ROM Hack 3DS ROM Tool: rom_tool

[Deleted User]

-x

 

[3DSGuy]

Thanks for the update. By the way, I found a minor error in this last version.View attachment 4804

Fixed. Get version 3 while it's fresh out of the oven.

Pong20302000 you can predict ROM compatibility Gateway3DS, with rom_tool now

Change log (v3.0):
* Renamed "Super Trimming" to "Removing Update Partition", to remove any confusion
* ROM Partition info is now displayed via a separate command
* ROM Header info, now has categories, and provides more information
* NCSD Signature is no longer display, it's irrelevant for most users of rom_tool
* Changed code which dealt with detecting and handling ROMs which have a removed update partition
* Detecting ROM target has been changed
* polarssl has been added for future use
* help text no-longer continues on next line.

 

[mr. fancypants]

supper trimming/ removing update partition what does that mean?

 

[Armadillo]

What is card2 (under the gateway prediction thing).

SDK is obvious, but card1/2 (nand save?)

 

[3DSGuy]

What is card2 (under the gateway prediction thing).

SDK is obvious, but card1/2 (nand save?)

card2 is the special chip which has a RW portion after the ROM data, eliminating the need for an external EEPROM for storing savedata. The same as Animal Crossing. I don't know why everyone calls it NAND saving, this technique doesn't involve the 3DS' NAND chip. Maybe they mean the chip inside the Game Card.

 

[3DSGuy]

supper trimming/ removing update partition what does that mean?

Each 3DS ROM has a series of partitions. One for the game code/assets, and the other partitions hold the e-manual, download play app. In production ROMs there also exists an update partition, so you can update the 3DS to play a game. If you are going to play game backups, you aren't going to be updating your 3DS for any reason. So removing the update partition shrinks the size of the ROM even more than what can be done with normal ROM trimming. However removing the update partition is permanent, so that's something to keep in mind.

 

[kyogre123]

card2 is the special chip which has a RW portion after the ROM data, eliminating the need for an external EEPROM for storing savedata. The same as Animal Crossing. I don't know why everyone calls it NAND saving, this technique doesn't involve the 3DS' NAND chip. Maybe they mean the chip inside the Game Card.

Let me get this straight... this "special chip" is just a memory in which one of the partitions is made for the sole purpose of storing the save game file? Pokemon really uses this SLC NAND as Animal Crossing? that means the special memory of Animal Crossing was not that special as Nintendo said.

 

[how_do_i_do_that]

Let me get this straight... this "special chip" is just a memory in which one of the partitions is made for the sole purpose of storing the save game file? Pokemon really uses this SLC NAND as Animal Crossing? that means the special memory of Animal Crossing was not that special as Nintendo said.

I thought you understood that when somebody posted pics of the animal crossing PCB and there was no EEPROM module anywhere on the PCB, front or back.

 

[kyogre123]

I thought you understood that when somebody posted pics of the animal crossing PCB and there was no EEPROM module anywhere on the PCB, front or back.

No, I thought the NAND memory was a completely separated chip from whatever 3DS standard memory chip is used for the ROM portion.

 

[3DSGuy]

Let me get this straight... this "special chip" is just a memory in which one of the partitions is made for the sole purpose of storing the save game file? Pokemon really uses this SLC NAND as Animal Crossing? that means the special memory of Animal Crossing was not that special as Nintendo said.

SDK specifications make it seem it's written in the same partition as the ROM, only after the ROM data finishes.

 

[how_do_i_do_that]

The PCB design raises some possibilities for a homemade flashcart if the encryption get fully reverse engineered.

 

[Cyan]

So those games with "NAND saves" weren't actually saved on a NAND chipset?
When they said the game saved to NAND, I thought the games were actually saving on the console's NAND instead of the cartridge. So it's still saved in the cartridge, but not in EEPROM nor in NAND chipset?

Which chipset allows both ROM part and writable memory part? which memory type is the writable part in that chipset?

 

[kyogre123]

I still would like to know if these two games have exactly the same memory chip model, which was described as expensive, very limited in production and only useful for saving a large amount of data in short times; or if Pokémon just have a different chip that is still able to have ROM and writable data on a single chip.

 

[3DSGuy]

So it's still saved in the cartridge, but not in EEPROM nor in NAND chipset?

That's right.

Which chipset allows both ROM part and writable memory part? which memory type is the writable part in that chipset?

I'd guess the memory type is the same as the rest of the ROM, the 3DS just doesn't write there. There is a value in the ROM header which tells the 3DS the location from which it is safe to write savedata without corrupting the ROM. These addresses are within the ROM dump, so if you dumped Pokemon X/Y after savedata was made, you'd be able to find the save data in the ROM dump.

I still would like to know if these two games have exactly the same memory chip model, which was described as expensive, very limited in production and only useful for saving a large amount of data in short times; or if Pokémon just have a different chip that is still able to have ROM and writable data on a single chip.

Decide for yourself (large pics of game PCBs):

Pokemon X:

Spoiler

Kid Icarus Uprising (Same Chip Size as Pokemon X):

Spoiler

Steel Diver Kiosk demo (no EEPROM):

Spoiler

 

[how_do_i_do_that]

Pokemon by and large has stuck with Flash memory for the their games even when nintendo shrank the save types that could be used.

 

[3DSGuy]

You've all been nagging me for a GUI for rom_tool for awhile. So I decided to give 3DSExplorer a much needed update, and implement the features of rom_tool as best I could into 3DSExplorer.

Download link and source code in the original post.

@elisherer, I'm sorry if my C# is a bit hacky, I'm used to writing in C. In the past 12 hours I've written more C# source code than I've ever done before.

 

[phanteon]

could you explain step by step how to use room tool on mac to me?
im really interested in the usage of this tool
thanks

i have the file and the terminal prompt

 

[3DSGuy]

Updated to version 3.1:

The features in rom_tool 3.1 and the modification of 3DSExplorer are equivalent.

Change log (v3.1):
* Removed support for NAND dumps, now only supports CCI/CSU images
* Ditched Crypto Library
* Changed terminology, "CCI" has been used in place of "ROM"
* CCI information has been changed.
* Detects SDK version accurately
* Detects required kernel (NATIVE_FIRM) version accurately.
* Detects encryption key used for each partition.

could you explain step by step how to use room tool on mac to me?
im really interested in the usage of this tool
thanks

i have the file and the terminal prompt

You need to put rom_tool in the same directory as your 3DS ROMs. In terminal, change the directory using the "cd" command to the directory where your 3DS ROMs are. Then you are able to use the commands specified on the OP on your ROMs.

 

[Bug_Checker_]

You've all been nagging me for a GUI for rom_tool for awhile. So I decided to give 3DSExplorer a much needed update, and implement the features of rom_tool as best I could into 3DSExplorer.

Spoiler

Download link and source code in the original post.

@elisherer, I'm sorry if my C# is a bit hacky, I'm used to writing in C. In the past 12 hours I've written more C# source code than I've ever done before.

Sorry about hijacking the thread, but if you are fixing things in 3DSExplorer could you also look at the following:

in 3DSExplorer_r100 in mdlTMD.cs
http://code.google.com/p/3dsexplorer/source/browse/trunk/3DSExplorer/Modules/mdlTMD.cs
sizes do not agree
23 public byte Version;
181 f.AddListItem(off + 124, 4, "Version", Head.Version, 0);
which throws off displayed offsets(not actual offsets) in TMD files
so the following also need correcting (lines 182 - 195)

Spoiler

f.AddListItem(off + 128, 1, "Car Crl Version", Head.CarCrlVersion, 0);
f.AddListItem(off + 129, 1, "Signer Version", Head.SignerVersion, 0);
f.AddListItem(off + 130, 1, "Reserved1", Head.Reserved1, 0);
f.AddListItem(off + 131, 8, "System Version", Head.SystemVersion, 0);
f.AddListItem(off + 139, 8, "Title ID", Head.TitleID, 0);
f.AddListItem(off + 147, 4, "Title Type", Head.TitleType, 0);
f.AddListItem(off + 151, 2, "Group ID", Head.GroupID, 0);
f.AddListItem(off + 153, 62, "Reserved2", Head.Reserved2, 0);
f.AddListItem(off + 215, 4, "Access Rights", Head.AccessRights, 0);
f.AddListItem(off + 219, 2, "Title Version", Head.TitleVersion, 0);
f.AddListItem(off + 221, 2, "Content Count", Head.ContentCount, 0);
f.AddListItem(off + 223, 2, "Boot Content", Head.BootContent, 0);
f.AddListItem(off + 225, 2, "Padding", Head.Padding0, 0);
f.AddListItem(off + 227, 32, "Content Info Records Hash", Head.ContentInfoRecordsHash, 0);

change to
f.AddListItem(off + 124, 1, "Version", Head.Version, 0);
f.AddListItem(off + 125, 1, "Car Crl Version", Head.CarCrlVersion, 0);
f.AddListItem(off + 126, 1, "Signer Version", Head.SignerVersion, 0);
f.AddListItem(off + 127, 1, "Reserved1", Head.Reserved1, 0);
f.AddListItem(off + 128, 8, "System Version", Head.SystemVersion, 0);
f.AddListItem(off + 136, 8, "Title ID", Head.TitleID, 0);
f.AddListItem(off + 144, 4, "Title Type", Head.TitleType, 0);
f.AddListItem(off + 148, 2, "Group ID", Head.GroupID, 0);
f.AddListItem(off + 150, 62, "Reserved2", Head.Reserved2, 0);
f.AddListItem(off + 212, 4, "Access Rights", Head.AccessRights, 0);
f.AddListItem(off + 216, 2, "Title Version", Head.TitleVersion, 0);
f.AddListItem(off + 218, 2, "Content Count", Head.ContentCount, 0);
f.AddListItem(off + 220, 2, "Boot Content", Head.BootContent, 0);
f.AddListItem(off + 222, 2, "Padding", Head.Padding0, 0);
f.AddListItem(off + 224, 32, "Content Info Records Hash", Head.ContentInfoRecordsHash, 0);

Also character is displayed as GroupID not sure if you want that.
33 public char[] GroupID;

And for sake of consistency alone with respect to dsi/wii/wiiu and 3ds,
8 public enum SignatureType
all should be probably swapped around unless there is a good reason (I don't recall little endian being used anywhere in certs,tickets or tmds)

Spoiler

(but I could be wrong. sometimes a bug checker needs a bug checker)

Thanks

 

[DAHU75]

Great tools , thanks for the work

where can found a game list of trimmed or super trimmed list that work fine with gateway 2.01B or all the games work with gateway work when trimmed or super trimmed ?