物理接口Edit
3ds游戏卡带拥有与DS和DSi有一样的物理接口。他们的区别只有3DS游戏卡带的塑料壳右上角有一个防呆槽,它能阻止3DS卡带插入到旧的Nintendo DS或DSi主机中。
即使去除防呆槽并把卡带插入DS或DSi主机中,系统也会拒绝检测卡带,并且不能显示标题图标。
引脚 | 名称 | 描述 |
---|---|---|
1 | GND | 接地。 |
2 | CLK | 时钟信号。DS/DSi游戏卡带频率分别为6.7MHz和4.2MHz,3DS游戏卡带高达16.6MHz(用于SPI和ROM传输)。 |
3 | NC | 未连接。可能用于编程卡(program card?翻译待查证)。 |
4 | RCS | ROM选择,低电平有效。送低电平开始传输ROM。 |
5 | RST | 重置信号。低电平有效。 |
6 | ECS | 存游戏芯片(Savegame chip)选择,低电平有效。送低电平开始存游戏SPI传输(savegame SPI transfer)。 |
7 | IRQ | 移除检测。 |
8 | VCC | 提供3.3V电压。 |
9 | DAT0 | 双向数据总线。 |
10 | DAT1 | 双向数据总线。 |
11 | DAT2 | 双向数据总线。 |
12 | DAT3 | 双向数据总线。 |
13 | DAT4 | 双向数据总线 /存游戏芯片上的NC/SIO3引脚。 |
14 | DAT5 | 双向数据总线 /存游戏芯片上的WP#/SIO2引脚。 |
15 | DAT6 | 双向数据总线 /存游戏芯片上的SO/SIO1引脚。 |
16 | DAT7 | 双向数据总线 /存游戏芯片上的SI/SIO0引脚。 |
17 | GND | 接地。 |
SPI闪存Edit
目前为止,只有存游戏闪存芯片(savegame FLASH chip)被识别了。这块芯片被识别为0xC22211。JEDEC制造ID为Macronix,此外芯片标签为25L1001,与 MX25L1021E相符。
数据表位于:http://www.macronix.com/QuickPlace/hq/PageLibrary4825740B00298A3B.nsf/$defaultview/3F21BAC2E121E17848257639003A3146/$File/MX25L1021E%2C%203V%2C%201Mb%2C%20v1.1.pdf?OpenElement
http://www.beilenet.com/download/MX25L1021E,%203V,%201Mb,%20v0.01.pdf(old version mirror)
。不论如何,MX25L1021E不支持3DS用于与SPI闪存(SPI flash)交换数据的4位宽传输。因此,这可能是一块定制闪存芯片。
格式Edit
Cartridge及系统更新存放在为此预留的区块内。 在ROM里,能找到小于1GB的CART_SIZE_MAX-( 0x280000*(CART_SIZE_MAX/CART_SIZE_128MB) )-0x2000000的更新区块。该区块为0x2000000字节。
通信协议Edit
与DS和DSi游戏卡带相比,3DS系统与3DS游戏卡带的通信协议几乎完全改变了。
在第6个传输以后,命令从8 byte变为16 byte。可能使用了新的加密手段,比如AES CTR。 发送16 byte命令之后,卡带准备好并发送一个单字节数据0x01之前,数据总线一直为0x00直到。接下来是实际数据。每0x200-byte 实际数据块之后,是4-byte该字节块的标准CRC32码(未加密)。
下面是一个3DS主机给3DS游戏卡带的发送的命令样本:
大小 | 命令 | 解码命令 | 描述 |
---|---|---|---|
2000 | 9F00000000000000 | Reset | |
0000 | 71C93FE9BB0A3B18 | Unknown | |
0004 | 9000000000000000 | Get gamecard ID, response=9000FEC2 | |
0004 | 9000000000000000 | Get gamecard ID, response=9000FEC2 | |
0004 | A000000000000000 | Unknown, response=00000000 | |
0000 | 3E00000000000000 | Enter 16-byte command mode. | |
0200 | 82000000000000000000000000000000 | Get header | |
0000 | F32C92D85C9D44DED3E0E41DBE7C90D9 | 8300000000000000708DF1A731717D0B | Seed |
0004 | 696B9D8582FB55D31B68CAFE70C74A95 | A200000000000000708DF1A731717D0B | Get secured gamecard ID, response=9000FEC2 |
0004 | BAA4812CA0AC9C5D19399530E3ACCCAB | A300000000000000708DF1A731717D0B | Unknown |
0000 | 178E427C22D87ADB86387249A97D321A | C500000000000000708DF1A731717D0B | Unknown |
0004 | E06019B1BD5C9130ED6A4D9F4A9E7193 | A200000000000000708DF1A731717D0B | Get secured gamecard ID, response=9000FEC2 |
0004 | 4E0D224862523BBFE2E6255F80E15F37 | A200000000000000708DF1A731717D0B | Get secured gamecard ID, response=9000FEC2 |
0004 | 4CDF93D319FB62D0DB632A45E3E8D84C | A200000000000000708DF1A731717D0B | Get secured gamecard ID, response=9000FEC2 |
0004 | 9AA5D80551002F955546D296A57F0FEF | A200000000000000708DF1A731717D0B | Get secured gamecard ID, response=9000FEC2 |
0004 | C12BA81AEF30DDDBD93FAD5D544C6334 | A200000000000000708DF1A731717D0B | Get secured gamecard ID, response=9000FEC2 |
0200 | 62EC5FB7F420AE1DC6253AE18AFA5BB3 | BF000000000000000000000000000000 | Read address 0 |
0200 | E3FA23AA016BE0C93430D1F42FF41324 | BF000000000040000000000000000000 | Read address 0x4000 |
头部命令有一些无用的初始字节,最后返回一个0x200字节的头部。下面是乐高星球大战3( Lego Starwars 3)的样本:
(The header command has some initial dummy bytes, and eventually responds with a 0x200 byte header. Here's an example for Lego Starwars 3:)
0000000: 00 8c 03 00 00 00 04 00 00 00 00 00 00 00 00 00 ................ 0000010: b3 cf fb c6 6a b1 cb 20 32 af ce 35 d4 1c 74 c9 ....j.. 2..5..t. 0000020: 8e 6b 27 2f 08 01 28 3b d4 30 de 44 37 f5 b0 46 .k'/..(;.0.D7..F 0000030: 91 59 d7 38 33 48 df 83 fd 71 84 2c 00 00 00 00 .Y.83H...q.,.... 0000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0000080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0000090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0000100: 4e 43 43 48 7a 7f 0e 00 00 8c 03 00 00 00 04 00 NCCHz........... 0000110: 36 34 02 00 00 00 00 00 00 8c 03 00 00 00 04 00 64.............. 0000120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0000130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0000140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0000150: 43 54 52 2d 50 2d 41 4c 47 50 00 00 00 00 00 00 CTR-P-ALGP...... 0000160: 0c 27 e3 c1 de 7b 2a e2 d3 11 4f 32 a4 ee bf 46 .'...{*...O2...F 0000170: 9a fd 0c f3 52 c1 1d 49 84 c2 a9 f1 d2 14 4c 63 ....R..I......Lc 0000180: 00 04 00 00 00 00 00 00 00 00 00 00 01 03 00 00 ................ 0000190: 05 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ 00001a0: 06 00 00 00 1c 0a 00 00 01 00 00 00 00 00 00 00 ................ 00001b0: 22 0a 00 00 58 75 0e 00 01 00 00 00 00 00 00 00 "...Xu.......... 00001c0: 13 0c 04 26 15 f6 47 c4 c6 32 25 ea 9e 67 f8 a2 ...&..G..2%..g.. 00001d0: 7b 15 24 6b 88 fb c7 a9 27 25 7b 84 97 7b 78 7b {.$k....'%{..{x{ 00001e0: a6 5b ee 10 60 bb 6a 68 21 bb ce c6 00 03 5b 7e .[..`.jh!.....[~ 00001f0: 64 fb 6e ac a7 f0 96 0c fb 1f 5a 37 08 77 28 f7 d.n.......Z7.w(.