Hacking [stupid idea] Homebrew Game Carts?

[gudenau]

I came up with a stupid idea today, take the 3DS ROM format of some homebrew and shove it into a DIY game cart.

I know this is impracticle and stupid, I'm just kinda curious about how hard it would be to make a normal looking and feeling 3DS cart for homebrew on modded consoles.

I understand this wouldn't work without a CFW.

This is not intended as a piracy discussion.

This is for civil discussion and learning purposes.

 

[Navonod]

Would be interesting. I always thought of cubic ninja as a homebrew game cart because that's all it's good for.

Edit: Would be nice to have all homebrew apps and cfw on a game cart with out having to modify the system in any way. Kinda how R4i flash carts work. But I don't see that happening honestly.

 

[zoogie]

You should, in theory, be able to run homebrew on sky3ds carts.
I've edited commercial dumps with a byte here and there and they will still run with cfw sig patches.
The sky3ds will reject homebrew cci's built with makerom though.

Should be able to work with modifications, however.

 

[gudenau]

You should, in theory, be able to run homebrew on sky3ds carts.
I've edited commercial dumps with a byte here and there and they will still run with cfw sig patches.
The sky3ds will reject homebrew cci's built with makerom though.

Should be able to work with modifications, however.

Any idea what hardware is in there?

I should probably read the wiki too.

Edit:
Not much use.

 

[ThisIsDaAccount]

Sciresm has said on r/3dshacks that there's a key we need to make custom carts. Unfortunately, that key is not actually on the 3DS, it's on the carts themselves, so it won't be easy to dump. Gateway and Sky3DS have done it, but they obviously won't share it.

Edit: here's the source

 

[gudenau]

Sciresm has said on r/3dshacks that there's a key we need to make custom carts. Unfortunately, that key is not actually on the 3DS, it's on the carts themselves, so it won't be easy to dump. Gateway and Sky3DS have done it, but they obviously won't share it.

Edit: here's the source

Interesting...

Guess I'll look into the sky thing, see if I can't find hardware pictures.

Edit:
Couldn't find any.

 

[Deleted User]

Sciresm has said on r/3dshacks that there's a key we need to make custom carts. Unfortunately, that key is not actually on the 3DS, it's on the carts themselves, so it won't be easy to dump. Gateway and Sky3DS have done it, but they obviously won't share it.

Edit: here's the source

I wonder if this is what is preventing us from launching games from the SD card...
Well, one of the things at least

--------------------- MERGED ---------------------------

Sorry for double post, but I would just like to say that if we could write to our own gamecards, it would be amazing to have a cartridge with a custom sticker that has a ROM hack on it.

 

[gnmmarechal]

The Sky3DS is one I would like to own, but it is extremely expensive. I wouldn't mind having an EZ-Flash Redux either.

 

[gudenau]

I wonder if this is what is preventing us from launching games from the SD card...
Well, one of the things at least

--------------------- MERGED ---------------------------

Sorry for double post, but I would just like to say that if we could write to our own gamecards, it would be amazing to have a cartridge with a custom sticker that has a ROM hack on it.

I mean, launching stuff off of a SD card is fairly easy. Just install as a CIA.

The Sky3DS is one I would like to own, but it is extremely expensive. I wouldn't mind having an EZ-Flash Redux either.

I kinda want one right now just to take apart.

 

[Deleted User]

I mean, launching stuff off of a SD card is fairly easy. Just install as a CIA.

Yeah, but imagine having a CTR Cart with Pokemon: Umbra Moon on it. That would look sick.

 

[gudenau]

Yeah, but imagine having a CTR Cart with Pokemon: Umbra Moon on it. That would look sick.

That would be fairly neat.

Guess we mostly need the key for this.

 

[Deleted User]

Well, IIRC, the Gamecard controller is what receives the key and then sends the decrypted data to the system to read. The firmware for this is completely separate from ARM9 and probably won't be accessible without external hardwdare. I am not quite sure how you would take over this and get the key, but it is possible.

And theoretically, if we had this key, couldn't we encrypt what goes on the cartridge so that we could load it on stock? Probably wrong here, but just an idea.

 

[gnmmarechal]

Well, IIRC, the Gamecard controller is what receives the key and then sends the decrypted data to the system to read. The firmware for this is completely separate from ARM9 and probably won't be accessible without external hardwdare. I am not quite sure how you would take over this and get the key, but it is possible.

And theoretically, if we had this key, couldn't we encrypt what goes on the cartridge so that we could load it on stock? Probably wrong here, but just an idea.

Sigchecks are still a thing. Don't think it is the same key.

 

[Deleted User]

Sigchecks are still a thing. Don't think it is the same key.

Retail cartridges are signed? I didn't know that.

 

[gudenau]

Well, IIRC, the Gamecard controller is what receives the key and then sends the decrypted data to the system to read. The firmware for this is completely separate from ARM9 and probably won't be accessible without external hardwdare. I am not quite sure how you would take over this and get the key, but it is possible.

And theoretically, if we had this key, couldn't we encrypt what goes on the cartridge so that we could load it on stock? Probably wrong here, but just an idea.

The 3DS carts are basically one chip, can't MITM it.

 

[Deleted User]

The 3DS carts are basically one chip, can't MITM it.

What you just said went right over my head. Can you explain what you mean? What I am saying is that the gamecard has the special key that gets sent to the Cart controller, which then decrypts the game, and then the decrypted data gets sent to the console.

 

[gudenau]

What you just said went right over my head. Can you explain what you mean? What I am saying is that the gamecard has the special key that gets sent to the Cart controller, which then decrypts the game, and then the decrypted data gets sent to the console.

Uhm, your off the mark a bit.

So you know what HTTPS is right? That's basically what we are dealing with here. The communications between the console and the game cart are encrypted. On top of this there is the other encryption that also exists on CIA files and 3DS ROMs. I'll make a diagram when I get home.

--------------------- MERGED ---------------------------

Retail cartridges are signed? I didn't know that.

Everything is signed, more or less.

 

[Deleted User]

I'll make a diagram when I get home.

That'll be helpful. Thanks.

 

[gudenau]

I hope this is helpful. All the points where there is crypto on the top left block there are also signature checks, plus a couple that I did not put on there.

@blujay

 

[Deleted User]

So, what are the checkmarks for? And why isn't there one next to Crypto on the Gamecart one?