Search found 17 matches

by PSI
Thu Apr 02, 2020 2:11 pm
Forum: Other Retro Dev
Topic: 3DS reverse engineering
Replies: 322
Views: 269855

Re: 3DS reverse engineering

Have you tried first switching to NDS/DSi mode before switching to GBA mode? It sounds as though you're switching from 3DS to GBA mode directly, and I don't know if the 3DS is designed to do that. It might help to look at what AGB_FIRM does for initializing the various magic registers as well.
by PSI
Mon Jan 06, 2020 3:42 am
Forum: Other Retro Dev
Topic: 3DS reverse engineering
Replies: 322
Views: 269855

Re: 3DS reverse engineering

PKCS means Public-Key Cryptography Standards. It's the format used for RSA signatures in the 3DS, which consists of padding, some metadata, and an SHA-256 hash. Probably all of this is useful to avoid brute-force, though I'm not a crypto expert. The public keys should be more important in everyday 3...
by PSI
Wed Aug 14, 2019 1:28 pm
Forum: Other Retro Dev
Topic: 3DS reverse engineering
Replies: 322
Views: 269855

Re: 3DS reverse engineering

wifiboot: It does seem nonsensical to change from system to supervisor mode. Nevertheless, that's how it is, and people expect FIRMs to work from all sources. MMU: 4K pages and 64K pages aren't entirely identical. 4K has an XN bit, but 64K doesn't. --- I've acquired the AR6014 ROM and have begun wri...
by PSI
Mon Aug 12, 2019 3:23 pm
Forum: Other Retro Dev
Topic: 3DS reverse engineering
Replies: 322
Views: 269855

Re: 3DS reverse engineering

I have decompressed the firmware that NWM uploads, and surprisingly, it appears to be Type1. It contains the string A_INIT() FAILED and is only about ~0x1A00 bytes when compressed. As expected, it is a newer firmware version than what you have: 0x230000EC. I will try to examine this firmware to see ...
by PSI
Sun Aug 11, 2019 9:00 pm
Forum: Other Retro Dev
Topic: 3DS reverse engineering
Replies: 322
Views: 269855

Re: 3DS reverse engineering

I figured out the problem with wifiboot. It was crashing because it assumes that CPSR is in system mode in the entry point, but Luma3DS loads all FIRM payloads in supervisor mode. This is a problem because the wifiboot function that initializes stack pointers for the different modes leaves CPSR in s...
by PSI
Sun Aug 11, 2019 6:07 pm
Forum: Other Retro Dev
Topic: 3DS reverse engineering
Replies: 322
Views: 269855

Re: 3DS reverse engineering

WiFi checklist: - Some of it I've ignored, but I do handle at least the EEPROM and chip ID. NWM crashes after BMI if those aren't correct. - Yes, the full handshake goes through. - I do handle Mbox IRQs for the last step of the handshake, but on my version of NWM, this is also handled on IRQ 40h. NW...
by PSI
Sat Aug 10, 2019 8:48 pm
Forum: Other Retro Dev
Topic: 3DS reverse engineering
Replies: 322
Views: 269855

Re: 3DS reverse engineering

Handshake: Ah yes, I thought from reading GBAtek that it went straight to WMI after BMI_DONE. Well, adding REGDOMAIN like you said doesn't help matters either - it does receive and process the event, but it just hangs in the same place. Clearly there's something else I'm missing... eventually I will...
by PSI
Sat Aug 10, 2019 12:52 pm
Forum: Other Retro Dev
Topic: 3DS reverse engineering
Replies: 322
Views: 269855

Re: 3DS reverse engineering

I would have thought that WMI_SYNCHRONIZE would occur a bit later than WMI_READY_EVENT, but that might be timed a bit differently in NWM versus DSi Launcher (which doesn't use SYNCHRONIZE at all as it's only uploading the firmware). Anyways, the initialization should look as so: BMI commands, then ...
by PSI
Wed Aug 07, 2019 9:33 am
Forum: Other Retro Dev
Topic: 3DS reverse engineering
Replies: 322
Views: 269855

Re: 3DS reverse engineering

nocash, is there a special dumper you used to dump the WiFi ROM? I have started working on WiFi stuff in my 3DS emulator, and I'm running into problems with the handshake protocol - NWM hangs after I send a WMI_READY reply when it does a WMI_SYNCHRONIZE command. So I'd like to see what's different o...
by PSI
Tue Jul 23, 2019 3:12 pm
Forum: Other Retro Dev
Topic: 3DS reverse engineering
Replies: 322
Views: 269855

Re: 3DS reverse engineering

The ARM datasheet has this sentence - One consequence of the strict comparison is that a Pending interrupt with the lowest possible priority, 0xF, never causes the assertion of an interrupt request to MP11 CPUs, permitting an extra level of interrupt enabling It isn't quite clear what they are tryi...
by PSI
Sat Jun 15, 2019 5:00 pm
Forum: Other Retro Dev
Topic: 3DS reverse engineering
Replies: 322
Views: 269855

Re: 3DS reverse engineering

Does 3DS/ARM11 support THUMB2 instruction set? They do not. All ARM11 kernel/process code I've seen thus far only uses ARM mode as well. The ARM9 mainly uses Thumb mode. The CDMA/XDMA controllers have their own instruction set??? Though I don't see that when looking at the CDMA/XDMA functions in bo...
by PSI
Thu Jun 13, 2019 7:42 pm
Forum: Other Retro Dev
Topic: 3DS reverse engineering
Replies: 322
Views: 269855

Re: 3DS reverse engineering

Cool! I am still far away from emulating anything myself. I will probably first do some tests on how the hardware is working (there are some things that I wanted to know for years, and now I can finally test them). Well, and I am a bit afraid of trying to allocate 128Mbytes of MainRAM in no$gba... ...
by PSI
Wed Jun 12, 2019 3:41 pm
Forum: Other Retro Dev
Topic: 3DS reverse engineering
Replies: 322
Views: 269855

Re: 3DS reverse engineering

Another progress report! After fixing countless CPU, MMU, DMA, eMMC, and PMR bugs, we finally have sysmodules running on the emulator. Kernel11 manages to load these modules: PXI, FS, PM, and SM. All four modules are running as their own processes mapped in userland. Process9 initialization is compl...
by PSI
Wed Jun 05, 2019 7:37 am
Forum: Other Retro Dev
Topic: 3DS reverse engineering
Replies: 322
Views: 269855

Re: 3DS reverse engineering

I've made some more progress on my own emulator. I hit a wall in getting Process9 to work, so I implemented the ARM11 MMU to get Kernel11 further. It's very basic and will break once we hit userland, but it'll have to do for now. I also had to redesign my ARM11 interrupt handling to support more tha...
by PSI
Thu May 16, 2019 9:36 pm
Forum: Other Retro Dev
Topic: 3DS reverse engineering
Replies: 322
Views: 269855

Re: 3DS reverse engineering

The MMU is well-documented on ARM's official docs. I haven't looked too deeply into it, although I know a few things: it's completely accessed through CP15 registers, it works through a "page-walking" scheme (where the code provides pointers to page tables in memory to the MMU), and page s...