Hacking Just got my Sky3DS ! Pic inside

[jmleolgq]

Right click and open the image in a new tab (on Chrome) then they work.

jmleolgq Possible to provide an explanation?

The link is here( t.cn/R7gon0G ),
The author who used a programmer would release a short instruction in a few days.

 

[Pawed]

Reuploaded them so that everyone can see them. http://imgur.com/a/E4XxI

There's quite a bit of interesting talk in the thread, so read it with Google Translate From what I've understood (from the thread) there's 2MB of EEPROM in the chip that he tested (see 10th picture in the link above), which is where the ROM headers are stored.

 

[Scorpiopt]

Anyone tried save editing yet ?

 

[Deleted-355425]

Still waiting on a real review of this and it's limitations

 

[Pawed]

Still waiting on a real review of this and it's limitations

If you mean the GBAtemp review, it's already up.

 

[telon22]

Anyone tried save editing yet ?

Want to know this too specially for Pokemon games

 

[Mr_Pichu]

Reuploaded them so that everyone can see them. http://imgur.com/a/E4XxI

There's quite a bit of interesting talk in the thread, so read it with Google Translate From what I've understood (from the thread) there's 2MB of EEPROM in the chip that he tested (see 10th picture in the link above), which is where the ROM headers are stored.

The program fuse option is very troubling. They are likely setting the EEPROM into a read-only mode, thus you cannot rewrite the data once programmed. Let's hope this is not the case.

 

[Pawed]

The program fuse option is very troubling. They are likely setting the EEPROM into a read-only mode, thus you cannot rewrite the data once programmed. Let's hope this is not the case.

I think you misunderstood. The person's trying to remove the limit, not set it

 

[gamesquest1]

im guessing that flash chip is just for card1 saves i doubt they would write their super anti 10 game limit to a erasable chip

 

[Mr_Pichu]

I think you misunderstood. The person's trying to remove the limit, not set it

It is just my conclusion that the card must write protect the data it writes to the memory chip. If this is the case, not sure if this can be undone. There are a number of memory devices with a fuse, write protect, or password feature. As far as preventing that data from being write protected this would be a good thing to figure out.

As far as Gateway is concerned, given the hardware is reprogrammable there might be a way to program the exploit-less boot feature of this new card into the GW card. This would be possible only if there is enough logic available to program the feature along with the support required to read the header from the Micro SD. Doesn't seem like too much of a stretch.

After a bit of searching around I found what looks like the datasheet for the device in question. This device has many features...

http://www.nexflash.com/NR/rdonlyres/0143840F-8550-480A-9C1C-9261DE1DFCD7/0/W25Q16DV.pdf

The Sky card is using the Q option version of the W25Q16DV chip. The G version of the chip can be bought at the cost of $0.62 per unit. Not sure if the G version can be used with this design. They are not using the dreaded P version of the device which features OTP, so there is hope of finding a solution. If all else fails, I am sure a clever lad will find a way to piggyback a bunch of these chips to brute force support for additional games.

 

[jmleolgq]

The following video shows that R5 SDHC (same with SKY3DS) can run the 11th 3DS backup game.
It proves that the restriction is designed for non-technical reason

[parsehtml]<iframe height=498 width=510 src="http://player.youku.com/embed/XODI1MTk1OTA0" frameborder=0 allowfullscreen></iframe>[/parsehtml]http://v.youku.com/v_show/id_XODI1MTk1OTA0.html

Games above:
1. 进撃の巨人
2. Monster Hunter 4G
3. Super Smash Bros. for Nintendo 3DS
4. Mario Kart 7
5. New Super Mario Bros. 2
6. Super Mario Land 3D
7. Kid Icarus:UPRISING
8. 闪乱カグラ -少女达の真影-
9. 闪乱カグラ Burst 红莲の少女达
10. Gundam 3D
11. Resident Evil: Revelations

 

[FAST6191]

For a second I thought you found a datasheet on the ASIX chip. The D sub model would be a better fit for the numbers we saw but in the end it is a small flash chip; how it is used and what it stores are going to be of infinitely more interest here.

Anyway comparing it to the earlier winbond stuff I was looking at it looks like they have plumped for an industrial grade chip, and one without some of the slower modes of the other modes but same upper limits, voltages*, timings (give or take slower modes).

*the lack of the slower modes seems to be reflected in a marginally varied current draw and a wider AC Voltage I do not want to say capability but the tests were done at a wider range.

Being industrial grade I have to imagine the price bumped a bit (granted it might not matter so much at the volumes they are likely playing at), the cynic in me wonders if it was just what was available in Shenzhen that day where the more optimistic side of me wonders if it was an actual desire for increased temperature capacity -- we already saw a few DS flash carts overheat and judging by the other ASIX products the inside of a 3ds is probably not going to yield a ideal conditions for it to operate in.

 

[Deleted-355425]

It's so it can be used at the north pole, or anywhere at -40

 

[Duo8]

OK so the only option is to desolder the chip and reprogram it?
You'd need soldering skills and a reprogrammer for this.
Yeah I'm not doing that. But this seems to confirm that the limit is some sort of DRM.

 

[Danjal]

The following video shows that R5 SDHC (same with SKY3DS) can run the 11th 3DS backup game.
It proves that the restriction is designed for non-technical reason
**snip**

Seems the video doesn't load for me - has anyone been able to confirm or reproduce this since?

 

[adrenochrome]

seems the guy from the pics managed to reset the memory of the card (ready for 10 new games) too. he will post more infos tomorrow

 

[Joe88]

wont be long now before it cloned with the restriction removed

 

[Foxi4]

Sounds about right - if the chip is rewritable then sure, you can rewrite it using a hardware programmer, the real question was whether or not it was rewritable in the first place and where exactly the headers were stored. I've inquired about the possiblity of removing the 10 games limitation in the future, we'll see what sky3DS has to say about that.

 

[Danjal]

seems the guy from the pics managed to reset the memory of the card (ready for 10 new games) too. he will post more infos tomorrow

How dare he go and sleep! Someone go and wake him up! lol

 

[RomAnOCrY]

The following video ....

Did he try more than 11 games ? I'll try with my sky3DS tomorrow