Hacking 3DS BIOS

[daniilS]

Hi,

I've been wondering, is there any information known about the 3DS BIOS? I've read somewhere that on the DSi, it's stored somewhere on a Wi-Fi module, but that isn't the case with the 3DS (however, it seems to be responsible for a few other interesting things).
So, is the BIOS then maybe stored on the Nintendo 1048 0H? And if yes, is that chip based on some kind of ARM standard? Because I believe that with BIOS hacking, a lot is possible. Because it is the first thing that gets launched, it can't be encrypted. So if we found this http://3dbrew.org/wiki/PSPXI:EncryptDecryptAes command, and redirected the destination and a possible jump after it to the SD card, we'd get a decrypted stage 2 bootloader or even a decrypted firmware run from the SD card.

I'm sorry if this is a very noobish question, I know very little about the 3DS, but I just wanted to know if there's any possibility on BIOS hacking.

 

[greyneon]

AFAIK the term BIOS is not correct for the 3ds

 

[Arras]

Whatever boots first is probably read-only anyway.

 

[daniilS]

Whatever boots first is probably read-only anyway.

Through software means, probably. But chips can always be reprogrammed if you have a right programmer and know how to connect the wires.

AFAIK the term BIOS is not correct for the 3ds

Alright, the bootloader or something.

 

[Arras]

Through software means, probably. But chips can always be reprogrammed if you have a right programmer and know how to connect the wires.

Not necessarily. There's several types of memory that can't be rewritten, no matter what.

 

[FAST6191]

When you say BIOS do you mean you want something like http://nocash.emubase.de/gbatek.htm#biosfunctions and http://nocash.emubase.de/gbatek.htm#dsmaths but for the 3ds? If so then I would be quite interested to see one too and I have not been able to find a public one or even hints at a private one (all the comments are also along the lines of things still need to be mapped out so I am not expecting there to be a hidden private one). Indeed I am not actually sure the BIOS would be used as a quasi functions library/coprocessor this time around but I would be shocked if there was not a serious amount of that sort of thing at some level in the 3ds.

Alternatively if you are confusing BIOS with firmware in the DS sense of the term ( http://nocash.emubase.de/gbatek.htm#dsfirmwareserialflashmemory ) then greyneon was probably on the right path. Most things seem to revolve around the 3ds kernel and how it plays out. More is known here, mainly as that is what most of the hacks work with, around and through, but I have not seen anything I would use as a reference or even try to construct a reference document from.

 

[daniilS]

Not necessarily. There's several types of memory that can't be rewritten, no matter what.

Ah, now I think about it, of course. But still, only dumping it may explain something about decryption, and maybe even be the first step to a complete 3ds emulator.

When you say BIOS do you mean you want something like http://nocash.emubase.de/gbatek.htm#biosfunctions and http://nocash.emubase.de/gbatek.htm#dsmaths but for the 3ds? If so then I would be quite interested to see one too and I have not been able to find a public one or even hints at a private one (all the comments are also along the lines of things still need to be mapped out so I am not expecting there to be a hidden private one). Indeed I am not actually sure the BIOS would be used as a quasi functions library/coprocessor this time around but I would be shocked if there was not a serious amount of that sort of thing at some level in the 3ds.

Alternatively if you are confusing BIOS with firmware in the DS sense of the term ( http://nocash.emubase.de/gbatek.htm#dsfirmwareserialflashmemory ) then greyneon was probably on the right path. Most things seem to revolve around the 3ds kernel and how it plays out. More is known here, mainly as that is what most of the hacks work with, around and through, but I have not seen anything I would use as a reference or even try to construct a reference document from.

What I meant is the bootloader; the part that decrypts the fiware or the stage 2 bootloader form the NAND flash memory.

 

[profi200]

You can't dump it.
You can't modify it.
You can't redirect it.

All not possible and serveral have already tried. Not even with RAM haxx you can dump it or modify it.