Hardware nand flash dump (3ds xl)

[_Tim_]

...
Arduino has 5V gpio voltage levels which is 2 high for interfacing an eMMC.
...

You can always use the $1 SD shield which automatically converts the 5V to 3.3V.

 

[krisztian1997]

If they really locked the eMMC you will need the passkey to unlock it without erasure of it's contents
or you will need a working nand backup and a method to restore it.

We already know how to restore the NAND (with sd card reader), so I think that it would be posible to tell the controller to erase the NAND, unlock it and then flash the nand back with a sd card reader.

An arduino can talk to the eMMC in both modes as basically every gpio pin of it can be set as input or output and can be set high or low.
The arduino microcontroller only has hardware support for the SPI protocol.
This means that all other communication has to be emulated in software which is usually much slower than a dedicated hardware interface for the same purpose.
Arduino has 5V gpio voltage levels which is 2 high for interfacing an eMMC.
The raspberry uses 3V3 gpio voltage levels which might be what is needed?
The problem is finding (writing) the needed software to communicate with the eMMC at a level that shows us what is going on. Being able to read it's registers would already help a lot as some status bits might indicate the condition of the eMMC chip.

Lowering the 5v to 3v3 is easy with a voltage divider, or that small SD shield already does that. This library http://www.roland-riegel.de/sd-reader/index.html can comunicate with the sd card on low level, and from what I saw it has a function to initiate the sd card, and then its posible to talk with the controller using the sd_raw_send_command, unfortunately I sold my arduino some time ago so I cant test it with an old eMMC card.

 

[obcd]

Of cause you can use such, but it makes things a little more complicated.
I am just trying to warn people before they start to connect an arduino to their 3ds eMMC, that's all.

Raspberry is a bit more expensive than arduino.
Raspberry either needs to be used standalone (with a screen and keyboard connected to it) or it needs to be accessed over the LAN (using an SSH client like putty)
arduino could emulate a usb2serial client on a pc. It might be more barebone, so easier to program for the needed result. (Being low level eMMC interfacing)

One question... Are the eMMC interface lines 3V3 level or lower? Someone who can measure on those lines?

We already know how to restore the NAND (with sd card reader), so I think that it would be posible to tell the controller to erase the NAND, unlock it and then flash the nand back with a sd card reader.

If you have a nand backup, that should be a possible option, I agree.

 

[profi200]

The eMMC is 3V3, otherwise it would burn everyones cardreader

 

[obcd]

Normally a cardreader is providing the voltage to it's sd card.
In case of a connected eMMC, the device gets it's power from the 3ds.
Inputs can be tolerant, like everything below 0.6V is seen as a low and everything above 1V is seen as a high.
Still, the io can be desigened for 1.8V or 3.3V. While 1.8V might still work on 3.3V, it's better not to exceed those limits.
Not checking this kind of things usually lead to "working" and "non working" cases, without someone knowing why it is like that.
Like, cardreader x is working and cardreader y is not working, altough they both work with an sd card.

 

[profi200]

The I/Os are 3.3V. Just look in the datasheet's.

 

[obcd]

I don't assume you have a link to those datasheets?
All I could find until now were more commercial leaflets.
Please don't tell me google is my friend. He let me down when I searched for the eMMC chip datasheets.

 

[krisztian1997]

I don't assume you have a link to those datasheets?
All I could find until now were more commercial leaflets.
Please don't tell me google is my friend. He let me down when I searched for the eMMC chip datasheets.

It was already linked several times in this thread/other threads, but this is it http://yourcmc.ru/wiki/images/5/55/EMMC_JESD84-A441.pdf , that datasheet is the same for every eMMC, and this is the datasheet for a samsung eMMC http://pdf.datasheetarchive.com/indexerfiles/Datasheets-AQ2/DSAAQ0030862.pdf (not the same what 3ds uses, but the controller is the same)

 

[obcd]

That datasheet is telling me that there exist high voltage multi media cards and dual voltage multi media cards.
It's not telling me the actual voltage used in the 3ds.
As it's a battery operated device I would expect them to choose for the lower voltage.
I even remember me posting the link to that datasheet myself a couple of days ago. Thanks anyway.

 

[naxil]

i have other datasheet about emmc: http://www2.lauterbach.com/pdf/emmcflash.pdf
Yes, is possible re-set the controller but obviusly is not enough the software for read/write,
but some xbox360 hack (corona 4gb) use the FAkeSD...

 

[obcd]

That datasheet is about the Trace 32 JTAG debugger. It just describes how the device can be used to interface an eMMC.
It probably won't tell the voltage levels used in the 3ds for eMMC interfacing either?

The best way to figure out will likely be measuring the voltage on the eMMC interface lines, as the eMMC can be interfaced with 2 different voltages.

 

[lordofthereef]

Instead of donating it, you could try getting a cheap mmc card and communicate with it using SPI, and if that works then it should be easy to send any commands to the controller directly.

OK, but I don't really know how to do any of that LOL

 

[krisztian1997]

That datasheet is about the Trace 32 JTAG debugger. It just describes how the device can be used to interface an eMMC.
It probably won't tell the voltage levels used in the 3ds for eMMC interfacing either?

The best way to figure out will likely be measuring the voltage on the eMMC interface lines, as the eMMC can be interfaced with 2 different voltages.

From the datasheet for the 4gb NAND:

Power : Interface power → VDD (1.70V ~ 1.95V or 2.7V ~ 3.6V) , Memory power → VDDF(2.7V ~ 3.6V)

Its posible to use 2.7v-3.6v without problems, from what I remember first the CMD0 (reset) is send using 3.6v then after the card answers with IDLE the host can switch the data lines to 1.70v-1.95v while keeping the power lines on 3.6v

 

[kirillov]

*patiently waiting with raspberry in my hand*

thx for your hard work (GbaTeam? ) , i hope my 3ds will be fixed soon

 

[ryuga93]

I have arduino uno,AT Mega and raspberry model B.Just don't have a bricked 3ds.Anyone willing to donate a bricked 3ds?

 

[krisztian1997]

I have arduino uno,AT Mega and raspberry model B.Just don't have a bricked 3ds.Anyone willing to donate a bricked 3ds?

Do you know how to connect an SD card to it ? Because first we should test it with a card, write a program which can erase it and then try it on a bricked 3DS. Then if it works, unbricking consoles will be super easy, it would be posible to even make a small unbricker device what can be used by those who have no programming knowledge (and it would be super cheap)

 

[ryuga93]

Do you know how to connect an SD card to it ? Because first we should test it with a card, write a program which can erase it and then try it on a bricked 3DS. Then if it works, unbricking consoles will be super easy, it would be posible to even make a small unbricker device what can be used by those who have no programming knowledge (and it would be super cheap)

Haven't done that but I can try.If a shell is needed then I need to order online.Any recomended library to use?

 

[krisztian1997]

Haven't done that but I can try.If a shell is needed then I need to order online.Any recomended library to use?

This user found some interesting libraries http://gbatemp.net/threads/has-anyone-with-a-brick-been-able-to-recover.360647/page-4#post-4892087 , the 2nd one should work on arduino without problems with some small edits, the first one... I dont know, theoretically it should work because its for an AVR, but maybe some stuffs needs to be edited to work with arduino pins. As for the shield there is one which already converts from 5v to 3v3, but if you dont have money for that (around $1-$2) then you only need some voltage dividers on the 3v3 pins.

 

[olfa]

Pin SD Mode SPI Mode
Name Type Description Name Type Description
1 CD/DAT3 I/O/PP Card detection / Connector data line 3 CS I Chip selection in low status
2 CMD PP Command/Response line DI I Data input
3 Vss1 S GND VSS S GND
4 Vdd S Power supply VDD S Power supply
5 CLK I Clock SCLK I Clock
6 Vss2 S GND VSS2 S GND
7 DAT0 I/O/PP Connector data line 0 DO O/PP Data output
8 DAT1 I/O/PP Connector data line 1 RSV
9 DAT2 I/O/PP Connector data line 2 RSV

http://pinouts.ru/Memory/sdcard_pinout.shtml

 

[Dan-the-Rebirth]

hey if i make a DIY/NAND backup of my 4.5 firmware befor using my gateway, and get bricked in the future i can allways unbrick my 3ds, by reinstalling the old nand.bin right?