nesdev.org

Code: Select all

Content Metadata (.cmd) file format
  00h     4    File number for 000000nn.cmd file (eg. 3=00000003.cmd)
  04h     4    Number of Contents (N)
  08h     4    Number of Contents (N) (same as above)
  0Ch     4h   Zerofilled  ;reportedly always 1  ;\maybe shop titles??
  10h     10h  Zerofilled  ;reportedly AES-MAC   ;/or SD card exports???
  20h     N*4  List of file numbers for 000000nn.app files
  20h+N*4 N*4  List of file numbers for 000000nn.app files (same as above)
  20h+N*8 -    Nothing     ;reportedly more AES-MAC's ???
The .cmd file is reportedly "encrypted with a console unique keyslot"??? (actually, it isn't encrypted at all).

Code: Select all

#pragma once

#include "types.h"
#include "arm9/ncch.h"



#define CARD_ENABLE     (1u<<15)
#define CARD_SPI_ENABLE (1u<<13)
#define CARD_SPI_BUSY   (1u<<7)
#define CARD_SPI_HOLD   (1u<<6)


void resetCardslot(void);
bool gamecardInit(void);
u32  getChipId(void);
u32  getCardType(void);


//////////////////////////////////
//            NTRCARD           //
//////////////////////////////////

#define NTRCARD_PAGESIZE_0         (0u<<24)
#define NTRCARD_PAGESIZE_4         (7u<<24)
#define NTRCARD_PAGESIZE_512       (1u<<24)
#define NTRCARD_PAGESIZE_1K        (2u<<24)
#define NTRCARD_PAGESIZE_2K        (3u<<24)
#define NTRCARD_PAGESIZE_4K        (4u<<24)
#define NTRCARD_PAGESIZE_8K        (5u<<24)
#define NTRCARD_PAGESIZE_16K       (6u<<24)

#define NTRCARD_ACTIVATE           (1u<<31)           // when writing, get the ball rolling
#define NTRCARD_WR                 (1u<<30)           // Card write enable
#define NTRCARD_nRESET             (1u<<29)           // value on the /reset pin (1 = high out, not a reset state, 0 = low out = in reset)
#define NTRCARD_SEC_LARGE          (1u<<28)           // Use "other" secure area mode, which tranfers blocks of 0x1000 bytes at a time
#define NTRCARD_CLK_SLOW           (1u<<27)           // Transfer clock rate (0 = 6.7MHz, 1 = 4.2MHz)
#define NTRCARD_BLK_SIZE(n)        ((n & 0x7u)<<24)   // Transfer block size, (0 = None, 1..6 = (0x100 << n) bytes, 7 = 4 bytes)
#define NTRCARD_SEC_CMD            (1u<<22)           // The command transfer will be hardware encrypted (KEY2)
#define NTRCARD_DELAY2(n)          ((n & 0x3Fu)<<16)  // Transfer delay length part 2
#define NTRCARD_SEC_SEED           (1u<<15)           // Apply encryption (KEY2) seed to hardware registers
#define NTRCARD_SEC_EN             (1u<<14)           // Security enable
#define NTRCARD_SEC_DAT            (1u<<13)           // The data transfer will be hardware encrypted (KEY2)
#define NTRCARD_DELAY1(n)          (n & 0x1FFFu)      // Transfer delay length part 1

// 3 bits in b10..b8 indicate something
// read bits
#define NTRCARD_BUSY               (1u<<31)           // when reading, still expecting incomming data?
#define NTRCARD_DATA_READY         (1u<<23)           // when reading, REG_NTRCARDFIFO has another word of data and is good to go

// Card commands
#define NTRCARD_CMD_DUMMY          (0x9Fu)
#define NTRCARD_CMD_HEADER_READ    (0x00u)
#define NTRCARD_CMD_HEADER_CHIPID  (0x90u)
#define NTRCARD_CMD_ACTIVATE_BF    (0x3Cu)  // Go into blowfish (KEY1) encryption mode
#define NTRCARD_CMD_ACTIVATE_SEC   (0x40u)  // Go into hardware (KEY2) encryption mode
#define NTRCARD_CMD_SECURE_CHIPID  (0x10u)
#define NTRCARD_CMD_SECURE_READ    (0x20u)
#define NTRCARD_CMD_DISABLE_SEC    (0x60u)  // Leave hardware (KEY2) encryption mode
#define NTRCARD_CMD_DATA_MODE      (0xA0u)
#define NTRCARD_CMD_DATA_READ      (0xB7u)
#define NTRCARD_CMD_DATA_CHIPID    (0xB8u)

#define NTRCARD_CR1_ENABLE         (0x8000u)
#define NTRCARD_CR1_IRQ            (0x4000u)

#define NTRKEY_PARAM               (0x3F1FFFu)


void ntrcardCommand(const u32 command[2], u32 pageSize, u32 latency, void* buffer);


//////////////////////////////////
//            CTRCARD           //
//////////////////////////////////

#define CTRCARD_PAGESIZE_0   (0u<<16)
#define CTRCARD_PAGESIZE_4   (1u<<16)
#define CTRCARD_PAGESIZE_16  (2u<<16)
#define CTRCARD_PAGESIZE_64  (3u<<16)
#define CTRCARD_PAGESIZE_512 (4u<<16)
#define CTRCARD_PAGESIZE_1K  (5u<<16)
#define CTRCARD_PAGESIZE_2K  (6u<<16)
#define CTRCARD_PAGESIZE_4K  (7u<<16)
#define CTRCARD_PAGESIZE_16K (8u<<16)
#define CTRCARD_PAGESIZE_64K (9u<<16)

#define CTRCARD_CRC_ERROR    (1u<<4)
#define CTRCARD_ACTIVATE     (1u<<31)           // when writing, get the ball rolling
#define CTRCARD_IE           (1u<<30)           // Interrupt enable
#define CTRCARD_WR           (1u<<29)           // Card write enable
#define CTRCARD_nRESET       (1u<<28)           // value on the /reset pin (1 = high out, not a reset state, 0 = low out = in reset)
#define CTRCARD_BLK_SIZE(n)  ((n & 0xFu)<<16)   // Transfer block size

#define CTRCARD_BUSY         (1u<<31)           // when reading, still expecting incomming data?
#define CTRCARD_DATA_READY   (1u<<27)           // when reading, REG_CTRCARDFIFO has another word of data and is good to go

#define CTRKEY_PARAM         (0x1000000u)


void ctrcardCommand(const u32 command[4], u32 pageSize, u32 blocks, u32 latency, void* buffer);
void ctrcardReadData(u32 sector, u32 length, u32 blocks, void* buffer);
NCCH_header* ctrcardGetHeader(void);
void ctrcardGetUniqueId(u32 *buf);

Code: Select all

#include <string.h>
#include "mem_map.h"
#include "types.h"
#include "util.h"
#include "arm9/hardware/gamecard.h"
#include "arm9/ncch.h"
#include "arm9/hardware/crypto.h"
#include "arm9/hardware/timer.h"


// TODO: This belongs in cfg9.h.
#define CFG_REGS_BASE         (IO_MEM_ARM9_ONLY)
#define REG_CFG9_CARDCTL      *((vu16*)(CFG_REGS_BASE + 0x0000C))
#define REG_CFG9_CARDSTATUS   *((vu8* )(CFG_REGS_BASE + 0x00010))
#define REG_CFG9_CARDCYCLES0  *((vu16*)(CFG_REGS_BASE + 0x00012))
#define REG_CFG9_CARDCYCLES1  *((vu16*)(CFG_REGS_BASE + 0x00014))

#define CTRCARD_REGS_BASE     (IO_MEM_ARM9_ONLY + 0x4000)
#define REG_CTRCARDCNT        *((vu32*)(CTRCARD_REGS_BASE + 0x00))
#define REG_CTRCARDBLKCNT     *((vu32*)(CTRCARD_REGS_BASE + 0x04))
#define REG_CTRCARDSECCNT     *((vu32*)(CTRCARD_REGS_BASE + 0x08))
#define REG_CTRCARDSECSEED    *((vu32*)(CTRCARD_REGS_BASE + 0x10))
#define REGs_CTRCARDCMD        ((vu32*)(CTRCARD_REGS_BASE + 0x20))
#define REG_CTRCARDFIFO       *((vu32*)(CTRCARD_REGS_BASE + 0x30))

#define NTRCARD_REGS_BASE     (IO_MEM_ARM9_ARM11 + 0x64000)
#define REG_NTRCARDMCNT       *((vu16*)(NTRCARD_REGS_BASE + 0x00))
#define REG_NTRCARDMDATA      *((vu16*)(NTRCARD_REGS_BASE + 0x02))
#define REG_NTRCARDROMCNT     *((vu32*)(NTRCARD_REGS_BASE + 0x04))
#define REGs_NTRCARDCMD        ((vu32*)(NTRCARD_REGS_BASE + 0x08))
#define REG_NTRCARDSEEDX_L    *((vu32*)(NTRCARD_REGS_BASE + 0x10))
#define REG_NTRCARDSEEDY_L    *((vu32*)(NTRCARD_REGS_BASE + 0x14))
#define REG_NTRCARDSEEDX_H    *((vu16*)(NTRCARD_REGS_BASE + 0x18))
#define REG_NTRCARDSEEDY_H    *((vu16*)(NTRCARD_REGS_BASE + 0x1A))
#define REG_NTRCARDFIFO       *((vu32*)(NTRCARD_REGS_BASE + 0x1C))


static u32 chipId, cardType;
static u32 cmdRand1, cmdRand2;
static NCCH_header ctrcardHeader;



static bool ctrcardSecureInit(u32 cmdBuf[4]);

void resetCardslot(void)
{
	REG_CFG9_CARDCYCLES0 = 0x1988;
	REG_CFG9_CARDCYCLES1 = 0x264C;
	// boot9 waits here. Unnecessary?

	REG_CFG9_CARDSTATUS = 3u<<2;     // Request power off
	while(REG_CFG9_CARDSTATUS != 0); // Aotomatically changes to 0 (off)
	TIMER_sleep(1);

	REG_CFG9_CARDSTATUS = 1u<<2;     // Prepare power on
	TIMER_sleep(10);

	REG_CFG9_CARDSTATUS = 2u<<2;     // Power on
	TIMER_sleep(27);

	// Switch to NTRCARD controller.
	REG_CFG9_CARDCTL = 0;          // Select NTRCARD controller, eject IRQ off?
	REG_NTRCARDMCNT = NTRCARD_CR1_ENABLE | NTRCARD_CR1_IRQ;
	REG_NTRCARDROMCNT = 0x20000000;
	TIMER_sleep(120);
}

bool gamecardInit(void)
{
	// No gamecard inserted.
	if(REG_CFG9_CARDSTATUS & 1) return false;

	resetCardslot();

	u32 cmdBuf[4] = {0};
	cmdBuf[0] = 0x9F000000; // Reset cmd
	ntrcardCommand(cmdBuf, 0x2000, NTRCARD_CLK_SLOW | NTRCARD_DELAY1(0x1FFF) | NTRCARD_DELAY2(0x18), NULL);

	// No idea what this is. Hardcoded in Process9.
	static const u32 unkGarbageCmd[2] = {0x71C93FE9, 0xBB0A3B18};
	ntrcardCommand(unkGarbageCmd, 0, NTRCARD_CLK_SLOW | NTRCARD_DELAY1(0x1FFF) | NTRCARD_DELAY2(0x18), NULL);

	// Send the get chip ID cmd twice like Process9.
	cmdBuf[0] = 0x90000000; // Get chip ID cmd
	ntrcardCommand(cmdBuf, 4, NTRCARD_CLK_SLOW | NTRCARD_DELAY1(0x1FFF) | NTRCARD_DELAY2(0x18), &chipId);
	ntrcardCommand(cmdBuf, 4, NTRCARD_CLK_SLOW | NTRCARD_DELAY1(0x1FFF) | NTRCARD_DELAY2(0x18), NULL);

	if(chipId & 0x10000000)
	{
		cmdBuf[0] = 0xA0000000; // Get card type cmd
		ntrcardCommand(cmdBuf, 4, 0, &cardType);

		cmdBuf[0] = 0x3E000000; // Enter 16 byte mode cmd
		ntrcardCommand(cmdBuf, 0, 0, NULL);

		// Switch to CTRCARD controller.
		REG_CTRCARDCNT = CTRCARD_nRESET;
		REG_CFG9_CARDCTL = 2;

		cmdBuf[0] = 0x82000000; // Read header cmd
		ctrcardCommand(cmdBuf, 0x200, 1, 0x704802C, &ctrcardHeader);

		// Check if the header is ok.
		if(memcmp(&ctrcardHeader.magic, "NCCH", 4) != 0) return false;

		// The secure init function sets the cmdRand* words in cmdBuf for us.
		if(!ctrcardSecureInit(cmdBuf)) return false;

		u32 chipIdTest, cardTypeTest;
		cmdBuf[0] = 0xA2000000; // Get secure chip ID cmd
		ctrcardCommand(cmdBuf, 4, 1, 0x701002C, &chipIdTest);
		cmdBuf[0] = 0xA3000000; // Get secure card type cmd
		ctrcardCommand(cmdBuf, 4, 1, 0x701002C, &cardTypeTest);

		if(chipIdTest == chipId && cardTypeTest == cardType)
		{
			cmdBuf[0] = 0xC5000000; // Check status cmd
			ctrcardCommand(cmdBuf, 0, 1, 0x100002C, NULL);
		}

		cmdBuf[0] = 0xA2000000; // Get secure chip ID cmd
		for(u32 i = 0; i < 5; i++)
		{
			ctrcardCommand(cmdBuf, 4, 1, 0x701002C, NULL);
		}
	}

	return true;
}

u32 getChipId(void)
{
	return chipId;
}

u32 getCardType(void)
{
	return cardType;
}



//////////////////////////////////
//            NTRCARD           //
//////////////////////////////////

void ntrcardCommand(const u32 command[2], u32 pageSize, u32 latency, void* buffer)
{
	REG_NTRCARDMCNT = NTRCARD_CR1_ENABLE;

	REGs_NTRCARDCMD[0] = swap32(command[0]);
	REGs_NTRCARDCMD[1] = swap32(command[1]);

	pageSize -= pageSize & 3; // align to 4 byte

	u32 pageParam = NTRCARD_PAGESIZE_4K;
	u32 transferLength = 4096;

	// make zero read and 4 byte read a little special for timing optimization(and 512 too)
	switch (pageSize) {
		case 0:
			transferLength = 0;
			pageParam = NTRCARD_PAGESIZE_0;
			break;
		case 4:
			transferLength = 4;
			pageParam = NTRCARD_PAGESIZE_4;
			break;
		case 512:
			transferLength = 512;
			pageParam = NTRCARD_PAGESIZE_512;
			break;
		case 8192:
			transferLength = 8192;
			pageParam = NTRCARD_PAGESIZE_8K;
			break;
	default:
		break; //Using 4K pagesize and transfer length by default
	}

	// go
	REG_NTRCARDROMCNT = 0x10000000;
	REG_NTRCARDROMCNT = NTRKEY_PARAM | NTRCARD_ACTIVATE | NTRCARD_nRESET | pageParam | latency;

	u8 * pbuf = (u8 *)buffer;
	u32 * pbuf32 = (u32 * )buffer;
	bool useBuf = ( NULL != pbuf );
	bool useBuf32 = (useBuf && (0 == (3 & ((u32)buffer))));

	u32 count = 0;
	u32 cardCtrl = REG_NTRCARDROMCNT;

	if(useBuf32)
	{
		while( (cardCtrl & NTRCARD_BUSY) && count < pageSize)
		{
			cardCtrl = REG_NTRCARDROMCNT;
			if( cardCtrl & NTRCARD_DATA_READY  ) {
				u32 data = REG_NTRCARDFIFO;
				*pbuf32++ = data;
				count += 4;
			}
		}
	}
	else if(useBuf)
	{
		while( (cardCtrl & NTRCARD_BUSY) && count < pageSize)
		{
			cardCtrl = REG_NTRCARDROMCNT;
			if( cardCtrl & NTRCARD_DATA_READY  ) {
				u32 data = REG_NTRCARDFIFO;
				pbuf[0] = (unsigned char) (data >>  0);
				pbuf[1] = (unsigned char) (data >>  8);
				pbuf[2] = (unsigned char) (data >> 16);
				pbuf[3] = (unsigned char) (data >> 24);
				pbuf += sizeof (unsigned int);
				count += 4;
			}
		}
	}
	else
	{
		while( (cardCtrl & NTRCARD_BUSY) && count < pageSize)
		{
			cardCtrl = REG_NTRCARDROMCNT;
			if( cardCtrl & NTRCARD_DATA_READY  ) {
				u32 data = REG_NTRCARDFIFO;
				(void)data;
				count += 4;
			}
		}
	}

	// if read is not finished, ds will not pull ROM CS to high, we pull it high manually
	if( count != transferLength ) {
		// MUST wait for next data ready,
		// if ds pull ROM CS to high during 4 byte data transfer, something will mess up
		// so we have to wait next data ready
		do { cardCtrl = REG_NTRCARDROMCNT; } while(!(cardCtrl & NTRCARD_DATA_READY));
		// and this tiny delay is necessary
		//ioAK2Delay(33);
		// pull ROM CS high
		REG_NTRCARDROMCNT = 0x10000000;
		REG_NTRCARDROMCNT = NTRKEY_PARAM | NTRCARD_ACTIVATE | NTRCARD_nRESET; // | 0 | 0x0000;
	}
	// wait rom cs high
	do { cardCtrl = REG_NTRCARDROMCNT; } while( cardCtrl & NTRCARD_BUSY );
	//lastCmd[0] = command[0];lastCmd[1] = command[1];
}



//////////////////////////////////
//            CTRCARD           //
//////////////////////////////////

void ctrcardCommand(const u32 command[4], u32 pageSize, u32 blocks, u32 latency, void* buffer)
{
	REGs_CTRCARDCMD[0] = command[3];
	REGs_CTRCARDCMD[1] = command[2];
	REGs_CTRCARDCMD[2] = command[1];
	REGs_CTRCARDCMD[3] = command[0];

	//Make sure this never happens
	if(blocks == 0) blocks = 1;

	pageSize -= pageSize & 3; // align to 4 byte
	u32 pageParam = CTRCARD_PAGESIZE_4K;
	u32 transferLength = 4096;
	// make zero read and 4 byte read a little special for timing optimization(and 512 too)
	switch(pageSize) {
		case 0:
			transferLength = 0;
			pageParam = CTRCARD_PAGESIZE_0;
			break;
		case 4:
			transferLength = 4;
			pageParam = CTRCARD_PAGESIZE_4;
			break;
		case 64:
			transferLength = 64;
			pageParam = CTRCARD_PAGESIZE_64;
			break;
		case 512:
			transferLength = 512;
			pageParam = CTRCARD_PAGESIZE_512;
			break;
		case 1024:
			transferLength = 1024;
			pageParam = CTRCARD_PAGESIZE_1K;
			break;
		case 2048:
			transferLength = 2048;
			pageParam = CTRCARD_PAGESIZE_2K;
			break;
		case 4096:
			transferLength = 4096;
			pageParam = CTRCARD_PAGESIZE_4K;
			break;
	default:
		break; //Defaults already set
	}

	REG_CTRCARDBLKCNT = blocks - 1;
	transferLength *= blocks;

	// go
	REG_CTRCARDCNT = 0x10000000;
	REG_CTRCARDCNT = CTRCARD_ACTIVATE | CTRCARD_nRESET | pageParam | latency;

	u8 * pbuf = (u8 *)buffer;
	u32 * pbuf32 = (u32 * )buffer;
	bool useBuf = ( NULL != pbuf );
	bool useBuf32 = (useBuf && (0 == (3 & ((u32)buffer))));

	u32 count = 0;
	u32 cardCtrl = REG_CTRCARDCNT;

	if(useBuf32)
	{
		while( (cardCtrl & CTRCARD_BUSY) && count < transferLength)
		{
			cardCtrl = REG_CTRCARDCNT;
			if( cardCtrl & CTRCARD_DATA_READY  ) {
				u32 data = REG_CTRCARDFIFO;
				*pbuf32++ = data;
				count += 4;
			}
		}
	}
	else if(useBuf)
	{
		while( (cardCtrl & CTRCARD_BUSY) && count < transferLength)
		{
			cardCtrl = REG_CTRCARDCNT;
			if( cardCtrl & CTRCARD_DATA_READY  ) {
				u32 data = REG_CTRCARDFIFO;
				pbuf[0] = (unsigned char) (data >>  0);
				pbuf[1] = (unsigned char) (data >>  8);
				pbuf[2] = (unsigned char) (data >> 16);
				pbuf[3] = (unsigned char) (data >> 24);
				pbuf += sizeof (unsigned int);
				count += 4;
			}
		}
	}
	else
	{
		while( (cardCtrl & CTRCARD_BUSY) && count < transferLength)
		{
			cardCtrl = REG_CTRCARDCNT;
			if( cardCtrl & CTRCARD_DATA_READY  ) {
				u32 data = REG_CTRCARDFIFO;
				(void)data;
				count += 4;
			}
		}
	}

	// if read is not finished, ds will not pull ROM CS to high, we pull it high manually
	if( count != transferLength ) {
		// MUST wait for next data ready,
		// if ds pull ROM CS to high during 4 byte data transfer, something will mess up
		// so we have to wait next data ready
		do { cardCtrl = REG_CTRCARDCNT; } while(!(cardCtrl & CTRCARD_DATA_READY));
		// and this tiny delay is necessary
		wait(66);
		// pull ROM CS high
		REG_CTRCARDCNT = 0x10000000;
		REG_CTRCARDCNT = CTRKEY_PARAM | CTRCARD_ACTIVATE | CTRCARD_nRESET;
	}
	// wait rom cs high
	do { cardCtrl = REG_CTRCARDCNT; } while( cardCtrl & CTRCARD_BUSY );
	//lastCmd[0] = command[0];lastCmd[1] = command[1];
}

void ctrcardReadData(u32 sector, u32 length, u32 blocks, void* buffer)
{
	static u32 readCount = 0;
	u32 cmdBuf[4] = {0};

	if(readCount++ >= 10000)
	{
		cmdBuf[0] = 0xC5000000; // Check status cmd
		cmdBuf[2] = cmdRand1;
		cmdBuf[3] = cmdRand2;
		ctrcardCommand(cmdBuf, 0, 1, 0x100002C, NULL);
		cmdBuf[2] = 0;
		cmdBuf[3] = 0;
		readCount = 0;
	}

	// This may not be needed if gamecards >4 GiB don't exist.
	cmdBuf[0] = 0xBF000000 | sector>>23; // Read ROM cmd
	cmdBuf[1] = sector<<9;
	ctrcardCommand(cmdBuf, length, blocks, 0x704822C, buffer);

	// Card dummy
	/*cmdBuf[0] = 0xA2000000; // Get secure chip ID cmd
	cmdBuf[2] = cmdRand1;
	cmdBuf[3] = cmdRand2;
	ctrcardCommand(cmdBuf, 4, 1, 0x701002C, NULL);*/
}

NCCH_header* ctrcardGetHeader(void)
{
	return &ctrcardHeader;
}

void ctrcardGetUniqueId(u32 *buf)
{
	// TODO: Do we need cmdRand* here?
	const u32 uniqueIdCmd[4] = {0xC6000000, 0x00000000, 0x00000000, 0x00000000};
	ctrcardCommand(uniqueIdCmd, 0x40, 1, 0x701002C, buf);
}

static void ctrcardSetSecSeed(const u32 seed[4], bool flag)
{
	// Select secure crypto key?
	if(flag) REG_CTRCARDSECCNT = ((cardType & 3u) << 8) | 4;

	REG_CTRCARDSECSEED = seed[0];
	REG_CTRCARDSECSEED = seed[1];
	REG_CTRCARDSECSEED = seed[2];
	REG_CTRCARDSECSEED = seed[3];
	REG_CTRCARDSECCNT |= 0x8000;

	while(!(REG_CTRCARDSECCNT & 0x4000));

	if(flag) (*(vu32*)0x1000400C) = 0x00000001; // Enable cart command encryption?
}

static bool ctrcardSecureInit(u32 cmdBuf[4])
{
	if((cardType & 3u) == 3) // Dev card
	{
		static const u32 devCardKey[4] = {0};
		AES_setKey(0x11, AES_KEY_NORMAL, AES_INPUT_BIG | AES_INPUT_NORMAL, false, devCardKey);
		AES_selectKeyslot(0x11);
	}
	else // Retail card
	{
		AES_setKey(0x3B, AES_KEY_Y, AES_INPUT_BIG | AES_INPUT_NORMAL, false, ctrcardHeader.seedKeyY);
		AES_selectKeyslot(0x3B);
	}

	u32 seed[4];
	AES_ctx ctx;
	AES_setNonce(&ctx, AES_INPUT_BIG | AES_INPUT_NORMAL, ctrcardHeader.seedNonce);
	AES_setCryptParams(&ctx, AES_INPUT_BIG | AES_INPUT_NORMAL, AES_OUTPUT_LITTLE | AES_OUTPUT_REVERSED);
	if(!AES_ccm(&ctx, ctrcardHeader.encryptedSeed, seed, 16, ctrcardHeader.seedAesMac, 1, false)) return false;

	ctrcardSetSecSeed(seed, true);

	cmdRand1 = REG_PRNG[0];
	cmdRand2 = REG_PRNG[4];
	cmdBuf[0] = 0x83000000; // Seed cmd
	cmdBuf[2] = cmdRand1;
	cmdBuf[3] = cmdRand2;
	ctrcardCommand(cmdBuf, 0, 1, 0x700822C, NULL);

	seed[0] = cmdRand2;
	seed[1] = cmdRand1;
	ctrcardSetSecSeed(seed, false);

	return true;
}

Code: Select all

#define CTRCARD_PAGESIZE_16K (8u<<16)
#define CTRCARD_PAGESIZE_64K (9u<<16)

Code: Select all

#define CTRCARD_CRC_ERROR    (1u<<4)

Code: Select all

#define CTRKEY_PARAM         (0x1000000u)

Code: Select all

                ctrcardCommand(cmdBuf, 4, 1, 0x701002C, &chipIdTest);

Code: Select all

                if(chipIdTest == chipId && cardTypeTest == cardType)
                {
                        cmdBuf[0] = 0xC5000000; // Check status cmd
                        ctrcardCommand(cmdBuf, 0, 1, 0x100002C, NULL);
                }

Code: Select all

REG_CTRCARDCNT = 0x10000000;

Code: Select all

        // make zero read and 4 byte read a little special for timing optimization(and 512 too)

Code: Select all

        // if read is not finished, ds will not pull ROM CS to high, we pull it high manually

Code: Select all

        static u32 readCount = 0;
        u32 cmdBuf[4] = {0};
        if(readCount++ >= 10000)
        {
                cmdBuf[0] = 0xC5000000; // Check status cmd

Code: Select all

        if(flag) (*(vu32*)0x1000400C) = 0x00000001; // Enable cart command encryption?

Code: Select all

        // TODO: Do we need cmdRand* here?
        const u32 uniqueIdCmd[4] = {0xC6000000, 0x00000000, 0x00000000, 0x00000000};
        ctrcardCommand(uniqueIdCmd, 0x40, 1, 0x701002C, buf);

Code: Select all

10004000h - CTRCARD_CNT
  0-4   Timeout (0-16=1ms,2ms,4ms,8ms,..,64s; 17-31=64s, too; def=12=4s)  (R/W)
  5     Timeout Error      (0=Okay, 1=Error) (write 0 to ack)           (R/ack)
  6     Timeout Enable     (0=Disable, 1=Enable)                          (R/W)
  7     Unused (0)
  8     CRC Error          (0=Okay, 1=Error) (write 0 to ack)           (R/ack)
  9     CRC Enable         (0=Disable, 1=Enable) (fails on some cmd's?)   (R/W)
  10-14 Unused (0)
  15    unknown... ?                                                      (R/W)
  16-19 Data Block size    (0-8=0,4,16,64,512,1K,2K,4K,8K; 9-15=8K, too)  (R/W)
  20-23 Unused (0)
  24-26 Tiny delay... per chip select or so? (0-3=Fast, 4=Med, 5-7=Slow)  (R/W)
  27    Data-Word status   (0=Busy, 1=Ready/DRQ)                            (R)
  28    Reset Pin          (0=Low/Reset, 1=High/Release) (SET-ONCE)       (R/W)
  29    Transfer Direction (0=Read, 1=Write)                              (R/W)
  30    Interrupt Enable   (0=Disable, 1=Enable) (ARM9 IF.bit23/24)       (R/W)
  31    Start              (0=Idle, 1=Start/Busy)                         (R/W)

Code: Select all

4004010h - DSi9 - SCFG_MC - NDS Slot Memory Card Interface Status (R)
4004010h - DSi7 - SCFG_MC - NDS Slot Memory Card Interface Control (R/W)
  0     1st NDS Slot Game Cartridge (0=Inserted, 1=Ejected)               (R)
  1     1st NDS Slot Unknown/Unused (0)
  2-3   1st NDS Slot Power State (0=Off, 1=On+Reset, 2=On, 3=RequestOff)  (R/W)
  4     2nd NDS Slot Game Cartridge (always 1=Ejected) ;\DSi              (R)
  5     2nd NDS Slot Unknown/Unused (0)                ; prototype
  6-7   2nd NDS Slot Power State    (always 0=Off)     ;/relict           (R/W)
  8-14  Unknown/Undocumented (0)
  15    Swap NDS Slots (0=Normal, 1=Swap)                                 (R/W)
  16-31 ARM7: See Port 4004012h, ARM9: Unspecified (0)
Note: Additionally, the NDS slot Reset pin can be toggled (via ROMCTRL.Bit29;
that bit is writeable on ARM7 side on DSi; which wasn't supported on NDS).
Power state values:
  0=Power is Off
  1=Power On and force Reset (shall be MANUALLY changed to state=2)
  2=Power On
  3=Request Power Off (will be AUTOMATICALLY changed to state=0)
cart_power_on: (official/insane 1+10+27+120ms, but also works with 1+1+0+1ms)
  wait until state<>3                   ;wait if pwr off busy
  exit if state<>0 AND no_reset_wanted  ;exit if already on & no reset wanted
  wait 1ms, then set state=1            ;pwr on & force reset
  wait 10ms, then set state=2           ;pwr on normal state   ;better: 1ms
  wait 27ms, then set ROMCTRL=20000000h ;release reset pin     ;better: 0ms
  wait 120ms                            ;more insane delay?    ;better: 1ms
cart_power_off: (official 150ms, when using default [4004014h]=264Ch)
  wait until state<>3                   ;wait if pwr off busy
  exit if state<>2                      ;exit if already off
  set state=3                           ;request pwr off
  exit unless you want to know when below pointless delay has ellapsed
  wait until state=0    ;default=150ms  ;wait until pwr off    ;better: skip
Power Off is also done automatically by hardware when ejecting the cartridge.
The Power On sequence does reset ROMCTRL.bit29=0 (reset signal).
Bit15 swaps ports 40001A0h-40001BFh and 4100010h with 40021A0h-40021BFh? and
4102010h?, the primary purpose is mapping the 2nd Slot to the 4xx0xxxh
registers (for running carts in 2nd slot in NDS mode; which of course doesn't
work because the 2nd slot connector isn't installed), theoretically it would
also allow to access the 1st slot via 4xx2xxxh registers (however, that doesn't
seem to be fully implemented, cart reading does merely reply FFh's (cart
inserted) or 00h's (no cart)). 4102010h can be read by manually polling DRQ in
40021A4h.bit23, and probably by NDMA (but not by old DMA which has no known DRQ
mode for 2nd slot).

4004012h - DSi7 - SCFG_CARD_INSERT_DELAY (usually 1988h = 100ms) (R/W)
4004014h - DSi7 - SCFG_CARD_PWROFF_DELAY (usually 264Ch = 150ms) (R/W)
  0-15  Delay in 400h cycle units (at 67.027964MHz)  ;max FFFFh=ca. 1 second
Usually set to 1988h/264Ch by firmware. Power up default is FFFFh/FFFFh, with
that setting it takes about 1 second to sense inserted carts (after power-up,
or after cart-insert).
Insert delay defines the time until SCFG_MC.bit0 reacts upon cart insert, and
until cart access works (cart eject works instantly regardless of the delay
setting). The 3DS bootrom uses 051Dh=20ms, which may be good to avoid switch
bounce. The DSi/3DS firmwares use 1988h=100ms, which might be reasonable if the
switch triggers too early.
Power Off delay defines how fast SCGF_MC.bit2-3 are changing from state=3
(request power off) to state=0 (power off). The 3DS bootrom uses 051Dh=20ms,
the DSi/3DS firmwares use 264Ch=150ms, which is both kinda pointless. If the
VCC pin is kept powered during that time (?) then the delay might help to
finish FLASH writes (which would make sense only if there was data written to
cartridge).

Code: Select all

1000000Ch - CFG9_CARD_CTL (R/W)
  0-1   Gamecard ROM controller  (0=NTRCARD, 1=?, 2=CTRCARD0, 3=CTRCARD1)
  2-3   Unused (0)
  4     Gamecard SPI_CARD mode   (0=Manual, 1=FIFO)
  5-7   Unused (0)
  8     Gamecard SPI controller  (0=NTRCARD, 1=SPI_CARD)
  9-11  Unused (0)
  12    Unknown...? (R/W)
  13-15 Unused (0)
There are three controllers for ROM cartridge commands:
  xxx0h/xxx1h? NTRCARD  (8-byte commands)  (bit1=0)         (Port 10164000h)
  xxx2h        CTRCARD0 (16-byte commands) (bit1=1, bit0=0) (Port 10004000h)
  xxx3h        CTRCARD1 (16-byte commands) (bit1=1, bit0=1) (Port 10005000h)
And three controllers for SPI-bus cartridge savedata:
  x0x0h/x0x1h  NTRCARD Manual NDS-style    (bit8=0, bit1=0) (Port 10164000h)
  x0x2h/x0x3h  None                        (bit8=0, bit1=1) (N/A)
  x10xh        SPI_CARD in Manual Mode     (bit8=1, bit4=0) (Port 1000D000h)
  x11xh        SPI_CARD in FIFO Mode       (bit8=1, bit4=1) (Port 1000D800h)
The deselected controllers are disconnected from the cartridge bus (and tend
to return data=FFh when trying to read from the cartridge).

Code: Select all

     ;orr r4,0000000h   ;time 19F8h per 200h, and 8D9Ah per 2000h, D81h per 4      ;8000h/2000h  = 4   ;67.027964MHz/4 = 16.7MHz
     ;orr r4,1000000h   ;time 1E73h per 200h, and B0E6h per 2000h, 10D8h per 4     ;A000h/2000h  = 5   ;67.027964MHz/5 = 13.4MHz
     ;orr r4,2000000h   ;time 22E4h per 200h, and D409h per 2000h, 13F6h per 4     ;C000h/2000h  = 6   ;67.027964MHz/6 = 11.2MHz
     ;orr r4,3000000h   ;time 2B96h per 200h, and 11A5Bh per 2000h, 1A6Eh per 4    ;10000h/2000h = 8   ;67.027964MHz/8 = 8.4MHz
     ;orr r4,4000000h   ;time 3484h per 200h, and 160D5h per 2000h, 211Fh per 4    ;14000h/2000h = 10  ;67.027964MHz/10 = 6.7MHz
     ;orr r4,5000000h   ;time 4F12h per 200h, and 23451h per 2000h, 3489h per 4    ;20000h/2000h = 16  ;67.027964MHz/16 = 4.2MHz
     ;orr r4,6000000h   ;time 4F0Eh per 200h, and 23451h per 2000h, 3489h per 4    ;same as above       ;EDIT: fixed above "/N" dividers
     ;orr r4,7000000h   ;time 4F0Eh per 200h, and 23452h per 2000h, 3489h per 4    ;same as above       ;ie. "/4..16" instead of "/4"
     ;non-dma           ;time 4xxxh per 200h, and 2F5FBh per 2000h... hmmm, there must be something wrong in my non-dma reading function

Code: Select all

10004000h/10005000h - CTRCARD_CNT
  0-4   Timeout (0-16=1ms,2ms,4ms,8ms,..,64s; 17-31=64s, too; def=12=4s)  (R/W)
  5     Timeout Error      (0=Okay, 1=Error) (write 0 to ack)           (R/ack)
  6     Timeout Enable     (0=Disable, 1=Enable)                          (R/W)
  7     Unused (0)
  8     CRC Error          (0=Okay, 1=Error) (write 0 to ack)           (R/ack)
  9     CRC Enable         (0=Disable, 1=Enable) (works for cmd 82h/BFh)  (R/W)
  10-14 Unused (0)
  15    DMA Enable         (0=Disable, 1=Enable DMA DRQs, each 8 words)   (R/W)
  16-19 Data Block size    (0-8=0,4,16,64,512,1K,2K,4K,8K; 9-15=8K, too)  (R/W)
  20-23 Unused (0)
  24-26 Byte Transfer Time (0-5=4,5,6,8,10,16 clks at 67MHz; 6-7=16, too) (R/W)
  27    Data-Word status   (0=Busy, 1=Ready/DRQ)                            (R)
  28    Reset Pin          (0=Low/Reset, 1=High/Release) (SET-ONCE)       (R/W)
  29    Transfer Direction (0=Read, 1=Write)                              (R/W)
  30    Interrupt Enable   (0=Disable, 1=Enable) (ARM9 IF.bit23/24)       (R/W)
  31    Start              (0=Idle, 1=Start/Busy)                         (R/W)

Code: Select all

int __fastcall CTRCARD_cmdBFReadRom(int a1, int a2, __int64 a3, unsigned __int16 a4)
{
  int v4; // r5
  signed int v5; // r0
  __int64 v6; // r6
  int result; // r0
  int v8; // r3
  int v9; // r0
  int v10; // r2
  signed int v11; // r5
  signed int v12; // r6
  signed int v13; // r3
  signed int v14; // r2
  signed int v15; // r2
  signed int v16; // r3
  signed int v17; // r2
  int v18; // r2
  signed int v19; // r3
  int v20; // r2

  v4 = a1;
  v5 = *(_DWORD *)(a1 + 16);
  v6 = a3;
  *(_DWORD *)(v4 + 16) = v5 + 1;
  if ( v5 > 10000 )
  {
    result = CTRCARD_cmdC5CheckStatus2(v4);
    if ( !result )
      return result;
    *(_DWORD *)(v4 + 16) = 0;
  }
  result = sub_8050334(v4, 0);
  if ( result )
  {
    v8 = (unsigned __int64)(v6 >> 23) | 0xBF000000;
    v9 = (unsigned __int8)byte_8094821;
    v10 = (_DWORD)v6 << 9;
    v11 = 1024;
    if ( byte_8094821 == 2 )
      v12 = 1024;
    else
      v12 = 0;
    REG_CTRCARD_CNT[v12 + 11] = v8;
    if ( v9 == 2 )
      v13 = 1024;
    else
      v13 = 0;
    REG_CTRCARD_CNT[v13 + 10] = v10;
    if ( v9 == 2 )
      v14 = 1024;
    else
      v14 = 0;
    REG_CTRCARD_CNT[v14 + 9] = 0;
    if ( v9 == 2 )
      v15 = 1024;
    else
      v15 = 0;
    REG_CTRCARD_CNT[v15 + 8] = 0;
    if ( v9 == 2 )
      v16 = 1024;
    else
      v16 = 0;
    REG_CTRCARD_CNT[v16 + 1] = a4 - 1;
    if ( v9 == 2 )
      v17 = 1024;
    else
      v17 = 0;
    v18 = (REG_CTRCARD_CNT[v17] & 0x10000000) - 0x40000000;
    if ( v9 == 2 )
      v19 = 1024;
    else
      v19 = 0;
    v20 = ((v18 | REG_CTRCARD_CNT[v19] & 0x8000000) + 0x1008000) | 0x4822C;
    if ( v9 != 2 )
      v11 = 0;
    REG_CTRCARD_CNT[v11] = v20;
    result = 1;
  }
  return result;
}