000000000000708DF1A731717D0B Unknown
0000 178E427C22D87ADB86387249A97D321A C500000000000000708DF1A731717D0B Unknown
0004 E06019B1BD5C9130ED6A4D9F4A9E7193 A200000000000000708DF1A731717D0B Get secured gamecard ID, response=9000FEC2
0004 4E0D224862523BBFE2E6255F80E15F37 A200000000000000708DF1A731717D0B Get secured gamecard ID, response=9000FEC2
0004 4CDF93D319FB62D0DB632A45E3E8D84C A200000000000000708DF1A731717D0B Get secured gamecard ID, response=9000FEC2
0004 9AA5D80551002F955546D296A57F0FEF A200000000000000708DF1A731717D0B Get secured gamecard ID, response=9000FEC2
0004 C12BA81AEF30DDDBD93FAD5D544C6334 A200000000000000708DF1A731717D0B Get secured gamecard ID, response=9000FEC2
0200 62EC5FB7F420AE1DC6253AE18AFA5BB3 BF000000000000000000000000000000 Read address 0
0200 E3FA23AA016BE0C93430D1F42FF41324 BF000000000040000000000000000000 Read address 0x4000

头部命令有一些无用的初始字节，最后返回一个0x200字节的头部。下面是乐高星球大战3( Lego Starwars 3)的样本:

（The header command has some initial dummy bytes, and eventually responds with a 0x200 byte header. Here's an example for Lego Starwars 3:） 

0000000: 00 8c 03 00 00 00 04 00 00 00 00 00 00 00 00 00  ................
0000010: b3 cf fb c6 6a b1 cb 20 32 af ce 35 d4 1c 74 c9  ....j.. 2..5..t.
0000020: 8e 6b 27 2f 08 01 28 3b d4 30 de 44 37 f5 b0 46  .k'/..(;.0.D7..F
0000030: 91 59 d7 38 33 48 df 83 fd 71 84 2c 00 00 00 00  .Y.83H...q.,....
0000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0000080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0000090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0000100: 4e 43 43 48 7a 7f 0e 00 00 8c 03 00 00 00 04 00  NCCHz...........
0000110: 36 34 02 00 00 00 00 00 00 8c 03 00 00 00 04 00  64..............
0000120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0000130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0000140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0000150: 43 54 52 2d 50 2d 41 4c 47 50 00 00 00 00 00 00  CTR-P-ALGP......
0000160: 0c 27 e3 c1 de 7b 2a e2 d3 11 4f 32 a4 ee bf 46  .'...{*...O2...F
0000170: 9a fd 0c f3 52 c1 1d 49 84 c2 a9 f1 d2 14 4c 63  ....R..I......Lc
0000180: 00 04 00 00 00 00 00 00 00 00 00 00 01 03 00 00  ................
0000190: 05 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00  ................
00001a0: 06 00 00 00 1c 0a 00 00 01 00 00 00 00 00 00 00  ................
00001b0: 22 0a 00 00 58 75 0e 00 01 00 00 00 00 00 00 00  "...Xu..........
00001c0: 13 0c 04 26 15 f6 47 c4 c6 32 25 ea 9e 67 f8 a2  ...&..G..2%..g..
00001d0: 7b 15 24 6b 88 fb c7 a9 27 25 7b 84 97 7b 78 7b  {.$k....'%{..{x{
00001e0: a6 5b ee 10 60 bb 6a 68 21 bb ce c6 00 03 5b 7e  .[..`.jh!.....[~
00001f0: 64 fb 6e ac a7 f0 96 0c fb 1f 5a 37 08 77 28 f7  d.n.......Z7.w(.
Retrieved from "https://www.3dbrew.org/w/index.php?title=游戏卡带&oldid=2619"