Hacking 3DS unbricking progress

[krisztian1997]

don't want to rain on your parade, but

Reset command sent on MOSI, but no answer from the slave. Please check your card connection/soldering
ReadCardStatus = 11111111,11111111

doesn't look all that good to me.

Saw that... same problem like before. Any reasons why the dat line is on high if there is no card in the arduino ?

 

[Coto]

isolating it might be difficult as for that you might need to cut a trace.
I assume there are methods to stop the 3ds clock signal in a high state somehow, as people can backup and restore their 3ds eMMC with an sd card reader.
They also can unlock and force erase it with a raspberry pi. I haven't heared of anyone frying his 3ds, but lowering the pullup resistors is a very bad idea as it increases the current needed to pull the line low.

Basically, 2 things need to be tested.

1. Finding a method to stop the 3ds clk signal and having that line in a high state. This can be checked by measuring it's voltage. It should be above 3.1V
2. Pulling such a frozen clock signal to gnd and measuring the current that is needed to do this.
If it's only a few hunderd microamps or even less, it's driven by an open drain on the 3ds as well and there is no danger in driving it with an additional open drain as well.
If it's several milliamps, it's driven with a logic gate. In such case it's hard to tell if it's 100% safe to drive the signal with external hardware without first isolating it.

The 3ds will probably be case 1. Even than, you should only pull the signals to gnd.
The resistor voltage divider gives a protection, as the maximum possible currents are limited by the resistors.
A (non open drain or open collector) buffer chip can easily drive several milli amps. This currents could be dangerous for the 3ds chip that controls the eMMC.

I can understand that most of you can deal with the software site of things, but have problems with the hardware.
It doesn't mean that correct interfacing the hardware is unimportant for a proper result (every time and reliable)

While experimenting with software usually isn't harmfull, the same can not be said about the hardware way of doing things.

you've raised some interesting facts. I thought the 3DS had a dedicated controller while dealing with the one on the eMMC. Knowing nintendo being cheap, it could be a possibility too.

But keep in mind a few facts (from various sources on this topic)

Some people incorrectly plugged the VCC or DAT line on the CMD, yet the 3DS bios reported accurately every "weird behaviour" of the CMD line (00000000 000000X0) (FFFFFFFF FFFFFFFF)

Instead of the FFFFFFFF's the "circuit" from the 3DS could've been fried if a logic gate have had taken place (multi loads from different sources meet eachother),
that, or somehow the 3DS CLK load gets absorbed, and input load from CLK (as it deals with high low voltage signals) takes place instead.

i'm not an electronics guy either

don't want to rain on your parade, but

Reset command sent on MOSI, but no answer from the slave. Please check your card connection/soldering
ReadCardStatus = 11111111,11111111

doesn't look all that good to me.

Right. it's impossible for bit48 to be 1, as it's the start bit (it's 0 no matter what)

it seems almost like voltage is wrong (or leakage? interference?), or clock or something going on either SPI_OUT (emmc) or eMMC itself

 

[plog]

Hi,

I received my Raspberry Pi today and hooked it up.
But I get this, see picture.
Is there something wrong.
I get the same when I put a sd card in the Pi.


I have a normal 3ds.
I put the files from bkifft on it.
Connected with 4 wires.

 

[olfa]

View attachment 6303 Hi,

I received my Raspberry Pi today and hooked it up.
But I get this, see picture.
Is there something wrong.
I get the same when I put a sd card in the Pi.


I have a normal 3ds.
I put the files from bkifft on it.
Connected with 4 wires.

check cables and soldering
mesure voltage on sdcard adapter between ground and dat0, ground and cmd
verify clk soldering (it s very sensitive)
shorten your cable if longer than 20cm
try with a sdcard reader on linux, and check dmesg output
(to see if it's detected or not by sdcard reader)

 

[TheBorg]

Has someone considered the fact that the CLK signal is an output from the 3DS to the eMMC?
Bidirectional lines like the DAT0 are normally driven by open collector or open drain signals.
This means that the line has a pullup resistor to 3V3 and is pulled to GND by the device that wants that line to become low.
While the eMMC standard accepts multiple eMMC devices on the same bus, the 3ds likely isn't expecting something else taking over control of the eMMC interface.
So, basically, in normal operating conditions, the 3ds is controlling the lines. What happens if the 3ds can't access the eMMC? Will it turn of it's clock signal?
If you measure 2.xV on the clk signal, it's probably an average of the signal being switched between high and low. And as you aren't switching it, it's likely the 3ds doing it.

Most digital circuits that are not open collector or open drain survive when their outputs is pulled to gnd. They don't survive when there output is pulled or forced to 3V3.

So basically, we need to find out how we can stop the 3ds from generating the eMMC clk signals. When this condition is met, we should measure 3V3 on the clk signal (If our arduino interface drives it high as well) It wouldn't suprise me that forcing one of the other CMD or DAT0 lines low will disable the 3ds to eMMC communication (blue screen with error code) No idea if that turns off the 3ds clk generation. To proper see the condition of the clk signal, you will need an oscilloscope or a logic probe. You can even use the arduino bord to probe that signal. If you sample it several lines, and you measure high as well as low, it's likely constantly changing between high and low.

Also note that it could make a difference if you allow the 3ds to initialise the eMMC (only connect your interface after the 3ds was turned on) or if you don't allow it (connect your interface and turn it on before the 3ds)
Even if your interface is connected before the 3ds is turned on, it shouldn't influence the 3ds operation if all your interface lines are in the high state.

If you don't understand what I am writing here, you are experimenting on a dangerous level.
In that case I would suggest you use the raspberry pi as it has proven to work.
If you are trying to learn something and don't mind frying your 3ds, ignore previous sentence.

I tried to turn on 3ds without any connection, direct blue screen, CLK = 0V and no CLK pulsing.
I tried to turn on 3ds connected to my Board and tried on PC, it's for 3 seconds black and then blue screen, CLK = 0V and no CLK pulsing.
Then in both states i make output CLK to high on my board and i measure 2.3V.
The output i used is an open collector with a pull up resistor of 47K
i also tried it with the 3ds switch off, not connected 0V... Connected with CLK hi 2.3V

 

[mvmiranda]

Hello,

I'm trying to unbrick a normal 3DS with Rasp and I'm getting one error

If i query it with the s, it reports the MMC is locked, so I use the f command and then type H to continue. Then I see the CID and see MMC status is 0x02000900 (MMC is loicked).
The program tries a force erase (CMD42) and I receive this error:

SND_send_init: error occurred whilst waiting for transfer complete interrupt
SD_init: error sending CMD42, error = 00200000. Giving up.

Any clues?

Thx

 

[bkifft]

Hello,

I'm trying to unbrick a normal 3DS with Rasp and I'm getting one error

If i query it with the s, it reports the MMC is locked, so I use the f command and then type H to continue. Then I see the CID and see MMC status is 0x02000900 (MMC is loicked).
The program tries a force erase (CMD42) and I receive this error:

SND_send_init: error occurred whilst waiting for transfer complete interrupt
SD_init: error sending CMD42, error = 00200000. Giving up.

Any clues?

Thx

as written in step 16 this error is expected. should none the less be unlocked (check with another s)


edit: oh and please don't forget step 18

 

[mvmiranda]

Hello,

I'm trying to unbrick a normal 3DS with Rasp and I'm getting one error

If i query it with the s, it reports the MMC is locked, so I use the f command and then type H to continue. Then I see the CID and see MMC status is 0x02000900 (MMC is loicked).
The program tries a force erase (CMD42) and I receive this error:

SND_send_init: error occurred whilst waiting for transfer complete interrupt
SD_init: error sending CMD42, error = 00200000. Giving up.

Any clues?

Thx

nevermind! I soldered DAT0... :S I soldered to the pad directly bellow it... Reviewed the wiring and found it.

Thx!

 

[bkifft]

oh dang. right, mixed up dat connection will result in that error too... so i'll have to find a way to catch that after all -.-

 

[mvmiranda]

as written in step 16 this error is expected. should none the less be unlocked (check with another s)


edit: oh and please don't forget step 18

No matter how many times I tried to force erase it never erased since DAT0 was "not soldered".

I just soldered to the correct pad and get a "MMC is not locked." now.

I'll finish unbricking it and greet you with a fine "national" art, if you know what I mean (step 18 rulez)

 

[mvmiranda]

oh dang. right, mixed up dat connection will result in that error too... so i'll have to find a way to catch that after all -.-

I realized something were wrong because I tried unlocking MMC soooooo many times tht I thought: crap! bkifft said SOMETIMES you get that msg not EVERYTIME
Reviewed the wiring and caught the error...

Anyway thx!

 

[bkifft]

No matter how many times I tried to force erase it never erased since DAT0 was "not soldered".

I just soldered to the correct pad and get a "MMC is not locked." now.

I'll finish unbricking it and greet you with a fine "national" art, if you know what I mean (step 18 rulez)

looking forward to it (just remember: drawn, not a photography).

I realized something were wrong because I tried unlocking MMC soooooo many times tht I thought: crap! bkifft said SOMETIMES you get that msg not EVERYTIME
Reviewed the wiring and caught the error...

Anyway thx!

glad it worked and very welcome (and to be honest though: that error is 100% even when it works *innocent whistle*).

 

[mvmiranda]

bkifft
Oh! Just remembered... is that anyway you could update your 3dsunbrick program and put a way to disable automatic update? I'm not using Internet in my Rasp but everytime I need to wait something around 1 minute until it times out and proceed
That's not a BIIIG deal, but it would be neat

Thx!

 

[bkifft]

bkifft
Oh! Just remembered... is that anyway you could update your 3dsunbrick program and put a way to disable automatic update? I'm not using Internet in my Rasp but everytime I need to wait something around 1 minute until it times out and proceed
That's not a BIIIG deal, but it would be neat

Thx!

exists already as a hidden option: "3dsunbrick NOUPDATE"

 

[mvmiranda]

oh crap! the 3DS died (battery) while I was writing the NAND backup...
Can I power it with a XL power supply? I don't have a normal 3DS power brick around.

 

[mvmiranda]

exists already as a hidden option: "3dsunbrick NOUPDATE"

nice!
so if it's documented somewhere, RTFM for me, right?!

 

[TheBorg]

wouldn't it work if the arduino was powering the nand instead of the 3ds battery? shouldn't be too hard to find a power pin for the nand no? There would be no need to turn on the 3ds, or for that we need more wires or something (besides the power wire ofc)?

The points i marked in red is the power for the nand right?

Want to try it.
But i must know for sure where i can connect the 3.3V.
i have a 3ds xl.

 

[krisztian1997]

oh crap! the 3DS died (battery) while I was writing the NAND backup...
Can I power it with a XL power supply? I don't have a normal 3DS power brick around.

Its the same voltage but the XL has a better battery, its gonna work

 

[mvmiranda]

Its the same voltage but the XL has a better battery, its gonna work

Nice to know!
Can I write to the NAND while charging?

 

[krisztian1997]

Nice to know!
Can I write to the NAND while charging?

No idea, some users reported that it causes some interference when a charger is connected to the 3ds, you could try and see if the SD card read can write to the nand.