Ace3ds X PCB and firmware

[moon_rabbit]

Yellow arrow
GD25LH80BM (1MB) SPI FLASH.
Firmware for ntrboot.

Blue arrow
W25Q16DV (2MB) SPI FLASH.
Original firmware.

---Update---
In ntrboot_flasher you can't dump it.
It has the same firmware as the Ace3ds+.
The only difference is that you can choose the firmware for ntrboot.
Fixed an incorrect filename that was attached.
---

I've attached the dumped firmware.
If anyone is interested, feel free to compare or analyze the firmware.

 

[chrisfuk]

Thanks for this
I had one of these sat in a draw ,bought from ali express a while ago , got refunded as the card did nothing .
removed the W25Q16DV put it in my programmer ,it was blank , programed it up with your dump , now it works great.

 

[moon_rabbit]

Thanks for this
I had one of these sat in a draw ,bought from ali express a while ago , got refunded as the card did nothing .
removed the W25Q16DV put it in my programmer ,it was blank , programed it up with your dump , now it works great.

That's good.
It seems like some people have gotten blank flash from Ace3ds X.
Since it's the same firmware as the Ace3ds plus, there's no card specific data either, which is nice.

 

[SylverReZ]

That's good.
It seems like some people have gotten blank flash from Ace3ds X.
Since it's the same firmware as the Ace3ds plus, there's no card specific data either, which is nice.

The firmware is the same, as well as the hardware but it's slightly different. The switch turns on or off either one of the SPI flash chips to access a different firmware.

 

[Apache Thunder]

Took a quick glance at the flash dumps. 0xA000 appears to be where the rom data starts as the sponge bob header is at this location. 0x8000 has the entire 0x1048 blowfish key as one block sorta like how Acekard 2i store's it's blowfish key. Data at 0x0 to 0x7FFF appears to just be a test patterns. 0x9050 appears to contain version information. 0x90C0 might be a basic table of how rom data is mirrored during rom reads. It's the one part that is notably different between the ntrboot flash and the regular rom flash. I imagine the version used for the ntrboot flash just has the rom mirroring disabled. (so this cart should easily do DSi ntrboot I reckon)

Both flash dumps appear to be organized the same way so you could probably put 2 separate DS roms on this thing or 2 ntr boot roms or a mix of either. Assuming you have a method of flashing this thing.

As for rom data mirroring/relocation, one would have to compare a rom dump of the sponge bob mode to see where the data appears to move around around if you don't want to try deciphering what I believe was the rom data organization stuff at 0x90C0 ...but practically speaking I think you could easily put a DSi ntrboot package on this using the flash dump on the second chip if you have a method of flashing it.