Homebrew how would we dump DSi BIOS, eMMC and Wifi-flash with sudokuhax?

[demon77]

I see thanks so much for both information ^^ , Maybe one day someone will release the DSI firmware that nocash/martin has maybe..

Until then the new DSI proper dump games will not be fully playable on emulation, DSI firmware show on right side .

He will not give away his DSI Firmware , because of the keys from the DSI in it.

 

[Apache Thunder]

According to some info here:

http://ngemu.com/threads/dsi-cid-discovered.169257/

It is possible to dump NAND using homebrew launched using sudokuhax. However the current public release of sudukohax intentionally destroys the key slot data in memory for TWL NAND so that homebrew can't access it or if it does the data there is useless. Figures they'd intentionally neuter the dev scene. Might be one reason why DSi scene never took off.

I'm led to believe this also impacts the ability to dump TWL partition in DSi mode on 3DS. But that assumes 3DS even stores that data like the DSi does. Everything else you can dump with fwtool But eMMC needs the encryption key retrieved and Sudokuhax being the only means of getting to it has code programmed in to intentionally prevent you from accessing it.

 

[drwhojan]

You asked me that before didn't ya?
https://gbatemp.net/threads/no-gba-v2-8-released-with-dsi-emulation.380462/page-2#post-5479075

lol, sorry i didn't respond.
Here it is before i forget again:

OK after some time I used my flashcard r4 original and ds lite + fwtool.nds , it dump the firmware and bioses fine arm9 and arm7

anyone yet got a dsi and flashcard with fwtool to backup the dsi bioses ?, they are much needed now with no$gba progress for dsi enhances .
a dsi
contact me if privet only, all to be done is just put fwtool.nds from zip file on last page onto flashcard that works with DSI , and backup the firmware and bios , think so should work like ds did , then can test on no$gba latest .

 

[demon77]

can you post latest fwtool.nds here then so we can try.

Fwtool.nds from post #13 is not dumping the bios good from a dsi , but that was already told here.

"
Just part of the bios is dumped. You need the upper 32K of the bios which fwtool.nds does not dump.
I'm not clear on how to get that. Also, you have to dump the dsi nand which I also can't do.

You can't dump it... But the keys are copied into ram and you can dump that (either with complex hardware mod or by dumping itcm on a 3ds)."

 

[drwhojan]

Yes it was on post 13 - thanks for letting me know and trying anyway!.

It sure that nocash got a copy, they are some that have also, but just 0 to get one copy of BIOSDSI7.ROM / BIOSDSI9.ROM

his progresses on dsi stuff

http://ngemu.com/threads/booted-dsi-system-settings.177673/

http://ngemu.com/threads/dsi-regions.166777/

http://ngemu.com/threads/dsi-wifi-hardware-discovered.173033/

http://ngemu.com/threads/dsi-unidentified-language.166785/

buy yes you are right

DSi emulation requires a copy of the lower 32K-halves of the ARM7/ARM9 BIOSes (BIOSDSI7.ROM and BIOSDSI9.ROM). And don't forget to enable DSi emulation (default is still set to NDS mode, for better compatibility with games like Cooking Coach).

 

[demon77]

You can get part of the dsi bios and the wifi flash on 3ds with sudokuhax using fwtool

https://github.com/WinterMute/nintendo-ds-tools/tree/master/firmware/nds/fwTool

dunno about the rest, probably a soldering iron needed.

Could you build the latest version for us , did see that they changed things last month.

 

[zoogie]

Could you build the latest version for us , did see that they changed things last month.

Yeah, they added nand dumping didn't they? Cool.
Surprised I missed that!

 

[drwhojan]

cool!, anyone manage to get a backup copy NAND ?, thanks . and bios9i.bin / bios7i.bin anyway's .

maybe the source file, { "Dump Bios", backupBIOS } ,

should be renamed , { "Dump NDS / DSi Bios", backupBIOS } ,

maybe rename , void to match name .

main.cpp in arm9

some think like this .

https://raw.githubusercontent.com/W...ster/firmware/nds/fwTool/arm9/source/main.cpp

 

[drwhojan]

can you post latest fwtool.nds here then so we can try.

Fwtool.nds from post #13 is not dumping the bios good from a dsi , but that was already told here.

"
Just part of the bios is dumped. You need the upper 32K of the bios which fwtool.nds does not dump.
I'm not clear on how to get that. Also, you have to dump the dsi nand which I also can't do.

You can't dump it... But the keys are copied into ram and you can dump that (either with complex hardware mod or by dumping itcm on a 3ds)."

I missed read from quote .

DSi emulation requires a copy of the lower 32K-halves of the ARM7/ARM9 BIOSes (BIOSDSI7.ROM and BIOSDSI9.ROM). And don't forget to enable DSi emulation (default is still set to NDS mode, for better compatibility with games like Cooking Coach).

Seams the lower 32k is fine for DSi mood only as long as you Enable "And don't forget to enable DSi emulation" ^ in his no$gba settings .

Now we need privet copy to test it .

Must mean the NDS mode on image .

 

[drwhojan]

Just to note backup of the NDS 9/7 bios files are bad in fwback tool , arm7 0x1204 filled with FF , but size correct , arm9 correct but size way to big from 4k to 32k with 00's , 0xfff cut off correct , fwtool bad at 0x7FFF

 

[demon77]

Just to note backup of the NDS 9/7 bios files are bad in fwback tool , arm7 0x1204 filled with FF , but size correct , arm9 correct but size way to big from 4k to 32k with 00's , 0xfff cut off correct , fwtool bad at 0x7FFF

NAND dump is stil not working , and arm7 from a DSI has not filled that area with FF.
That just happens with a NDS.

 

[TuxSH]

Are the DSi's (TWL) keyslots the same that those TWL keyslots on 3DS? https://www.3dbrew.org/wiki/AES_Registers

 

[drwhojan]

NAND dump is stil not working , and arm7 from a DSI has not filled that area with FF.
That just happens with a NDS.

I see thanks .

 

[zoogie]

Encrypted eMMC Images
no$gba can emulate up to 12 consoles simultaneously, and expects the eMMC
images having following filename(s), in no$gba folder:
  DSi-#.mmc             ;eMMC for machine 1..12 (# = 1..C hex)
the eMMC images are encrypted with per-console keys, so decryption wont work
without knowing the console ID values. no$gba expects that info to be stored in
a 40h-byte Footer at the end of the file:
  0000000h ..  Encrypted eMMC image (usually 240Mbyte for DSi)
  *F000000h 16  Footer ID      ("DSi eMMC CID/CPU")*
  F000010h 16  eMMC CID       (dd ss ss ss ss 03 4D 30 30 46 50 41 00 00 15 00)
  F000020h 8   CPU/Console ID (nn n1 nn nn nn 0n A2 08)
  F000028h 24  Reserved       (zerofilled)

Does anyone know how to get the Footer ID (between the **)? I've got the other three and that's all I lack.

 

[Normmatt]

Encrypted eMMC Images
no$gba can emulate up to 12 consoles simultaneously, and expects the eMMC
images having following filename(s), in no$gba folder:
  DSi-#.mmc             ;eMMC for machine 1..12 (# = 1..C hex)
the eMMC images are encrypted with per-console keys, so decryption wont work
without knowing the console ID values. no$gba expects that info to be stored in
a 40h-byte Footer at the end of the file:
  0000000h ..  Encrypted eMMC image (usually 240Mbyte for DSi)
  *F000000h 16  Footer ID      ("DSi eMMC CID/CPU")*
  F000010h 16  eMMC CID       (dd ss ss ss ss 03 4D 30 30 46 50 41 00 00 15 00)
  F000020h 8   CPU/Console ID (nn n1 nn nn nn 0n A2 08)
  F000028h 24  Reserved       (zerofilled)

Does anyone know how to get the Footer ID (between the **)? I've got the other three and that's all I lack.

Its literally just that string "DSi eMMC CID/CPU" in ascii.

 

[zoogie]

Its literally just that string "DSi eMMC CID/CPU" in ascii.

oh my god
*hangs head in shame*