Search found 17 matches
- Thu Apr 02, 2020 2:11 pm
- Forum: Other Retro Dev
- Topic: 3DS reverse engineering
- Replies: 322
- Views: 269855
Re: 3DS reverse engineering
Have you tried first switching to NDS/DSi mode before switching to GBA mode? It sounds as though you're switching from 3DS to GBA mode directly, and I don't know if the 3DS is designed to do that. It might help to look at what AGB_FIRM does for initializing the various magic registers as well.
- Mon Jan 06, 2020 3:42 am
- Forum: Other Retro Dev
- Topic: 3DS reverse engineering
- Replies: 322
- Views: 269855
Re: 3DS reverse engineering
PKCS means Public-Key Cryptography Standards. It's the format used for RSA signatures in the 3DS, which consists of padding, some metadata, and an SHA-256 hash. Probably all of this is useful to avoid brute-force, though I'm not a crypto expert. The public keys should be more important in everyday 3...
- Wed Aug 14, 2019 1:28 pm
- Forum: Other Retro Dev
- Topic: 3DS reverse engineering
- Replies: 322
- Views: 269855
Re: 3DS reverse engineering
wifiboot: It does seem nonsensical to change from system to supervisor mode. Nevertheless, that's how it is, and people expect FIRMs to work from all sources. MMU: 4K pages and 64K pages aren't entirely identical. 4K has an XN bit, but 64K doesn't. --- I've acquired the AR6014 ROM and have begun wri...
- Mon Aug 12, 2019 3:23 pm
- Forum: Other Retro Dev
- Topic: 3DS reverse engineering
- Replies: 322
- Views: 269855
Re: 3DS reverse engineering
I have decompressed the firmware that NWM uploads, and surprisingly, it appears to be Type1. It contains the string A_INIT() FAILED and is only about ~0x1A00 bytes when compressed. As expected, it is a newer firmware version than what you have: 0x230000EC. I will try to examine this firmware to see ...
- Sun Aug 11, 2019 9:00 pm
- Forum: Other Retro Dev
- Topic: 3DS reverse engineering
- Replies: 322
- Views: 269855
Re: 3DS reverse engineering
I figured out the problem with wifiboot. It was crashing because it assumes that CPSR is in system mode in the entry point, but Luma3DS loads all FIRM payloads in supervisor mode. This is a problem because the wifiboot function that initializes stack pointers for the different modes leaves CPSR in s...
- Sun Aug 11, 2019 6:07 pm
- Forum: Other Retro Dev
- Topic: 3DS reverse engineering
- Replies: 322
- Views: 269855
Re: 3DS reverse engineering
WiFi checklist: - Some of it I've ignored, but I do handle at least the EEPROM and chip ID. NWM crashes after BMI if those aren't correct. - Yes, the full handshake goes through. - I do handle Mbox IRQs for the last step of the handshake, but on my version of NWM, this is also handled on IRQ 40h. NW...
- Sat Aug 10, 2019 8:48 pm
- Forum: Other Retro Dev
- Topic: 3DS reverse engineering
- Replies: 322
- Views: 269855
Re: 3DS reverse engineering
Handshake: Ah yes, I thought from reading GBAtek that it went straight to WMI after BMI_DONE. Well, adding REGDOMAIN like you said doesn't help matters either - it does receive and process the event, but it just hangs in the same place. Clearly there's something else I'm missing... eventually I will...
- Sat Aug 10, 2019 12:52 pm
- Forum: Other Retro Dev
- Topic: 3DS reverse engineering
- Replies: 322
- Views: 269855
Re: 3DS reverse engineering
I would have thought that WMI_SYNCHRONIZE would occur a bit later than WMI_READY_EVENT, but that might be timed a bit differently in NWM versus DSi Launcher (which doesn't use SYNCHRONIZE at all as it's only uploading the firmware). Anyways, the initialization should look as so: BMI commands, then ...
- Wed Aug 07, 2019 9:33 am
- Forum: Other Retro Dev
- Topic: 3DS reverse engineering
- Replies: 322
- Views: 269855
Re: 3DS reverse engineering
nocash, is there a special dumper you used to dump the WiFi ROM? I have started working on WiFi stuff in my 3DS emulator, and I'm running into problems with the handshake protocol - NWM hangs after I send a WMI_READY reply when it does a WMI_SYNCHRONIZE command. So I'd like to see what's different o...
- Tue Jul 23, 2019 3:12 pm
- Forum: Other Retro Dev
- Topic: 3DS reverse engineering
- Replies: 322
- Views: 269855
Re: 3DS reverse engineering
The ARM datasheet has this sentence - One consequence of the strict comparison is that a Pending interrupt with the lowest possible priority, 0xF, never causes the assertion of an interrupt request to MP11 CPUs, permitting an extra level of interrupt enabling It isn't quite clear what they are tryi...
- Sat Jun 15, 2019 5:00 pm
- Forum: Other Retro Dev
- Topic: 3DS reverse engineering
- Replies: 322
- Views: 269855
Re: 3DS reverse engineering
Does 3DS/ARM11 support THUMB2 instruction set? They do not. All ARM11 kernel/process code I've seen thus far only uses ARM mode as well. The ARM9 mainly uses Thumb mode. The CDMA/XDMA controllers have their own instruction set??? Though I don't see that when looking at the CDMA/XDMA functions in bo...
- Thu Jun 13, 2019 7:42 pm
- Forum: Other Retro Dev
- Topic: 3DS reverse engineering
- Replies: 322
- Views: 269855
Re: 3DS reverse engineering
Cool! I am still far away from emulating anything myself. I will probably first do some tests on how the hardware is working (there are some things that I wanted to know for years, and now I can finally test them). Well, and I am a bit afraid of trying to allocate 128Mbytes of MainRAM in no$gba... ...
- Wed Jun 12, 2019 3:41 pm
- Forum: Other Retro Dev
- Topic: 3DS reverse engineering
- Replies: 322
- Views: 269855
Re: 3DS reverse engineering
Another progress report! After fixing countless CPU, MMU, DMA, eMMC, and PMR bugs, we finally have sysmodules running on the emulator. Kernel11 manages to load these modules: PXI, FS, PM, and SM. All four modules are running as their own processes mapped in userland. Process9 initialization is compl...
- Wed Jun 05, 2019 7:37 am
- Forum: Other Retro Dev
- Topic: 3DS reverse engineering
- Replies: 322
- Views: 269855
Re: 3DS reverse engineering
I've made some more progress on my own emulator. I hit a wall in getting Process9 to work, so I implemented the ARM11 MMU to get Kernel11 further. It's very basic and will break once we hit userland, but it'll have to do for now. I also had to redesign my ARM11 interrupt handling to support more tha...
- Thu May 16, 2019 9:36 pm
- Forum: Other Retro Dev
- Topic: 3DS reverse engineering
- Replies: 322
- Views: 269855
Re: 3DS reverse engineering
The MMU is well-documented on ARM's official docs. I haven't looked too deeply into it, although I know a few things: it's completely accessed through CP15 registers, it works through a "page-walking" scheme (where the code provides pointers to page tables in memory to the MMU), and page s...