157
edits
Changes
Jump to navigation
Jump to search
Line 11:
Line 11: − + − + − + − + − + − + − + − + − + + + + + + − + + − | Bidirectional data bus. − | Bidirectional data bus. − | Bidirectional data bus. − + − + − + − + − + + + + + + + + + + + + + + + + + + + + + + + + + + + + + − + + Line 94:
Line 126: + − + − + − + + − + − + − + + − + − + − + + − + − + + − + − + + − + − + + − + − + + − + − + − + + + + + + + + + + + + + + + + + + + + + + + + + + + − + − + − + + − + − + − + + − + − + − + + − + − + − + + − + − + − + +
Card-detect info
! Pin
! Pin
! Name
! Name
! Description
!colspan="2"| Description
|-
|-
| 1
| 1
| GND
| GND
| Ground
|colspan="2"| Ground
|-
|-
| 2
| 2
| CLK
| CLK
| Clock. Frequencies 6.7MHz and 4.2MHz)
|colspan="2"| Clock. Frequencies 6.7MHz and 4.2MHz for DS/DSi gamecards, up to 16.6MHz for 3DS gamecards (for both SPI and ROM transfers).
|-
|-
| 3
| 3
| NC
| NC
| Not connected. Possibly used to program cards.
|colspan="2"| Not connected. Possibly used to program cards.
|-
|-
| 4
| 4
| RCS
| RCS
| ROM select, active low. Pulled low to start a ROM transfer.
|colspan="2"| ROM select, active low. Pulled low to start a ROM transfer.
|-
|-
| 5
| 5
| RST
| RST
| Reset, active low.
|colspan="2"| Reset, active low.
|-
|-
| 6
| 6
| ECS
| ECS
| Savegame chip select, active low. Pulled low to start a savegame SPI transfer.
|colspan="2"| Savegame chip select, active low. Pulled low to start a savegame SPI transfer.
|-
|-
| 7
| 7
| IRQ
| IRQ
| Removal detection.
|colspan="2"| Removal detection.
|-
|-
| 8
| 8
| VCC
| VCC
| Powersupply 3.3V.
|colspan="2"| Powersupply 3.3V.
|-
!
!
! ROM bus (selected by RCS)
! Savegame bus (selected by ECS)
|-
|-
| 9
| 9
| DAT0
| DAT0
| Bidirectional data bus.
|rowspan="8"| Bidirectional data bus.
|rowspan="4"| NC
|-
|-
| 10
| 10
| DAT1
| DAT1
|-
|-
| 11
| 11
| DAT2
| DAT2
|-
|-
| 12
| 12
| DAT3
| DAT3
|-
|-
| 13
| 13
| DAT4
| DAT4
| Bidirectional data bus.
| NC/SIO3
|-
|-
| 14
| 14
| DAT5
| DAT5
| Bidirectional data bus.
| WP#/SIO2
|-
|-
| 15
| 15
| DAT6
| DAT6
| Bidirectional data bus / SPI data from savegame chip.
| SO/SIO1
|-
|-
| 16
| 16
| DAT7
| DAT7
| Bidirectional data bus / SPI data to savegame chip.
| SI/SIO0
|-
|-
| 17
| 17
| GND
| GND
| Ground
|colspan="2"| Ground
|}
{| class="wikitable" border="1"
|-
!
! 3DS
! DS and DSi
|-
| VCC
| Only enabled when the power supply bits of [[CONFIG9_Registers#CFG9_CARDSTATUS|CFG9_CARDSTATUS]] are set to <tt>10</tt>
| Always available when card is detected
|-
| Card-detect
| Physical insertion switch, readable through [[CONFIG9_Registers#CFG9_CARDSTATUS|CFG9_CARDSTATUS]] bit 0
| IRQ pin
|-
| Time to first clock pulse
| ~280ms
| ~166ms
|}
|}
===SPI flash===
Savegame SPI flash transfers use CPOL=1 and CPHA=1. So far, only one savegame FLASH chip has been identified. The chip identifies as <tt>0xC22211</tt>. The JEDEC manufacturer ID is Macronix, and despite the chip label saying 25L1001, the JEDEC ID matches the MX25L1021E. Datasheet at:<br>
[https://www.macronix.com/Lists/Datasheet/Attachments/8796/MX25L1021E,%203V,%201Mb,%20v1.3.pdf Macronix (Rev. 1.3, nov. 11, 2013)] <br>
[https://web.archive.org/web/20160307235354/http://www.beilenet.com/download/MX25L1021E,%203V,%201Mb,%20v0.01.pdf Old version mirror (Rev. 0.01, apr. 07, 2010)] <br>
However, the MX25L1021E doesn't support the 4 bit wide transmission that the 3DS uses to talk to the SPI flash. It is thus likely that this is a custom flash chip.
===Format===
Cartridges can come in several sizes and include system updates in a region reserved for this. In ROMs less than 1GB the update region can be found with:
CART_SIZE_MAX-( 0x280000*(CART_SIZE_MAX/CART_SIZE_128MB) )-0x2000000. The region is then 0x2000000 bytes.
===Protocol===
===Protocol===
The communication protocol between the 3DS system and the 3DS gamecard has changed almost completely in comparison with the DS and DSi gamecard communication protocol.
The communication protocol between the 3DS system and the 3DS gamecard has changed almost completely in comparison with the [http://problemkaputt.de/gbatek.htm#dscartridgeprotocol DS and DSi gamecard communication protocol].
After the sixth transfer, commands change size from 8 bytes to 16 bytes. Possibly a new encryption is used, such as AES CTR.
After the sixth transfer, commands change size from 8 bytes to 16 bytes. Possibly a new encryption is used, such as AES CTR.
When 16-byte commands are used, the data bus maintains the value 0x00 until the card signals it is ready by clocking a single byte 0x01, followed by the actual data. After each 0x200-byte block of actual data, a 4-byte standard CRC32 of the block data (before encryption) follows.
Here's a set of sample gamecard commands that a 3DS sends to a 3DS gamecard:
Here's a set of sample gamecard commands that a 3DS sends to a 3DS gamecard:
! Size
! Size
! Command
! Command
! Decrypted command
! Description
! Description
|-
|-
|2000
|<tt>2000</tt>
|9F00000000000000
|<tt>9F00000000000000</tt>
| Reset
|?
|Reset
|-
|-
|0000
|<tt>0000</tt>
|71C93FE9BB0A3B18
|<tt>71C93FE9BB0A3B18</tt>
| Unknown
|?
|Unknown
|-
|-
|0004
|<tt>0004</tt>
|9000000000000000
|<tt>9000000000000000</tt>
| Get gamecard ID, response=9000FEC2
|?
|Get gamecard ID, response=9000FEC2
|-
|-
|0004
|<tt>0004</tt>
|9000000000000000
|<tt>9000000000000000</tt>
|?
| Get gamecard ID, response=9000FEC2
| Get gamecard ID, response=9000FEC2
|-
|-
|0004
|<tt>0004</tt>
|A000000000000000
|<tt>A000000000000000</tt>
|?
| Unknown, response=00000000
| Unknown, response=00000000
|-
|-
|0000
|<tt>0000</tt>
|3E00000000000000
|<tt>3E00000000000000</tt>
|?
| Enter 16-byte command mode.
| Enter 16-byte command mode.
|-
|-
|07EC
|<tt>0200</tt>
|82000000000000000000000000000000
|<tt>82000000000000000000000000000000</tt>
|?
| Get header
| Get header
|-
|-
|05E3
|<tt>0000</tt>
|F32C92D85C9D44DED3E0E41DBE7C90D9
|<tt>F32C92D85C9D44DED3E0E41DBE7C90D9</tt>
| Encrypted, unknown
|<tt>8300000000000000708DF1A731717D0B</tt>
| Seed
|-
|<tt>0004</tt>
|<tt>696B9D8582FB55D31B68CAFE70C74A95</tt>
|<tt>A200000000000000708DF1A731717D0B</tt>
| Get secured gamecard ID, response=9000FEC2
|-
|<tt>0004</tt>
|<tt>BAA4812CA0AC9C5D19399530E3ACCCAB</tt>
|<tt>A300000000000000708DF1A731717D0B</tt>
| Unknown
|-
|<tt>0000</tt>
|<tt>178E427C22D87ADB86387249A97D321A</tt>
|<tt>C500000000000000708DF1A731717D0B</tt>
| Unknown
|-
|<tt>0004</tt>
|<tt>E06019B1BD5C9130ED6A4D9F4A9E7193</tt>
|<tt>A200000000000000708DF1A731717D0B</tt>
| Get secured gamecard ID, response=9000FEC2
|-
|<tt>0004</tt>
|<tt>4E0D224862523BBFE2E6255F80E15F37</tt>
|<tt>A200000000000000708DF1A731717D0B</tt>
| Get secured gamecard ID, response=9000FEC2
|-
|-
|0332
|<tt>0004</tt>
|696B9D8582FB55D31B68CAFE70C74A95
|<tt>4CDF93D319FB62D0DB632A45E3E8D84C</tt>
| Encrypted, unknown
|<tt>A200000000000000708DF1A731717D0B</tt>
| Get secured gamecard ID, response=9000FEC2
|-
|-
|0332
|<tt>0004</tt>
|BAA4812CA0AC9C5D19399530E3ACCCAB
|<tt>9AA5D80551002F955546D296A57F0FEF</tt>
| Encrypted, unknown
|<tt>A200000000000000708DF1A731717D0B</tt>
| Get secured gamecard ID, response=9000FEC2
|-
|-
|032E
|<tt>0004</tt>
|178E427C22D87ADB86387249A97D321A
|<tt>C12BA81AEF30DDDBD93FAD5D544C6334</tt>
| Encrypted, unknown
|<tt>A200000000000000708DF1A731717D0B</tt>
| Get secured gamecard ID, response=9000FEC2
|-
|-
|0332
|<tt>0200</tt>
|E06019B1BD5C9130ED6A4D9F4A9E7193
|<tt>62EC5FB7F420AE1DC6253AE18AFA5BB3</tt>
| Encrypted, unknown
|<tt>BF000000000000000000000000000000</tt>
| Read address 0
|-
|-
|0332
|<tt>0200</tt>
|4E0D224862523BBFE2E6255F80E15F37
|<tt>E3FA23AA016BE0C93430D1F42FF41324</tt>
| Encrypted, unknown
|<tt>BF000000000040000000000000000000</tt>
| Read address 0x4000
|}
|}