Hacking Analysis on the Gateway 3DS blue cart (updateable??)

[scafandro]

There is no official Wood FW beyond 1.62

1.64 is for fake R4 clone cards with minor differences ... they are all based on 1.62.

Regards,
iCEQB

Well but one of the difference between them is the fact that 1.64 supports 3DS fw 7.1 and 1.62 don`t.
It would be great to be able to play NDS roms without buying other cart.

 

[FR0ZN]

The Wood FW is not the factor which enables you to run the card on a higher 3DS FW.
The bootstrap (the game which is "faked" / used to make it look like a real NDS cart to the 3DS) needs to be updated, which is currently not possible on the blue cart.
We didn't look further into it, because most people who have a blue cart have a <=4.5.0 3DS anyway, so we focused our efforts on the game compatability, which is the role of the Wood FW.

Regards,
iCEQB

 

[scafandro]

The Wood FW is not the factor which enables you to run the card on a higher 3DS FW.
The bootstrap (the game which is "faked" / used to make it look like a real NDS cart to the 3DS) needs to be updated, which is currently not possible on the blue cart.
We didn't look further into it, because most people who have a blue cart have a <=4.5.0 3DS anyway, so we focused our efforts on the game compatability, which is the role of the Wood FW.

Regards,
iCEQB

Ohh thanks for the info. I read somewhere in the internet about it 'till wood 1.62 it only supported 3DS fw <= 6.X, so it's not true? If someone wanted to update this bootstrap, what would be
the right direction to start looking to do this? I mean, what kind of modifications in the card and what kind of knowledge would would be necessary to do it?

 

[FR0ZN]

Well if they locked the ROM inside the chip, then you can't do anything.

But if you are lucky and it's writeable you could look at the cart updates from Ace3DS+, they produced the same hardware found inside the blue cart and they released updates which write to the internal ROM once, so maybe editing it gets you somewhere.

Another possibility would be to try flashing it with a hardware programmer. I didn't look further into it, but iirc there are pins above the mSD slot (SPI?) which are probably used during production to flash the internal ROM ... maybe you can get something from there.

Last possibility is to just buy another flashcart for 5$
Updating the bootstrap is a lot more painful than spending a few bucks on a cart which works on the latest 3DS., or even 15$+ on a cart which gets bootstrap updates pretty quick after Nintendo pushes another 3DS FW update (like DSTWO).

Regards,
iCEQB

 

[scafandro]

Well if they locked the ROM inside the chip, then you can't do anything.

But if you are lucky and it's writeable you could look at the cart updates from Ace3DS+, they produced the same hardware found inside the blue cart and they released updates which write to the internal ROM once, so maybe editing it gets you somewhere.

Another possibility would be to try flashing it with a hardware programmer. I didn't look further into it, but iirc there are pins above the mSD slot (SPI?) which are probably used during production to flash the internal ROM ... maybe you can get something from there.

Last possibility is to just buy another flashcart for 5$
Updating the bootstrap is a lot more painful than spending a few bucks on a cart which works on the latest 3DS., or even 15$+ on a cart which gets bootstrap updates pretty quick after Nintendo pushes another 3DS FW update (like DSTWO).

Regards,
iCEQB

Thanks for the answer man, i would like to try it for the thrill of hacking and 'cause here in my country those carts aren't so cheap, it cost at least 6 times the prices you said, so probably there would be more
people who could benefit from this solution.

 

[FR0ZN]

Order them from china

 

[piratesephiroth]

Bumping this to remind you that the 'game.dldi' driver that comes in that GW blue card's kernel is useless.
You need to use the dldi driver from EX4DS or any homebrew that needs patching won't run.

 

[FR0ZN]

Which homebrew for example doesn't run w/o your dldi driver?

 

[Technicmaster0]

Which homebrew for example doesn't run w/o your dldi driver?

Probably every homebrew that uses DLDI like DSCraft, every emulator etc.

 

[ninjadudexp]

So does this enable the blue card to work on 9.2 0.0?

 

[piratesephiroth]

So does this enable the blue card to work on 9.2 0.0?

No, nothing can do that.

 

[ninjadudexp]

No, nothing can do that.

i figured, well at least i have the dstwo

 

[overdriver]

Thanks, ICEQB ! for wood 1.62!
it's much better than old 1.5X came with it.

I just want to let you guys know that my Gateway Blue card(ordered 11/4/14) is NOT based on any of previous cards that are posted here:
1. there is no marking on PCB.
2. PCB pattern is different.
3. no it's not fake one.
4. it's not ACE3D, nor R4i(etc) clone.
5. I don't have camera so I cannot upload pic now.

I am sure that Gateway team uses all kind of different R4 clones. and it still won't work on latest 3DS firmware(>9.x).
but, it is still upgradable to decrypted 1.62 by ICEQB. it's more about rom compatibility.. not bootstrap upgrade to work on higher firmware.

anyway it's very interesting story...

 

[Duo8]

Hmm mine has X-C on it.
Anw the pins on top are probably JTAG pins for the FPGA. The SPI is probably updated through the FPGA.

 

[Spork Schivago]

Hello,

Great work by the way. I was curious if anyone could post how Woods v1.62 is created in order to allow it work on the blue Gateway 3DS cart. I know iCEQB has posted an encrypted version of the Woods v1.62 firmware that works with the blue cart, however, I'd like to know how to re-encrypt it myself. What software would I need in order to do that and how would I actually go about doing that? Thank you.

 

[Acidflare]

The one that comes with the Gateway FW pack is v1.56.

This is probably because if you all remember Gateway 3DS come out after the R4i Deluxe kit came out.
The gateway blue card is actually a clone of the blue card used in the R4i deluxe kit which is actually an R4i Gold 3DS RTS in a different shell.
The Multimedia kernel offered for the R4i Gold uses Wood 1.56, I've packed the multimedia kernel with 1.64 myself it works a lot better that way for my R4i Gold I find.
Gateway probably used wood from the old multimedia kernel that was available.

 

[piratesephiroth]

Hello,

Great work by the way. I was curious if anyone could post how Woods v1.62 is created in order to allow it work on the blue Gateway 3DS cart. I know iCEQB has posted an encrypted version of the Woods v1.62 firmware that works with the blue cart, however, I'd like to know how to re-encrypt it myself. What software would I need in order to do that and how would I actually go about doing that? Thank you.

We can use a slightly modified version of r4enc do encrypt it.

 

[Spork Schivago]

Thank you Piratesephiroth. Do you know what needs modifying in r4enc? Also, does the Woods firmware need decrypting first? Or is it already decrypted and just needs to be encrypted? Thanks again for responding.

 

[Acidflare]

We can use a slightly modified version of r4enc do encrypt it.

I know that the original R4enc doesn't work for the R4i Gold unless it's moonshell 2.02+ for some reason. it's probably the same fix

 

[kyriptic]

Hmm mine has X-C on it.
Anw the pins on top are probably JTAG pins for the FPGA. The SPI is probably updated through the FPGA.

Mine is also an X-C and i just recently got it 2 weeks ago, but it looks identical to the 003 in the post http://gbatemp.net/threads/analysis-on-the-gateway-3ds-blue-cart-updateable.357103/#post-4819779

Since it's believed to be an Ace3DS+ clone and on their site they say it supports fw 9.5, has anyone tried just flashing their "OS" using a DS to the bluecard?

Also just found this http://imagizer.imageshack.us/a/img841/4421/i3io.jpg that definitely looks like JTAG pinouts labeled