Homebrew [RELEASE] TWLTool - DSi downgrading, save injection, etc multitool

nocash123

Well-Known Member
Member
Joined
Aug 4, 2015
Messages
133
Trophies
0
XP
900
Country
Afghanistan
Many thanks! Hmmm, no. Win98 still tells me it needs a newer windows version, and Win7 is now telling me that a MSVCR120.dll is missing (btw. that's one reason why I am developing under win98 - whatever I am doing, I can be quite sure that my programs will really work everywhere).
 

Normmatt

Former AKAIO Programmer
Member
Joined
Dec 14, 2004
Messages
2,161
Trophies
1
Age
33
Website
normmatt.com
XP
2,197
Country
New Zealand
Many thanks! Hmmm, no. Win98 still tells me it needs a newer windows version, and Win7 is now telling me that a MSVCR120.dll is missing (btw. that's one reason why I am developing under win98 - whatever I am doing, I can be quite sure that my programs will really work everywhere).
You should upgrade to ReactOS its an open source windows XP clone.
 
  • Like
Reactions: piratesephiroth

piratesephiroth

I wish I could read
Member
Joined
Sep 5, 2013
Messages
3,453
Trophies
2
Age
103
XP
3,233
Country
Brazil
Many thanks! Hmmm, no. Win98 still tells me it needs a newer windows version, and Win7 is now telling me that a MSVCR120.dll is missing (btw. that's one reason why I am developing under win98 - whatever I am doing, I can be quite sure that my programs will really work everywhere).
aw crap... I forgot about the dlls.

This one should not need them (but it still needs at least windows XP)
 

Attachments

  • twltool_x86_static.rar
    55.5 KB · Views: 171
  • Like
Reactions: nocash123

Gadorach

Electronics Engineering Technologist
Member
Joined
Jan 22, 2014
Messages
970
Trophies
0
Location
Canada
XP
956
Country
Canada
@nocash123 Just curious, but have you looked into the DSi XL/LL mainboard? I'm trying to fix a DSi XL I was researching but broke the RA that handles the DAT0-DAT3 connections to the NAND. Your DSi PCB partlist/pinout picture shows it as a quad isolated 14k, but replacing the RA with four 14k 0402 SMD resistors just got me the 0000FEFE bootloader error. Still, an improvement over black-screen coma booting. I managed to get a read from one of the sets of the RA after I took it off the board, but I used the solderblob method to remove it, so I don't know if it's accurate. It came up as 270 Ohms, but I can't be sure that's correct. I have the 0402s for 270 Ohms though, so I plan to try it, but if you could confirm, that would be sweet.
 
  • Like
Reactions: VinsCool

nocash123

Well-Known Member
Member
Joined
Aug 4, 2015
Messages
133
Trophies
0
XP
900
Country
Afghanistan
Many thanks for the new 32bit executable, this time it's working (with Win7). That's really helping me (I was about to downgrade to my old version without sudokuhax, or to write my own decryption tool, but with twltool it's a lot easier).

ReactOS sounds interesting, I wasn't aware of that project. Downside is that using a clone OS might be a bit dangerous when using it for compatibility tests (like ending up with an executable that work only with the clone, not with real winxp).

I don't have an DSi XL, but checked the resistors again on my normal DSi. Measured in one direction I am getting around 14.5Kohm, but when swapping the pins I am getting 17.7Kohm. Apparently there are some electrons flowing through the attached chips. 17.7K should be more accurate, but it might still have the same issue, so real value might be 20Kohm or even higher.
270 ohm sounds almost definitely wrong, that would give you lots of Watts for a pullup resistor (from my experiences pullup's are usually in 3.3K .. 33K range). Checking two Samsung datasheets: KMCEN0000M-S998000 recommends 50K .. 100K, and KLMXGXFEJA recommends 10K .. 100K, for the eMMC Data lines. With the big XL case, you could probably attach a small circuit board with some solderpads somewhere, wire it to the datalines, and then wire normal non-SMD resistors to the solderpads. I would try something like 20K, 33K, 50K (and check if you get 14K one-direction and 17K other-direction after connection, if so, then you've probably found the right resistor).
 

Gadorach

Electronics Engineering Technologist
Member
Joined
Jan 22, 2014
Messages
970
Trophies
0
Location
Canada
XP
956
Country
Canada
I don't have an DSi XL, but checked the resistors again on my normal DSi. Measured in one direction I am getting around 14.5Kohm, but when swapping the pins I am getting 17.7Kohm. Apparently there are some electrons flowing through the attached chips. 17.7K should be more accurate, but it might still have the same issue, so real value might be 20Kohm or even higher.
270 ohm sounds almost definitely wrong, that would give you lots of Watts for a pullup resistor (from my experiences pullup's are usually in 3.3K .. 33K range). Checking two Samsung datasheets: KMCEN0000M-S998000 recommends 50K .. 100K, and KLMXGXFEJA recommends 10K .. 100K, for the eMMC Data lines. With the big XL case, you could probably attach a small circuit board with some solderpads somewhere, wire it to the datalines, and then wire normal non-SMD resistors to the solderpads. I would try something like 20K, 33K, 50K (and check if you get 14K one-direction and 17K other-direction after connection, if so, then you've probably found the right resistor).
Sounds good. I might just try lifting the RA from another console though, as that seems to be the only way to accurately measure it.
 

loco365

Well-Known Member
Member
Joined
Sep 1, 2010
Messages
5,457
Trophies
0
XP
2,927
Wait so how do I downgrade my DSi XL 1.4.5 Aus then using this???
You'll have to hardmod so you can dump your NAND which requires soldering, use one of three proven methods to get one of the keys, and get another key from your system (I'm not sure on how it's done since it's all being done for me essentially), then decrypt your NAND and inject older versions of some applications. It's not a task for the faint-of-heart.

There's a thread here if you'd like to give it a try: http://gbatemp.net/threads/dsi-downgrading-the-complete-guide.393682/
 

Coto

-
Member
Joined
Jun 4, 2010
Messages
2,979
Trophies
2
XP
2,565
Country
Chile
I wonder if gbaemu4ds would actually have been completed if nocash123 had joined the board years ago

I can answer that partially.

gbaemu4ds triggers cpu exceptions like ive rarely seen before. For example, from what I remember, clearing the I and F bit on the CPSR at the same time and set this new CPSR causes to follow a forced IRQ exception (which is why it's saving context stack on swi right after a GBA BIOS SWI call is performed), MPU disabled at this point, so the IRQ handler takes all NDS IF&IE enabled so far, then MPU enabled resorts to GBA IRQ handler blindly, so all gbawrites are redirected to each mapped GBA IO map (assigned and used like VBA does). This is hard to emulate basically because the CPU must emulate the order of priority of each CPU exception for each executed opcode that must be profiled on cycles. Because the cycle count says when it's time to trigger SWI or IRQ, and how many cycles should be substracted while keeping USER mode cycle count queued.

MPU is a whole another world
 
  • Like
Reactions: piratesephiroth

piratesephiroth

I wish I could read
Member
Joined
Sep 5, 2013
Messages
3,453
Trophies
2
Age
103
XP
3,233
Country
Brazil
His intellectual growth would have been stunted and we would have received nothing more from him. :P
Well, it could not have been finished because there was no NDS emulator acurate enough. Maybe @nocash123 could have found a way to implement the missing features.



I can answer that partially.

gbaemu4ds triggers cpu exceptions like ive rarely seen before. For example, from what I remember, clearing the I and F bit on the CPSR at the same time and set this new CPSR causes to follow a forced IRQ exception (which is why it's saving context stack on swi right after a GBA BIOS SWI call is performed), MPU disabled at this point, so the IRQ handler takes all NDS IF&IE enabled so far, then MPU enabled resorts to GBA IRQ handler blindly, so all gbawrites are redirected to each mapped GBA IO map (assigned and used like VBA does). This is hard to emulate basically because the CPU must emulate the order of priority of each CPU exception for each executed opcode that must be profiled on cycles. Because the cycle count says when it's time to trigger SWI or IRQ, and how many cycles should be substracted while keeping USER mode cycle count queued.

MPU is a whole another world

Yeah, it was a very ambitious project, probably the greatest NDS homebrew.
I wish it could have been completed.
 
Last edited by piratesephiroth,

Wizardkoer

Wii Veteran - 17
Member
Joined
Jul 14, 2015
Messages
513
Trophies
0
XP
402
Country
Australia
You'll have to hardmod so you can dump your NAND which requires soldering, use one of three proven methods to get one of the keys, and get another key from your system (I'm not sure on how it's done since it's all being done for me essentially), then decrypt your NAND and inject older versions of some applications. It's not a task for the faint-of-heart.

There's a thread here if you'd like to give it a try: http://gbatemp.net/threads/dsi-downgrading-the-complete-guide.393682/


I've done soldering before and made quite a few PCB so yeah I should be able to solder. I'll have a look at that thread.
 

Gadorach

Electronics Engineering Technologist
Member
Joined
Jan 22, 2014
Messages
970
Trophies
0
Location
Canada
XP
956
Country
Canada
Has anyone played with the 3DS features at all yet? I haven't gotten any feedback about any of them yet.
I've personally been so caught up in school and the DSi, I didn't even look into the 3DS part. I guess that's partly because TWL is already decrypted when Decrypt9 dumps it.
 

WulfyStylez

SALT/Bemani Princess
OP
Member
Joined
Nov 3, 2013
Messages
1,149
Trophies
0
XP
2,877
Country
United States
I've personally been so caught up in school and the DSi, I didn't even look into the 3DS part. I guess that's partly because TWL is already decrypted when Decrypt9 dumps it.
i spose it's mostly neat b/c you can do sudokuhax/etc on any system up to 9.9 with just a raspi/equivalent to get your CID.
 
  • Like
Reactions: Gadorach

zoogie

playing around in the end of life
Developer
Joined
Nov 30, 2014
Messages
8,560
Trophies
2
XP
15,000
Country
Micronesia, Federated States of

WulfyStylez

SALT/Bemani Princess
OP
Member
Joined
Nov 3, 2013
Messages
1,149
Trophies
0
XP
2,877
Country
United States
wulfy, have you ever looked into this?
http://3dbrew.org/wiki/3DS_System_Flaws (search DSiWare_Exports)

This looks like it wouldn't be too hard if you could decrypt dsiware exports on 3ds.
it's more of a neat technical note than something worth doing, especially since this tool lets you do basically the same thing.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    Psionic Roshambo @ Psionic Roshambo: https://www.tomshardware.com/tech-industry/manufacturing/new-memory-demoed-running-at-600-degrees...