Hacking Just got my Sky3DS ! Pic inside

Reecey

Mario 64 (favorite game of all time)
Member
Joined
Mar 7, 2010
Messages
5,870
Trophies
2
Location
At Home :)
XP
4,475
Country
did you make sure the rom was the correct region :P

if it really doesn't work on 4.x it doesn't sound very unblock-able, more like its relying on a exploit/glitch in newer firmwares to load

I find it very strange the fact it wont work in classic mode?. Got any idea why that would be? I mean surely classic mode is an exact copy of the original system nand but on the latest FW so there is no reason why it should not work. I'm starting to think already there is major flaws in this card.

Edit: also there is no reason why it should not work on FW 4.5.0 on system nand at all, any other retail game would obviously work apart from the 7.x titles. He should try a copy of SM3DLand or anything on 4.5.0 or below and see if it works on the 4.5.0 FW, it should work all OK!
 

FAST6191

Techromancer
Editorial Team
Joined
Nov 21, 2005
Messages
36,798
Trophies
3
XP
28,374
Country
United Kingdom
Thanks for the PCB shots, some minor analysis (I am not much of an electrical engineer in this regard). I also took the back side image, scaled it and flipped it to overlay/sit beside and compare.

The main two chips there
Winbond
Looks like 25Q160VSIG but I can not find anything right now on that,
However if it is 25Q16BVSIG then W25Q16BVSSIG is the chip in question. I can see some other things being off but that really does not look like a B to me.

Still
http://www.digikey.co.uk/product-detail/en/W25Q16BVSSIG/W25Q16BVSSIG-ND/2208449 , prices say "call" but similarly potent chips from the same company are in the sub £1 range.
https://www.winbond.com/NR/rdonlyres/7EB3B29C-1B35-421C-AA24-F430B51C776A/0/W25Q16BV.pdf
A 16Mbit (2 megabyte) flash chip if the B is correct, either way a single very low capacity flash chip. Most likely programming for the other chip you see, I have not traced down everything (and if it is three layer or more then I will not be able to) but as near as I can tell there is nothing going to the 3ds slot. With this being the case any "10 game, only write once" limit is pretty clearly an artificial hobbling (even with what I am about to cover), it might be a technical limit without in field programming but we have done that before (see passme2 stuff).
Edit
25Q16CVSIG could be it, though it still does not look like C to me (more than a B but hey)
http://www.winbond.com/NR/rdonlyres/63CFB9A9-816D-4DE0-85EE-FF08F9244193/0/W25Q16CV.pdf for the datasheet. Still a 16 megabit flash chip though.


For the other I have no idea. ASIX, proflex and the model number bring back very little. Clearly it is the brains of the operation but I have nothing.
ASX093F6760 would appear to be the numbers, however that 9 might be an S, that first 6 could be G and I am not sure about the last one (could be a 0, a C or a G, or possibly something else). Not knowing this somewhat limits what I can do, especially as far as doing any kind of bill of materials/cost analysis. 88 pin QFP though and over half the pins used.

The microSD appears to be being used in SD mode (I assume SDHC does not change anything of note here) which is better than some of the things I see using SPI mode (pin 1 of the microSD, which is unused in SPI mode and a data pin in SD mode, would appear to have a via underneath that then pops out just left of X1 in top side image, which then feeds directly into the ASIX chip).
http://www.planetmobile.it/jumpjack/adattatore/pinout-tflash.jpg


No idea what SAM12 is as far as make or model, it is pretty clearly part of clock generation and voltage regulation type stuff though, to that end nothing major, though it is tied to several things.

Looking at the back side image I am going to say the PCB is possibly not a simple double sided affair (probably no more than three layers but still not double sided) -- some what is visible of lower layers on the bottom side shot has no corresponding part on the top side. I can see a few not working with my scaling (maybe some differences in angles of the shots that I have not quite accounted for) but my via holes line up well enough on both sides. Also I see what might be the stink of an autorouter, or might just be someone not used to layout trying hard in reasonably high density world.

I don't have a good 3ds cartridge slot pinout but knowing it shares a common save method with the DS I can use http://problemkaputt.de/gbatek.htm#auxdsgamecardslot to guess a few things. I could start filling in what various pins do but without knowing more of the ASIX stuff it is not of that much use.
 

RomAnOCrY

Well-Known Member
OP
Member
Joined
Jan 2, 2011
Messages
258
Trophies
1
XP
444
Country
France

WiiCube_2013

Well-Known Member
Member
Joined
Oct 19, 2013
Messages
5,943
Trophies
0
XP
2,315
Country
Gaza Strip

LaserZX

Well-Known Member
Newcomer
Joined
Jul 4, 2012
Messages
64
Trophies
0
XP
119
Country
United States
  • Like
Reactions: RomAnOCrY

Ronhero

Too Weird to Live, Too Rare to Die
Member
Joined
Jun 28, 2014
Messages
3,470
Trophies
1
Location
Arizona Bay
Website
127.0.0.1
XP
2,062
Country
United States
The reason I think it isn't working in classic mode is because as OP said he is using mt card (classic mode without 7.x keys) my guess it's something to do with that.

Also the diagram posted for the nand mod is for ripping and restoring the 4.x nand image.
 

Duo8

Well-Known Member
Member
Joined
Jul 16, 2013
Messages
3,613
Trophies
2
XP
3,040
Country
Vietnam
FAST6191 My guess is that the Winbond is used for storing some data for the loaded ROMs and possibly FPGA update data (if it's an FPGA that is).
About the ASIC, I couldn't find anything on ASIX either, but if it's like the ProFPGA then it doesn't need to be programmed at boot and is likely secured.
 

naxil

Well-Known Member
Member
Joined
Oct 26, 2011
Messages
850
Trophies
1
XP
672
Country
Italy

Yes thanks RomAnOCry, but in the asix.com site i can't see any chips like this.. probably is a old product..
 

FAST6191

Techromancer
Editorial Team
Joined
Nov 21, 2005
Messages
36,798
Trophies
3
XP
28,374
Country
United Kingdom
Hmm, I did do searches for ASIX and Taiwan but missed that link.

Looking through their site they do make microcontrollers (8 bit 8051 and 80390 stuff it looks like) and do things in LQFP-80 packages, ones that also speak SPI and run at reasonable clocks. It is for a network device but http://www.asix.com.tw/products.php?op=pItemdetail&PItemID=90;72;103&PLine=72 has some on similar things. Though is probably not the case here it wouldn't be the first time someone has abused a programmable device way outside its intended purposes. Their site lists no general purpose microcontrollers though. Sadly the proper datasheets are behind a sign up and I am not that invested in this right now.
 

Shady Guy Jose

Well-Known Member
Member
Joined
Sep 14, 2008
Messages
518
Trophies
1
Age
31
XP
2,408
Country
Portugal
Maybe I just didn't fully understand how the Gateway worked, but I swore the last time I checked (several months ago), I thought Gateway came up with a way for you to load your 4.5 Nand into some emulation mode, and you can then update your system to the latest firmware. You then could toggle back & forth between the 4.5 & the latest version. 4.5 mode for your roms, and the newest one for real games. I guess that's not true then eh? Too bad, definitely would've made Gateway very OP, lol.

It's almost that. Basically, you keep your 4.5 NAND, but not for roms. You do nothing with it. But you can install a virtual NAND (emuNAND) on your SD card, update that one to a patched version of the latest firmware, and play your ROMs or retail cartridges while booting from the SD card.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    K3Nv2 @ K3Nv2: https://www.amazon.com/gp/product/B09ZLRDMXX/ref=ox_sc_act_title_1?tag=slickdeals09-20&ascsubtag=...