Hacking 3DS Development Hardware

Status
Not open for further replies.

3DSGuy

No longer in scene
OP
Member
Joined
May 22, 2012
Messages
345
Trophies
0
XP
467
Country
United States
After doing some digging, for info and photos on 3DS dev hardware, I noticed there was not much info in one place, and not everything was correct. So I thought, why not put it all together here and crush most of the rumors surrounding 3DS Dev Units. And unless otherwise stated, none of the photos are mine. A page documenting 3DS Development Software can be found here.

Pricing

An incomplete list of 3DS Development Kit Parts (Leaked from WarioWorld):

Development Kits:
PARTNER-CTR DEBUGGER $2,620
PARTNER-CTR CAPTURE $2,620
PARTNER-CTR DEBUGGER/CAPTURE (Dual Functionality) $3,905

Test Units:
Nintendo 3DS (Development only) "Panda" USA $324
Nintendo 3DS (Development only) "Panda" EU $324
Nintendo 3DS (Development only) "Panda" AUS $324
Nintendo 3DS XL (Development) "Panda" ALL REGIONS: $ 343.75
Nintendo 2DS Panda: $ 153.00

Flash Card/Memory:
Flash Card, 16 Gbits (2 GBytes) CTR $85
Backup Memory, 1Mbit (128 KBytes) Flash CTR $8.50
Backup Memory, 4Mbits (512 KBytes) Flash CTR $10.50

So now you know all panda units on eBay are complete rip offs.


Software Specifics

They cannot run unsigned code. Development hardware has the virtually identical firmware and software to production units. The differences include:

  1. The AES and RSA keyslots. This prevents interoperability with production units and software. Which in layman's terms means 3DS development hardware cannot run retail 3DS games and vice versa. There are also a collection of fixed AES keys which allow developers to encrypt data without having to know the AES key scrambler algorithm.
  2. Title Version restrictions. On retail units the ARM9 FIRM won't allow older titles to overwrite newer versions. This restriction does not exist on development hardware.
  3. The CPU/GPU Usage can be toggled on the Home Menu by pressing 'X' and 'Y' together.
  4. Development hardware has an alternate to the Home Menu, called the "Test Menu". It is a very basic GUI, see 3DS Development Unit GUI for more details.
  5. DS/DSi compatibility. DS/DSi compatibility was introduced around firmware 0.15.0 (Aprox SDK 2.0.0). All DS mode applications are supported from cartridge. Only DSi titles signed with a special RSA key will run. Production DSi titles and TWL_SDK compiled DSi titles are not compatible.
  6. System Transfer is stubbed and online System Updates fail.
  7. As a standard StreetPass Mii Plaza is stubbed and AR Games and Face Raiders are not installed.
  8. Different servers are used for managing Friends List.
There are also a series of tools written by Nintendo which help with the development process:
See Here



PARTNER-CTR DEBUGGER/WRITER/CAPTURE

The PARTNER-CTR DEBUGGER and the PARTNER-CTR WRITER (There are no public photos of the latter), are the development hardware which 3DS software is supposed to be created with. They are thick cream coloured boxes, that somewhat resemble the IS-NITRO devices for the original DS.

PARTNER-CTR DEBUGGER/WRITER Specifications:

1/ CTR Capture can output video signal to external screens via a Wii AV Cord, DVI or computer screen capture though a USB connection.

2/ Can be used in conjunction with PC using CTR SDK software (connection is probably through the same USB port used for screen capture)

3/ They have 2GB (this is standard) of emulated memory and 128MB of main memory. They can also perform real-time memory edits.

4/ They have WLAN protection from radio disturbances

5/ CTR Debuggers can flash cartridge images to CTR-008/CTR-005(-01) cards with a max 1 card at a time. While CTR Writers can flash up to eight CTR-008/CTR-005(-01) cards at a time.

6/ The two cords connecting a CTR Debugger to a dummy 3DS unit are both 100cm (1m) long.

7/ The actual SD Card slot used is located on the CTR-Debugger/Writer, NOT the dummy 3DS unit.


Photos of PARTNER-CTR DEBUGGER units in action:

2rpe7ie.jpg

hvwlqv.jpg

Ctr_debugger_at_press_event.jpg

3ds-development-hardware-1-extimgnwm.jpg

partner02.jpg
partner01.jpg


Video Footage:



"Developer" Test Units

Internally referred to as "Panda" units, these are 3DS development units which as the name suggests is used for testing games in the end user environment. These units offer little in terms of debugging ability. Images of panda units: DOWNLOAD

The only difference between a production units and panda units is the colour of the casing and the software in the NAND and BootROM.

Panda units, can be used to launch software from, slot 1 devices, the NAND(including the TWL partition) and the SD card. (These are the same launch locations which production units use)

Labeling:

"Panda" units have the model number CTR-001(-01)(COUNTRY CODE HERE). Where the country code is the region with which the panda is complying with local radio communications laws.
Aust_3ds_devlable.jpg

Images of Panda Units:
6sutqe.jpg
16peno.jpg

25hoopw.jpg
2v0fln9.jpg



"Display/Game Show" Test Units

Although they are not listed a Development parts, Nintendo uses 3DS Test units which cosmetically mimic retail 3DS units at events such as E3 (there have also been sightings of 3DS XL test units). Its worth noting that these units are exactly the same as Developer Test Units with the exception of the colour of casing.
2cr0heh.jpg



Accessing the Home Menu/Test Menu on 3DS test units, can be tricky. If pressing the Home button works, you're lucky. If that doesn't work, try hard booting the device. If that doesn't work, then you have an auto-booting title, in which case treat it like a retail kiosk unit. You should be at the home menu/test menu now. Have fun, if you can, take screenshots of the dev apps with the test menu and submit them here, or at least take photos of the unit's developer label.

There are videos of 3DS developer units being used at Game events. Here are ones I've found:

A Dev Unit at The Nintendo Connection Tour 2011:

A Dev Unit at GamesCom 2011:


Prototype Units

These are 3ds developer units which Nintendo devised while deciding on the final hardware specs. Most prototype revisions resemble a computer motherboard. The prototypes you see below are TEG based units, which means they use Nvidia's Tegra graphics chip. These prototype units also have special hardware settings, amongst which include a changeable ram allowance, an attachable controller and a connectable debugger. These units, because of the differing hardware, use different firmware to that of regular Developer 3DS units, and are not officially supported anymore. Here are some documents on prototype 3ds units I found on the FCC website: Download
34ihkqg.jpg
2q822c3.jpg
2nrmpgw.jpg


My Prototype Unit:


Flashcards

Typically .cci and .csu files can be written to a regular 3ds card which has the product code of CTR-005. But for the sake of development and testing two types of CTR cards are used with development hardware:

CTR-008 (re-writeable flash card)
CTR-008.jpg

As the name suggests, these types of cards can be re-flashed at the developer's discretion. A developer might only need two of these because of their re-usability. As described in the parts list it is possible to buy backup (or removable) memory flash, which is used in conjunction with the CTR-008 as it has no built in save flash.

CTR-005(-01)
CTR-005%28-01%29.jpg
(Image mine)
Like CTR-005, but have generic labels on the front, and the name of the flashed game/program is usually written on a label on the back of the cartridge. These aren't sold to developers. Nintendo privately uses these to showcase unfinished game demos at events.
 

3DSGuy

No longer in scene
OP
Member
Joined
May 22, 2012
Messages
345
Trophies
0
XP
467
Country
United States
this is interesting. i'm curious, what makes you qualified to remove rumors and by doing so imply that the information contained here is 100% correct?

-another world
"...crush most of the rumors..." Implies that this may not be 100% correct. I don't know everything, I'm not Nintendo. There is some information I haven't put on this page because I am uncertain of its validity. Every thing in the post is to my knowledge is completely correct, with the the execption of the parts about the CTR-DEBUGGER, I'm sure it's correct, but without having one myself, I've no way of being 100% certain.
 

jimmyemunoz

Well-Known Member
Member
Joined
Feb 23, 2009
Messages
1,958
Trophies
0
Location
Louisiana
XP
467
Country
United States
I'm glad someone started to document all the tools available in one place. I don't think any of the technical information would benefit 99.9% of the users here, but hopefully it finds a person who needs it, or could even add to it. Good luck...:)
 
  • Like
Reactions: 2 people

3DSGuy

No longer in scene
OP
Member
Joined
May 22, 2012
Messages
345
Trophies
0
XP
467
Country
United States
BUMP! Corrections to the section about the encryption keys. After stumbling across the Standard Developer encryption key by accident, I discovered that there were no super secret nintendo keys, at all. And even titles like DevMenu can have it's ARM Code retrieved from the exefs by decrypting it with the standard development key. Either my trusted sources(those with the SDK and the Standard Developer key), were dead wrong and automatically assumed that it would use different keys, or I miss comprehended RSA keys for AES-CTR encryption keys in past conversations
 

goembario

Well-Known Member
Member
Joined
Sep 14, 2009
Messages
155
Trophies
0
Location
Netherlands
XP
230
Country
Netherlands
Just curious but would you be able to put a dumped rom on that "flash card" and start it somehow? (with the CTR-008 card)
Or only those cci. and csu. files??
 

nukeboy95

Old skool member
Member
Joined
Aug 24, 2010
Messages
2,275
Trophies
0
Location
The left side
XP
894
Country
United States
Awhile ago an incomplete list of 3DS Development Kit Parts was leaked with prices:

PARTNER-CTR DEBUGGER $2,650
PARTNER-CTR DEBUGGER/CAPTURE (Dual Functionality) $3,950
Nintendo 3DS (Development only) “Panda” USA $325
Nintendo 3DS (Development only) “Panda” EU $325
Nintendo 3DS (Development only) “Panda” AUS $325
Flash Card, 16 Gbits (2 GBytes) CTR $85
Backup Memory, 1Mbit (128 KBytes) Flash CTR $8.50
Backup Memory, 4Mbits (512 KBytes) Flash CTR $10.50
.
reason why people get them on ebay


nintendo is the hardest of all gaming companies to get devs kits from

it takes months and some times years
they only give them to TRUSTED game developers
if you get a dev kit from nintendo YOU ARE Lucky
 

3DSGuy

No longer in scene
OP
Member
Joined
May 22, 2012
Messages
345
Trophies
0
XP
467
Country
United States
Just curious but would you be able to put a dumped rom on that "flash card" and start it somehow? (with the CTR-008 card)
Or only those cci. and csu. files??
The 3DS rom dumps you see floating around on the internet, are in the CCI format. There's no reason why it shouldn't technically work. Though I can't imagine Nintendo would make it that easy, there's probably a restriction in PC flasher program which refuses to burn the rom if it has retail flags, or retail 3DS units refuse to read CTR-008 cartridges. But I don't know for sure, I don't have one :( .
 

xXMortalKombatXx

Well-Known Member
Newcomer
Joined
Apr 14, 2012
Messages
69
Trophies
0
XP
60
Country
Brazil
hey joe (can i call you by your name? xD)

so if you have a dev unit, can you make a 3ds rom? and how nintendo starts selling it or bring it to eShop?
 
Status
Not open for further replies.
General chit-chat
Help Users
    KenniesNewName @ KenniesNewName: You just burned the bread