Hardware nintendo DSi CPUs

[k66]

Last year, I saw the 37c3 modchip and then found @PoroCYon(PCY)'s blog.
Where one of the posts displayed the DSi Panda motherboard. It had an 'LR359A12' CPU on it (the retail version of the DSi uses the 'CPU TWL' or 'CPU TWL A').
A comment that says this CPU is being sold online. I found the dealer, and when I saw they had it in stock, I bought some. But I don't have a fully functional spare board, so I haven't replaced them.
Although I have a DSi Panda, I never knew it had a 'LR359A12' CPU, and there is no related information online.
Later I saw that PCY uploaded photos of the IS-TWL-DEBUGGER motherboard, and its CPU is also the 'LR359A12'.
So it seems that this is a CPU dedicated to development machines?
---------
UPDATE: (time-saving conclusion)
According to #7 & #12, I think 'LR359A12' ≈ 'CPU TWL', early production model.
'CPU TWL' was used for early retail DSi, while 'LR359A12' was used for development DSi.
'CPU TWL A' is a later production model, for later retail version DSi. Its development version is 'LR359A22' #27.
---------
(The following content is arranged in the order of my personal timeline, so it might be a bit confusing.)
I noticed there are some differences between the substrate of 'CPU TWL A' and 'LR359A12'.

Are there any other differences between these two CPUs?
.
Not long ago, one of my unused DSi had a graphical glitches, it seems the CPU has a cold solder joint.
I went ahead and replaced it, just for fun
(Click the image to view original)

The CPU I replaced
- CPU: LR359A12 , "0923 3m", produced in 2009/06?, console ID:08A2277024096132
.
Then I had a professional take CPU dieshot.
(The CPU size is measured manually and may have some error)

The CPU on the right
- CPU: TWL A , "0944 7K", produced in 2009/10?, console ID:0820150305099126
- iQue DSi, TCF100264951
- board C/TWL-CPU-10
- Wireless card DWM-W024
- eMMC CID:BC847011EF034D303046504100001500, produced in 2009/11, NAND product.log date 2010/01/25

The CPU on the left
- CPU: LR359A12 , "0925 4m", produced in 2009/06?, console ID:08A*, substrate number "D2"
.
.
.
This afternoon, I received dieshot.
(The original image is very large, and I don't know the forum's upload limits, so I resized the image)
(Click the image to view)

They are indeed different.
The core of the ‘LR359A12’ is larger than that of ‘CPU TWL A’.
...LR359A12 (left)......CPU TWL A (right)...

...LR359A12 (left)......CPU TWL A (right)...

.
Details (LR359A12): It might be made by Sharp?

Details (CPU TWL A): It might be made by Fujitsu?

.
.
Additional note: (Edited)
(I was mistaken before(i'm a noob), efuse only exists in the CPU, and MBR is related to NAND encryption.)
Since the Console ID (CPU ID) is used to initialize KEY_X values for eMMC encryption/decryption [1], the original NAND becomes useless after replacing the CPU.
If you only replace the CPU, ntrboot can launch some homebrew software(e.g. godmode9i, hbmenu, safenandmanager) that doesn't check the MBR, then using slot1launch can boot DS/DSi cartridge and flashcards (without sound&wifi, same situation when using ntrboot to launch slot1launch on a retail DSi).

[1] Martin Korth. GBATEK, DSi Console IDs
.
.
UPDATE
Related to 'LR359A12' CPU:
- Make a DSi panda ‘clone’ . #14
- Transform the DSi panda 'clone' into a ‘real’ DSi panda clone . #16
- Install the system from zero, make a real DSi panda . #17
- IR photo of 'LR359A12'. #26
- Dieshot of 'LR359A12'. #30

Related to 'LR359A22' CPU:
- The development version of 'CPU TWL A'. #27

Related to DSi panda:
- #17, #18
- DSi panda's slot1launch. #20 #21
- Install TWiLightMenu++ and SD card's Unlaunch when using the prototype menu. #25
- SignaPicDSi for dev (DSi panda)
- Install unlaunch on development units (pandas) (rvtr's tutorial)

 

[edo9300]

Since the Console ID (UID, eFuse ID, UniqeID) is written to the eMMC's efuse, the original NAND becomes useless after replacing the CPU. You need to replace it with a new eMMC, or use a micro SD card as a substitute. At present, it seems there is no way to install NAND from zero.

The nand should be "reusable", you use twlnandtool to decrypt it and then reencrypt it to the other console (by changing the cpu id when reencrypting), and recreating the hwinfo file. (You can do that since you'd now be using a dev console). Also there are factory tools that create a nand from scratch (that would work for dev consoles)

 

[k66]

The nand should be "reusable", you use twlnandtool to decrypt it and then reencrypt it to the other console (by changing the cpu id when reencrypting), and recreating the hwinfo file. (You can do that since you'd now be using a dev console). Also there are factory tools that create a nand from scratch (that would work for dev consoles)

I don't have the twlnandtool (I don't know how to compile).
I have consulted @rvtr before, he told me the program might have bugs and doesn't recommend me to use it.
.
I tried SDMC_Launcher today (I replace the Stage2 files in the NAND), failed, SDMC_Launcher did not start.
I have previously tried on a retail DSi, and it can indeed launch SDMC_Launcher.

 

[edo9300]

I don't have the twlnandtool (I don't know how to compile).
I have consulted @rvtr before, he told me the program might have bugs and doesn't recommend me to use it.
.

This twlnandtool https://github.com/TuxSH/twlnandtool (not rvtr's tool)

I tried SDMC_Launcher today (I replace the Stage2 files in the NAND), failed, SDMC_Launcher did not start.
I have previously tried on a retail DSi, and it can indeed launch SDMC_Launcher.

Sdmc launcher has a dev and retail build (since it checks scfg_op), both available

 

[PoroCYon]

Hi, someone pinged me with a link to this post (I don't look at GBATemp otherwise), so I guess I'll write what I know by now.

The current hypothesis is that the only functional difference is that the dies are bonded out differently, which is reflected in the SCFG_OP IO register. This register is read by the second-stage bootloader to then in turn configure SCFG_JTAG with a specific value, to enable either ARM7, ARM9 or DSP debugging. (The LR359A12 most likely allows for ARM9 JTAG). Problem is, the JTAG pinout is entirely unknown, which is why I am doing the ISTD RE in the first place.

Regarding the die shots, these seem to be of the top metal layer only, and everything looks roughly like standard cell logic. With the differing IO pads it does seem like they have been fabricated by different fab houses indeed. This would have necessitated generating a new synthesis, place&route, and GDSII output per fab house (because they most likely have different design rules and standard cells). Hence, most of the differences you see in the die shots are most likely because of that, instead of any sort of functional difference.

To see anything 'useful' (to be able to see the different components, CPU cores, etc. inside the chip), you'd need a die shot of the bottom transistor layer, and I expect these to be very similar between the two. The bond wires -- the parts hypothesized to be the actual difference -- are not visible in die shots, but instead you need micrometer-resolution X-ray scans of the unopened BGA packages.

As part of the ISTD RE, I'm planning on taking such an X-ray scan of the LR359A12, but unfortunately this work is being delayed because there's other more important stuff I have to deal with. Making bottom-layer die scans is more annoying because for that you'd have to either remove the chip from its package entirely (instead of merely exposing it, as shown in your photos) and then delayer it, or you'd have to take a backside IR image (which will only have a ~1µm resolution). I have tools to take backside IR images, but no tools to decapsulate a CPU-TWL or LR359A12 (they're wire-bond BGAs, not flip-chip BGAs, so it needs acids to do, which I don't have).

 

[rvtr]

Also there are factory tools that create a nand from scratch (that would work for dev consoles)

Not from scratch. You'll still need to have an MBR written to the NAND (I believe this would be done externally).

I have somewhat barely working copies of my TwlNandTool (thank you edo for clarification) that can write MBR, if needed. Would prefer to post in PMs though. The basic process should be:
- Write MBR & SDMC Launcher bootloader
- Boot TWL EVA PRE_IMPORT from SDMC Launcher, then use it to install factory firmware (this should be the default process)
- BEFORE EXITING PRE_IMPORT, you will want to reinstall the SDMC Launcher. It gets replaced by a normal stage2 which is useless.
- Use SDMC Launcher to boot Twl SystemUpdater (if you forgot to reinstall SDMC Launcher, flash Twl SystemUpdater to a dev cart)

PRE_IMPORT sets up the NAND, and Twl SystemUpdater installs the firmware and sets HWInfo.

 

[PoroCYon]

Had to dig a bit for this, but, a long time ago, others tried decapsulating the CPU-TWL, but they also only imaged the top layer (aka the kind of useless layer). It looks like this: .

The IO pads (and die shot in general) look the same as your LR359A12 die shot, and different from your CPU-TWL, even though this was also a retail chip. hence: the DSi SoC chip was made by two different fab houses, which needed different tooling runs. The differences you are seeing in the die shots don't actually cause any difference in functioning.

EDIT: if anyone has (pre-)decapsulated CPU-TWL/LR359A12 chips, I can take a backside IR scan of it if you want (so we can get some "actually informative" die shots), just send them my way (contact me via email/Signal/Mastodon/Matrix).

Post automatically merged: Feb 10, 2026

The core of the ‘LR359A12’ is larger than that of ‘CPU TWL A’.

Sorry for the doublepost but: as these are different fab houses, I just expect the LR359A12 to be physically larger because the standard cell layout and/or transistor size (aka "technology node") would be different. Same n# of logic gates, but larger logic gate size, means a larger die area too.

 

[rvtr]

Sdmc launcher has a dev and retail build (since it checks scfg_op), both available

This, also please keep in mind that you can only boot SRLs with complete secure areas. No homebrew, no cartridge dumps, no DSiWare, etc. Only full/complete/original SRLs compiled from the SDK, or ones released on the NDP. PRE_IMPORT is the only full SRL that will work on retail.

I have dev and retail versions here:
https://cdn.randommeaninglesscharacters.com/file_share/Twl_PRE_IMPORT_SD.ver1.0.dev.srl
https://cdn.randommeaninglesscharacters.com/file_share/Twl_PRE_IMPORT_SD.ver1.0.prod.srl
https://cdn.randommeaninglesscharacters.com/file_share/Twl_PRE_IMPORT_SD.ver1.3.dev.srl
https://cdn.randommeaninglesscharacters.com/file_share/Twl_PRE_IMPORT_SD.ver1.3.prod.srl

Haven't checked the dev versions but they should be correct...

 

[k66]

Had to dig a bit for this, but, a long time ago, others tried decapsulating the CPU-TWL, but they also only imaged the top layer (aka the kind of useless layer). It looks like this:

Can you upload images? Due to internet issues (GFW), I can't access certain websites.

 

[PoroCYon]

Does this work?

EDIT: original size (26 MB) here: https://pcy.be/tmp/img/49548423821_c618b33e2d_o.jpg

 

[k66]

I observed the top layer photos of the CPU TWL and LR359A12, and they seem to be the same.
I think 'CPU TWL' = 'LR359A12' , It made by Sharp.
'CPU TWL A' is an improved version, It made by Fujitsu.

 

[PoroCYon]

I observed the top layer photos of the CPU TWL and LR359A12, and they seem to be the same.
I think 'CPU TWL' = 'LR359A12' , It made by Sharp.
'CPU TWL A' is an improved version, It made by Fujitsu.

For the CPU xxx <-> LRxxx mapping: a few years ago, some PDFs from Sharp were discovered just being accessible online without login. These two documents: a, b both list LR359Ax chip numbers, but the final digit is missing. However, with the SCFG_JTAG and SCFG_OP docs, a pattern becomes clear:

• LR359A10: CPU-TWL (retail/prod) [confirmed?]
• LR359A11: dev CPU-TWL SoC, ARM7 debug
• LR359A12: dev CPU-TWL SoC, ARM9 debug [confirmed]
• LR359A20: CPU-TWL-A (retail/prod) [confirmed?]
• LR359A21: dev CPU-TWL-A SoC, ARM7 debug
• LR359A22: dev CPU-TWL-A SoC, ARM9 debug [edit: confirmed]

LR359Axy = DSi/TWL SoC , x = chip revision, y = SCFG_OP value

 

[rvtr]

Not from scratch. You'll still need to have an MBR written to the NAND (I believe this would be done externally).

I have somewhat barely working copies of my TwlNandTool (thank you edo for clarification) that can write MBR, if needed. Would prefer to post in PMs though. The basic process should be:
- Write MBR & SDMC Launcher bootloader
- Boot TWL EVA PRE_IMPORT from SDMC Launcher, then use it to install factory firmware (this should be the default process)
- BEFORE EXITING PRE_IMPORT, you will want to reinstall the SDMC Launcher. It gets replaced by a normal stage2 which is useless.
- Use SDMC Launcher to boot Twl SystemUpdater (if you forgot to reinstall SDMC Launcher, flash Twl SystemUpdater to a dev cart)

PRE_IMPORT sets up the NAND, and Twl SystemUpdater installs the firmware and sets HWInfo.

I’ve been talking with k66 and there seem to be some problems with launching the SystemUpdater. Disregard this message for now. I’ll post an update once I have worked out the issues.

 

[k66]

I have successfully booted NAND now.
Although it is currently just a clone of my DSi panda, I'm happy to see it come back to life.

thanks to @rvtr And to everyone who helped me, thank you.
.
The method I am currently using is:
Use the methods of 'Region changing a DSi on NAND' & 'Replace stage2' to 'clone' a DSi Panda console.
(For reference only.)

Spoiler

Do not attempt if you do not have an ntrboot cart.
Steps
1.Fix NAND:
1.1.ntrboot (twlnandtool)(rvtr's tool), Repair MBR. This is the most crucial.
1.2.Import NandFirm(SDMC) using twlnandtool.
1.3.Restart DSi ,SDMC_Launcher loading TWL EVA PRE_IMPORT 1.0dev/1.3dev (menu.srl) and install.
If ERROR 31-11: TWL EVA → Checker Menu → LOG → Write Dummy
If ERROR 09-06: TWL EVA → Evaluation Menu → RTC → RTC to RAW(DEB) & RAW to FAT(DEB)
(These two errors seem to be skippable. Once, I just clicked around in the Checker Menu/LOG and was able to get past these two errors. It might be that I unchecked some options in 'Checker Menu → Set Sequence'.)
(If TWL EVA PRE_IMPORT is not installed, OSFMount cannot access twl_main.img)
---------
2.Backup NAND: ntrboot(godmode9i) → safenandmanager, dump NAND.
---------
3.Edit NAND:
3.1.Change DSi region: Region changing a DSi on NAND (rvtr's tutorial)
(I used my DSi Panda NAND as a donor.)
(I tried using retail DSi NAND as a donor, the result is black screen and blue LED stays on.)
(Pay attention to the wifi board, DWM-W015 used for all, DWM-W024 or J27H020 used for V1.4 or higher.)
3.2.Replace stage2 files.
(stage2_bootldr.bin, stage2_footer.bin, stage2_infoblk1.bin, stage2_infoblk2.bin, stage2_infoblk3.bin)
(Copy all bytes from the donor file, then select all bytes of the target file, then paste.)
---------
4.Restore NAND: ntrboot(godmode9i) → safenandmanager, restore NAND.
Now I can boot Unlaunch, TWiLightMenu++, Launcher(Original system, DSimenu).
Cartridge:
- Nitro (DS) cart work fine.
- DS cart with special hardware work fine. (e.g. DS-TV)
- Hybrid (DS & DSi) cart unrecognized in DSimenu. Starting with slot1launch works fine, work in DSi mode, camera works.
- Limited (DSi only) cart unrecognized in DSimenu. Starting with slot1launch works fine. (e.g. DSi XL Demo Video)
- Flashcard work fine. (e.g. DSONEi&AK2i)
(The situation is same as original DSi panda V1.4U_dev.)
.
I will try using TwlSystemUpdater again later.
Now that I have ntrboot and a NAND backup, I can mess around with it as much as I want.
.
Good news, TwlNmenu work
(slot1launch can be installed using TwlNmenu.)

.
I tried hiyaCFW, using both the original NAND and the current NAND, hiyaCFW version 1.6.2.
The hiyaCFW SELECT settings interface appears, but then it gets stuck on a white screen.
.
.
.
What I'm about to do next:
- I don't know if TwlNmenu can install the TwlSystemUpdater.tad from the SD card, I'll give it a try. Update: Completed, update system using TwlSystemUpdater ( #17).
- Try other hiyacfw versions. Update: Completed ( #17).
- Looking for some good motherboards to replace the CPU, and also trying to replace the CPU as well as a new eMMC or TF card. (Since the only motherboard on which I have currently replaced the CPU comes from a faulty machine, It seems have a problem, sometimes there's no sound(one of the original faults), I can fix it by pressing framework...The motherboard may have warpage or an open circuit.)

 

[k66]

Outdated, for reference only.

Spoiler

The current situation:
I still can't install the system from zero, nor use the original NAND and hiyaCFW.
.
'Region changing a DSi on NAND'(depend on Unlaunch) & 'Replace stage2' to 'clone' a DSi Panda seems to be the only way to get the original eMMC working again.
So I tried various combinations of NAND.
OK = Launcher work
NG = Launcher error

retail DSi: use retail NAND OK
DSi hiyaCFW(retail DSi) work, hiyaCFW(panda) error 1-2345-8325.
melonDS boot NAND OK

retail DSi: use panda NAND NG
DSi can boot Unlaunch & hiyaCFW(retail DSi), hiyaCFW(panda) error 1-2345-8325.
DSi Launcher&SystemSetting always error "An error has occurred".
Prototype Launcher(NAND/SD>40DD22EE.app) can be started with Unlaunch, unable to run apps.
The same situation with melonDS.

retail DSi: use panda NAND + panda stage2 NG
DSi black screen and blue LED stays on.

'LR359A12'DSi: use panda NAND + panda stage2 OK
DSi can boot Unlaunch, Launcher, etc. work fine.
Unlaunch starts hiyaCFW(retail DSi & panda) NG wihtescreen.
(After consulting the developer, it seems this is normal, currently hiyaCFW is not compatible with DSi panda.)
EDIT: DSi hiyaCFW(panda) work.
(The white screen is due to using an old bootloader.nds when making hiyaCFW.)
melonDS wihtescreen.

'LR359A12'DSi: use retail NAND + panda stage2 NG
DSi black screen and blue LED stays on.
melonDS wihtescreen.

'LR359A12'DSi: use retail NAND + retail stage2 NG
DSi black screen and blue LED stays on.
melonDS can boot Unlaunch & hiyaCFW(retail DSi)

'LR359A12'DSi: use panda NAND + retail stage2 NG
DSi black screen and blue LED stays on,
melonDS can boot Unlaunch & hiyaCFW(retail DSi)

Post automatically merged: Feb 23, 2026

It seems that TwlSystemUpdater installed with TwlNmenu was successful ???
Although it displays "Update Failure!" ???
(If use TDT to install TwlSystemUpdater1.2 to SysNAND, the installation process is the same, final displays "Update Failure!", restart DSi will result in the error "An error has occurred".)

DSi started normally, and the version changed to 1.2U(originally it was 1.4U_dev), Unlaunch is unavailable (was it deleted?).

I directly use a region-changed NAND(DSi panda 'clone', #14, boot via Unlaunch), I thought I would fail (because the Launcher is read-only).
I need to check the NAND...

Post automatically merged: Feb 23, 2026

I compared the files in the NAND:
Launcher's app(title\00030017\484e4145\content\7412e50d.app) hasn't changed, it's read-only.
Unlaunch tmd(title\00030017\484e4141\content\title.tmd) hasn't changed, it's read-only.
(TwlSystemUpdater did not update them because of read-only attributes.)

All other system apps have been updated.
(e.g. The album used to have a FB icon, but now it doesn't. Memory Pit always work, can boot TWiLightMenu++)

cert.sys hasn't changed
HWID.sgn has changed
HWINFO_N.dat has changed
HWINFO_S.dat has changed
(TwlSystemUpdater updated them）
.
Then I deleted the Unlaunch tmd(title\00030017\484e4141\content\title.tmd)
Removed the read-only attribute of the Launcher(title\00030017\484e4145\content\7412e50d.app)
Deleted TwlSystemUpdater (title\00030015\30535541)
After restoring NAND...
Wow, I think I succeeded? this is a real DSi panda clone???Its Launcher doesn't run through Unlaunch.
.
Installing Unlaunch(original Unlaunch) will display: Unknow bootcode version.
(The situation is same as original DSi panda V1.4U_dev.)
(If it's a region-changed DSi panda 'clone', there is an Unlaunch tmd in the 484e4141 folder, Unlaunch tmd and Launcher'app as read only, Unlaunch will be successfully installed to the Launcher's tmd, and display "installation complete".)

.
There are still problems...
TwlNmenu: screen freezes when installing tad, and the progress bar is blank.
NandFiler: screen freezes after startup.
(I guess it's because the Launcher hasn't been updated? Or is it a bug in system version 1.2?)
Other system apps (&system settings) are running normally.
.
I started TWiLightMenu++ with Memory Pit , and then I installed the new version of TwlNmenu and NandFiler using TDT.
They are working now.

 

[k66]

Transform the DSi panda 'clone' into a ‘real’ DSi panda clone
(For reference only.)

Spoiler

Do not attempt if you do not have an ntrboot cart.
Steps
1.Make a DSi panda ‘clone’ . #14
(region-changed DSi: use panda NAND + panda stage2, boot via Unlaunch.)
---------
2.Update HWINFO file
2.1.Start DSi(Launcher), install TwlSystemUpdater(.tad) using TwlNmenu.
(If TwlNmenu doesn't work, use TDT to install TwlNmenu Rev.11437 to SysNAND.)
2.2.Start TwlSystemUpdater in DSimenu.
2.2a.Select the same region as NAND.
(TwlSystemUpdater will display "Update Failure!")
(Because the DSi panda 'clone' includes read-only Launcher, TwlSystemUpdater did not update them.)
2.2b.Select a region different from NAND (change region).
(TwlSystemUpdater will display "Update Failure!")
2.3.Restart the DSi, it should start the initial setup. Unlaunch is unavailable.
(If “An error has occurred" appears after restarting DSi, restore NAND backup using ntrboot.)
---------
3.Backup NAND:
ntrboot(godmode9i) → safenandmanager, dump NAND.
(Or use any exploit to boot TwilightMenu++ → safenandmanager, dump NAND.)
---------
4.Edit NAND:
4.1.Delete the Unlaunch tmd(NAND:/title/00030017/484e4141/content/title.tmd). Or delete the 484e4141 folder.
(If previously reinstalled Unlaunch using the original Unlaunch, also need to manually delete Unlaunch from the Launcher’s tmd.)
4.2a.TwlSystemUpdater selected the same region as before:
Remove the read-only attribute of the Launcher(NAND:/title/00030017/484e41**/content/xxxxxxxx.app), xxxxxxxx=file name.
4.2b.TwlSystemUpdater change region before:
Delete the Launcher folder from other regions (NAND:/title/00030017/484e41**/), **=region code.
(TwlSystemUpdater is still in the NAND)
---------
5.Restore NAND:
ntrboot(godmode9i) → safenandmanager, restore NAND.
(Or use any exploit to boot TwilightMenu++ → safenandmanager, restore NAND.)
Restart the DSi, it should start up normally.
---------
6.Update Launcher
Start TwlSystemUpdater in DSimenu.
(TwlSystemUpdater will display "Update Success!")
Restart the DSi, it should start the initial setup. Now it is a 'real' DSi Panda clone.




Others
- If TwlNmenu and NandFiler doesn't work, started TWiLightMenu++ with Memory Pit , and then installed the new version of TwlNmenu and NandFiler using TDT. (or ntrboot(godmode9i) → TDT)
- Delete TwlSystemUpdater (NAND:/title/00030015/30535541/)

 

[k66]

rvtr‘s method is correct, I think I got a lot of things wrong at the beginning , which caused the failure.
(Only TwlSystemUpdater ver 1.2 srl can works on SDMC_Launcher, and I have been using other card based versions)
(TwlSystemUpdater cannot be renamed to menu.srl, this will result in a black screen.)
(DSi system version1.2 is a very old system, and its development apps doesn't seem to support 64GB SDXC, the SDHC card still gets stuck, a 2GB SD card can be used. So this time I am only using a 2GB SD card.)
(Pay attention to the Wi-Fi board, DWM-W015 can be used for all system(firmware) versions, DWM-W024 or J27H020 used for Ver1.4 or higher.)
I've really taken a very long winding path...
It seems I previously used a strange method to get the NAND to work.
.
Did @rvtr notice it from the very beginning?
.
.
This is the correct method:
Install the system from zero, make a real DSi panda. (You can also use this method to build NAND.)

Things needed:
- 'LR359A12'cpu DSi
- 2GB SD card (FAT format) (Recommend)
- twlnandtool (SD:/ntrboot.nds)
- TWL EVA PRE_IMPORT v1.3 dev (SD:/menu.srl)
- TwlSystemUpdater v1.2（e.g. SD:/TwlSystemUpdater_v1.2_20090710.srl)
- DWM-W015 Wi-Fi board
---------
Steps
1.Fix NAND:
1.1.DSi ntrboot (twlnandtool, ntrboot.nds)(rvtr's tool), Repair MBR.
(Or use twlnandtool(TuxSH's tool) to repair MBR: decrypt the original NAND(with the original no$gba footer) twlnandtool nandcrypt nand.bin nand2.bin, output NAND2. Modify the consoleID in the no$gba footer of the NAND2. Then use twlnandtool to encrypt NAND2, and after encryption, the MBR of the NAND is normal.)
1.2.Import NandFirm(SDMC) using twlnandtool.
1.3.Restart DSi ,SDMC_Launcher loading TWL EVA PRE_IMPORT v1.3 dev (menu.srl) and install.
If ERROR 31-11: TWL EVA → Checker Menu → LOG → Write Dummy
If ERROR 09-06: TWL EVA → Evaluation Menu → RTC → RTC to RAW(DEB) & RAW to FAT(DEB)
(Or TWL EVA → Checker Menu → LOG → Write Log)
(Or TWL EVA → Checker Menu → Set Sequence, unchecked 31-11 and 09-06)
(If TWL EVA PRE_IMPORT is not installed, OSFMount cannot access twl_main.img)
(After PRE_IMPORT installation is complete, TWL EVA cannot install SDMC_Launcher, stuck at 2 pass)
1.4.Power off DSi and remove SD card, delete menu.srl from SD card.
---------
2.Install the system
2.1.Put the TwlSystemUpdater v1.2 on the SD card root, insert the SD card into DSi.
2.2.DSi ntrboot (twlnandtool, ntrboot.nds), Import NandFirm(SDMC).
2.3.Restart DSi, SDMC_Launcher loading TwlSystemUpdater, installation complete will display "Update Success!".
2.4.Restart DSi, it should start the initial setup.
(It has a new serial number, I think it is a real DSi panda.)
(The system version is 1.2, e.g. Ver 1.2U)
(TwlNmenu and NandFiler are Rev.9826, a 2GB SD card can be used.)

Details

Spoiler

1.Fix NAND:
1.1.Repair MBR using twlnandtool:

1.2.Import NandFirm(SDMC) using twlnandtool:

1.3.Restart DSi ,SDMC_Launcher loading TWL EVA PRE_IMPORT v1.3 dev (menu.srl) :

If ERROR 31-11:
(Press A button EXIT to TWL EVA [START MENU] )
START MENU → Checker Menu → LOG → Write Dummy:
(Return to [START MENU], press B button, then press A button Exec [PRE IMPORT])

If ERROR 09-06:
(Press A button EXIT to TWL EVA [START MENU] )
START MENU → Evaluation Menu → RTC → RTC to RAW(DEB) & RAW to FAT(DEB):
(Return to [START MENU], press B button, then press A button Exec [PRE IMPORT])

Install PRE_IMPORT:

---------
After PRE_IMPORT installation is complete, TWL EVA cannot install SDMC_Launcher, stuck at 2 pass:

Restart DSi will result in a white screen:

1.4.Power off DSi and remove SD card, delete menu.srl from SD card.
---------
2.Install the system
2.1.Put the TwlSystemUpdater v1.2 on the SD card root, insert the SD card into DSi.
2.2.DSi ntrboot (twlnandtool, ntrboot.nds), Import NandFirm(SDMC) :

2.3.Restart DSi, SDMC_Launcher loading TwlSystemUpdater, installation complete will display "Update Success!".


2.4.Restart DSi, it should start the initial setup:

.
.
.
Others
- Backup NAND:
ntrboot(godmode9i) → safenandmanager, dump NAND.
(Or use any exploit to boot TwilightMenu++ → safenandmanager, dump NAND.)

- Install unlaunch on development units (pandas) (rvtr's tutorial)
(If you want to enable H&S splash and DSimenu music, or replace the Unlaunch background image, you need to reinstall Original Unlaunch2.0 from TWilightMenu++.)
Details

Spoiler

Install godmode9i using TwlNmenu, Press START to start godmode9i.
(TwlNmenu and NandFiler are Rev.9826, a 2GB SD card can be used.)

Find unlaunch.dsi in the SD card directory of godmode9i, Boot file (Direct), install Unlaunch.

- Use Unlaunch to start TWL EVA FINAL and view information.
(I think TwlSystemUpdater created a new serial number based on the Console ID and CID?)
(I tried several times, the same hardware has only one serial number, and changing the Wi-Fi board(MAC address) will change the serial number. I guess there are two types of serial numbers: factory-set serial number and random serial number. If the TwlSystemUpdater cannot read the factory-set serial number, it will generate a random serial number based on the MAC address(confirmed), and some other IDs.)
(TwlIPL: Since this is not a mass production process, a real serial number cannot be prepared. In non-mass production environments (such as development or testing stages), a temporary pseudo serial number will be generated based on the MAC address and regional information.)

Spoiler

- Hybrid (DS & DSi) cart and Limited (DSi only) cart unrecognized in panda's DSimenu.
Install slot1launch using TwlNmenu. #20(Compatible with old flashcards) #21(Recommend)
Hybrid and Limited cart work fine, the camera can be used in DSi mode.
(Or Install godmode9i(.tad) with TwlNmenu, then boot slot1launch using godmode9i.)
(Or Install Unlaunch first, then start the cart from TWiLightMenu++.)
(Or install TWiLightMenu++ title#25, then start the cart from TWiLightMenu++.)

- Update System using TwlSystemUpdater.
I replaced the tad files in TwlSystemUpdater v1.2(.srl, nand based) with the tad files from v1.4a(.srl, card based), then fix TwlSystemUpdater v1.2.srl header. SDMC_Launcher can load TwlSystemUpdater v1.2 to install v1.4a.
(The system version is 1.4, e.g. Ver 1.4U_dev, TwlNmenu and NandFiler are Rev.11270)

Spoiler

- SignaPicDSi for dev (DSi panda)

Spoiler

- Using TWLMagician to create hiyaCFW(1.6.2) works properly.
(Unlaunch needs to be installed)

Spoiler

 

[rvtr]

Only TwlSystemUpdater ver 1.2 srl can works on SDMC_Launcher, and I have been using other card based versions)
(DSi system version1.2 is a very old system, and its development apps doesn't seem to support 64GB SDXC, the SDHC card still gets stuck, a 2GB SD card can be used. So this time I am only using a 2GB SD card.)

To be more specific, only these v1.2 SRLs:
- v1.2_20090428
- v1.2_20090430
- v1.2_20090514
- v1.2_20090611
- v1.2_20090710
- v1.2_forCKdev

There is one v1.2 SRL which will not work:
- v1.2_forCKdev_20090417

There is also a v1.2 released on the development portal. However, this has not been dumped, so I don't know if it will work. I'm assuming not.
If it's on my website and has an associated TAD version, it will work.

(I think TwlSystemUpdater created a new serial number based on the Console ID and CID?)

The serial number is randomized, except for the region specific part. VWxxxxxxx in your case.

---

If you want to update further:

• Download the Twl SystemUpdater for the firmware you want
• Mount the SystemUpdater app with a tool like ninfs, or in GodMode9i (I provide a TAD for this in my unlaunch on dev guide)
• Extract all TADs in the root of rom:/data/common
• Extract all TADs in the folder for your region (eg. rom:/data/common/America ). Do not Extract the folders for other regions.

If you have a debugger (IS-TWL)​

• Extract all TADs in the folder for your region at rom:/data/debugger

If you have a panda (handheld dev unit)​

• Extract all TADs in the folder for your region at rom:/data/standalone
• Copy all the extracted TADs to an SD card.

Do NOT use TwlNmenu. It will NOT WORK, and it will DELETE YOUR FIRMWARE.

• Run this specific copy of TDT.
• Locate and install each TAD with TDT. Make sure that you are on sysNAND (first option on the main menu)

 

[rvtr]

The serial number is randomized, except for the region specific part. VWxxxxxxx in your case.

Ended up being wrong about this. There was a TwlIPL app that generated a new serial just like how the SystemUpdater does. I thought it was a one off test program, but it appears that the code is still used.

Since serial numbers cannot be prepared outside of mass production, we will set an arbitrary value based on the MAC address here. Concatenate an arbitrary string with the MAC address, take the SHA1 hash, and use it as a temporary SerialNo.

(translated with deepl, may be inaccurate)

https://github.com/rvtr/TwlIPL/blob...u_tools/HWInfoWriter/ARM9/src/hwi.c#L490-L491

 

[k66]

I converted slot1launch* into a tad file and installed it with TwlNmenu, and it works fine.
(Already signed, no need to install Unlaunch first.)
*slot1launch is a component of TWiLightMenu++ (v27.22.2)
Installation location: NAND:/title/00030004/54574c31
(Uninstall: TwlNmenu → NAND → select TWL1 (3031 54574c31) → press X button )

Now DSi panda can start the Hybrid(DS & DSi) and Limited(DSi only) cart through this icon.

.
For old auto-boot flashcard(e.g. DSone, M3 DS Real): Insert the flashcard after starting slot1launch.