ak2i & cartridge header observations

Deleted member 702243

Well-Known Member
Member
Joined
Apr 21, 2024
Messages
1,591
Reaction score
1,296
Trophies
1
XP
1,957
I got my hands on an ak2i the other day and I've been playing around with it, and made a few observations (some interesting, some pointless)

first thing I did when I got it was flash some different versions of the bootloader updates. the card came with the 3ds 1.0.0-0 firmware update on it (Atama de Do! Koten Kotenko DORASU), no issues there. this card cannot work on latest 3ds or dsi firmware versions anyway, and because of cfw it doesn't even matter anyway. so I wanted to switch to the dsi 1.4.1 version of the bootloader (Alex Rider: Stormbreaker) for the aesthetic, because dstwo uses the same icon

observation #1: this one hangs my ds phat on boot, no matter what. dsi is fine, it sees the cart and can run it fine. I didn't think to try 3ds but I suspect 3ds would fail to recognize it for reasons I'll get into later

next I converted my card to r4i ultra, no issues there. the card runs as it should and it can run the r4i ultra version of akaio 1.8.6a, except that

observation #2: twlmenu++ should have functionality that allows using r4i ultra as a second sd card of sorts, and run games from slot-1 instead of sd card which can be useful for games that don't work correctly with nds bootstrap, but this does not work with ak2i (regular or r4i ultra converted), even though it should. are there hardware differences between the two that we weren't aware of?

I flashed back to original ak2i firmware, and put godmode9 ntr on it so I don't have to fiddle with r4i gold 3ds plus anymore. works as expected, the card has a fallback "acekard2i" banner and icon that it uses so you can still use it as a flashcart and ntrboot all in one. 3ds has no issues with it, ds phat has no issues with it. dsi on the other hand

observation #3: dsi launcher does not register ak2i flashed with ntrboot, 99% of the time, despite both ds/lite and unmodded 3ds being able to at least read the card and show the icon/launch it. I'm not sure why that is

I've decided this card will live in my 3ds, and I wanted to use twlmenu++ on it. in doing so I didn't like how the ak2i initial loading screen looked, the white "Loading" in a different font for the r4i ultra looks much nicer than the blue fat font "Loading" of the ak2i. so I flashed back to r4i ultra, put gm9 ntr back on, and as probably expected, r4i ultra also has its own fallback banner and icon that is used when you overwrite it with ntrboot. except I didn't like that one, it was ugly. I wanted to mod it back to ak2i so it would appear as an ak2i, but with the r4i ultra loader instead.

observation #4: this doesn't work. I don't know why. I replaced the icon and banner and modded the game title/game id/maker code back to the ak2i ones, and the card is not detected by the 3ds anymore (home menu sees nothing, gm9 cant read the card.) ds phat hangs on boot when the card is inserted (same as #1)

I figured, well maybe the checksums or whatever are wrong, because I didn't know how to fix them at the time, or I was too destructive and overwrote too much data from the ak2i backup into the r4i backup. one thing led to another and instead of putting the ak2i branding back on, I wanted to give it twlmenu++ banner and icon instead. I found Pk11's script for changing the banners in ntrboot backups, extracted the banner from twlmenu++ boot.nds with tinke, and replaced the banner inside my ntrboot flasher backup.

observation #5: banners for older versions of the flashcart firmware remain in memory after firmware upgrades, for some reason? the script found dorasu, alex rider and danny phantom banners in there waaaaay later in the file past the r4ds ultra banner

all was well, the card works as it should, I got my twlmenu++ banner and icon with the r4i ultra load screen. turns out r4i ultra has autoboot flag as well, I figured out how to fix the header crc so I could remove that, and all was good. except twlmenu wasnt working, the card just hanged at "Loading" (user error, I fixed it later), but just to make sure my edits hadnt broken the card's ability to actually load a kernel, I put the r4i ultra version of akaio 1.8.6a on there just to see if it would at least run. it did, except that

observation #6: after replacing the banners, akaio drm reports the card as a "fake acekard clone" (lol), I guess the r4i ultra variant of akaio still has drm in it, and it checks the banner to know if it's allowed to run. were they afraid that the r4i ultra would get cloned? that doesn't make sense because all a clone would need to do is copy the banner data. maybe the drm triggering like this was a mistake?

anyway I don't care, I wasn't going to use it anyway. but next I wanted to edit the header data back to ak2i, because this is an ak2i after all not an r4i ultra. for aesthetics I wanted it to show up as ak2i in gm9 and in unlaunch, for instance. so I re-dumped the flash, and all I changed was the first 18 bytes at 0x2000 back to ACEKARD2I ACEK AK, and fixed the header checksum

observation #7: even starting from a known working state and only changing the bare minimum to rebrand in the header, it was the same as #4. the card hangs ds phat on boot and is not recognized by the 3ds at all (unlaunch can boot it still, strangely enough.) what is up with that? how come original ak2i header works fine with those game title/game id/maker code, but r4i ultra doesn't? what about the ak2i header data causes the console to fail to read the card in one case but not the other? is it a hardware problem with my card, or there is some other interaction with the rest of the header that I'm not aware of? the card seems to work fine otherwise, so I guess I'll never know

in the end I'm flashing back my original ak2i backup, because as it turns out, I can't get good enough game compatibility in twlmenu++ with the included bl2ck kernel loader for ak2i/r4i ultra (pokemon white 2 black screens after you hit continue, pokemon conquest doesnt run at all, for example.) so I'm better off sticking with akaio, which is a shame because I wanted twlmenu's functionality of being able to show the animated icons for dsi-enhanced games. but this was fun to mess with anyway, most of this is pointless but maybe some will find these observations interesting

(that being said I'm interested in getting this ntrboot flashed card working in dsi launcher, if anyone has an idea what could make it fail to show up on dsi that would be appreciated)
 
  • Like
Reactions: k66
Note the game id/game code at 0x0C in the rom header used for Acekard is used as part of ntr secure area crypto as well as blowfish keys. Hence the instances where the card stopped showing up in the menus with a few of your attempts where it didn't work. Bad secure area CRC can also cause DS firmware/DSi System Menu/3DS Home Menu to now show the cart. If you alter any data at 0x4000 to 0x7FFF in the rom where arm9 binary usually located you'll have to fix the secure area CRC in the header. Game code also impacts the encryption of 0x4000 to 0x4800 which is the secure area I described.

Acekard's flashdump uses 0x0 to store blowfish key for main rom. Acekard hw81 varient also have a second rom section at 0x80000 where the blowfish key starts with the rom at 0x82000. The second rom section is what ntrboot typically uses for ntrboot roms. It's the rom section Acekard usually shows to DSi and 3DS consoles. First rom section is usually shown to DS/DS Lite consoles though some of Acekard's official updators can disable this section in some manner where the second rom is always used for all consoles. I forget which ones at the moment do that.

It is not recommended you attempt to alter the first rom as you have less space there as akaio will write to sections near it so if you put something too large there it will get overwritten and stop booting.

Second rom section you can use something up to 1.5ish MB in size without running into remapping/data mirroring by the way. Larger stuff won't map the correct locations in rom so you'll run into problems there.

Anyways to properly update rom headers you need to find yourself a tool for generating new blowfish keys else you are wasting your time. ;)
 
Last edited by Apache Thunder,
I recently bought AK2i(hw81).
My DSi is ver 1.4.6C, AK2i can boot with HiyaCFW and TWiLightMenu, Unlaunch failed to boot AK2i directly.
After injecting ntrboot(DS-Homebrew,ntrboot_flasher_nds:6.0.1-1-gf9e2fcf,flash_core: v1.1.0-1-gadc49d2),DSi fails to boot AK2i,DSi's ntrboot work.
If inject ntrboot 3DS(ds_ntrboot_flasher 4.0),DSimenu doesn't recognize AK2i, but can boot AK2i with Unlaunch, DSi's ntrboot doesn't work.
 
Last edited by k66,

Site & Scene News

Popular threads in this forum