There has been alot of tinkering with the 3DS since launch, and although there have been leaps and bounds due to the combined efforts of many contributors, much of what we're doing would be expedited by extracting the boot code and other proprietary information (secrets) from the custom Nintendo SoC (System-On-a-Chip) of a retail 3DS.
What is chip decapping?
For those that are unfamiliar: the CPU, GPU & DSP all exist on one proprietary SOC design used on the 3DS. Secure information is stored there partly, most likely burned onto the SoC during manufacturing and not readable by any other normal means or from outside of the SoC, in such a way that the secure information there, always stays there. In good design it will never reach the main memory of the 3DS and so sensitive data (like encryption keys or algorithms) stay secure.
Extracting data from a proprietary chip to reverse-engineer it is typically done by decapping it, which is risky business and involves removing the epoxy, delayering the chip and taking high-resolution pictures of every layer to reconstruct logic from the images. Special equipment is used ( SEM / scanning electron microscope ) and it is rarely done outside of a professional context because it is very costly to an average enthusiast ("hacker") and access to equipment and the expertise is hard to realize.
Chip decapping has been used by the "emulation" community to reverse-engineer and recover data from special proprietary chips, such as those in SNES cartridges. It has also been used to to reverse-engineer other hardware to create emulators for other platforms besides the SNES.
How much?
We have gotten a price quote from a professional lab on the deal (removal, decap, delayer, SEM imaging) and it came out to $400 per layer of the chip, which they estimate will come to "about $2000 total". Plus the cost of the 3DS we will be donating for the hardware sample(s).
The numbers of layers is approximate because they likely don't know how many layers are in the SoC until they actually decap it. For now we're trying to reach their initial quote of $2000+ USD and send in the 3DS to get it started. Later on we can still decide to have the remaining layers imaged.
Why should I help?
Kicking it around with other contributors on this site, we all agreed it would be interesting or valuable to us but $2000+ is simply a lot to ask of anyone to drop suddenly on a hobby project. Also $2000+ while a lot for an individual is a very achievable goal for a fund raising.
We created this page here to raise awareness of the fundraiser for this purpose. Now is the chance for you, the viewers of this site, to contribute. You will have the noble honor of helping the 3DS community progress forward. We're also considering giving contributors a copy of the images produced as thanks.
To reiterate, what we're trying to do is: send in initially 1 3DS to a professional lab to get delayered and imaged (covering the costs of doing so). The resulting SEM images will be reconstructed and used towards discovering more of the hardware secrets inside the 3DS.
How likely is this going to help progress?
It is not possible to give a clear answer on this until the 3DS SoC chip has been decapped. But consider the success story about the SNES decapping here. We have a team of proven experts, anxious to have a very thorough look inside the SoC of the 3DS. If there is something Nintendo wanted to hide, you can be sure it will be discovered.
The most likely focus points will be:
- the bootROM, possibly containing flaws which allow us to take control of the system
- secret keys, hidden in hardware, used in cryptographic operations
- secret algorithms, implemented in hardware to obscure information
- and possibly much more
How can I help?
If you'd like to donate and help contribute to this cause you can do so by donating here.
Contact information
User Jl12 is in charge of collecting the donations, and will deliver the final samples to the professional lab for the chip decapping at the end of the fundraiser. Any more questions can be directed to him at his email address jingling0 (at) yahoo (dot) com