Datel Trainer Toolkit/Action Replay Reverse Engineering?

[gudenau]

Does anyone know much about reversing efforts of Datel's Trainer Toolkit or the overarching Action Replay software stack?

The SLOT-2 device is a super cool bit of hardware that is pretty hard to use today for it's original goal of creating game cheats, even back in the day it would often crash the DS when doing code searches. A modern set of software for this could allow easier use, hopefully fix the crashing issues and maybe even allow using it for debugging homebrew or other weird and wonderful things.

Post automatically merged: Oct 26, 2022

It is interesting, from what little I have observed in messing with this myself is that "PAUL" shows up in the SLOT-2 address space and the USB protocol that the Trainer Toolkit uses. I wonder if that is the name of a developer.

 

[FAST6191]

They were reasonably sought after in early days of cheat making as emulators had not quite caught up, however I never saw any talk then of modifying all that much for it, much less making some kind of open source or seriously hacked setup to handle it.

Crashing issues are likely to be inherent to it, at least pending some kind of crazy awareness of all ROMs and their foibles -- the timing, the gulf in bus speeds, the dozens of ways you might need to inject things...

Today with emulators having very shiny debugging options (or able to be made so with external tools using known protocols) then you are unlikely to get much hit, not to mention the trainer toolkits are reasonably rare (for others playing along not every action replay had the option to make cheats). I would almost go the other way and make some kind of thing to run on a flash cart where you can reasonably easily patch things in at will (DSATM working says most of what you need to know there) and whatever DSserial equivalent, save bus (the pokewalker using it for IR comms being a nice example), possibly even some kind of wifi (pokemon typing being an example of this in action) or custom GBA slot as a write out and maybe serial comms in.

About all having the trainer toolkit might gain you is the option to do fun things with any cart with onboard extras (pokemon typing and the bluetooth keyboard, maybe that robot dog thing was it wappy dog, pokemon IR comms if you can be bothered to do the hard bypass or feel like working up from software rather to figure out how it works than down from hardware), possibly faking being a GBA slot for whatever purposes (not sure who would have this and not a GBA slot cart they could persuade to play with whatever but could happen. https://nintendo.fandom.com/wiki/List_of_Nintendo_DS_games_with_GBA_connectivity for those playing along at home, most caring about pokemon pal park which allowed GBA era to DS era pokemon transfers and see also cory1492's pokepatch for how most would approach that today if a save editor is not the order of the day).

 

[gudenau]

I do have the hardware and someone has a reverse engineered schematic and board layout on GitHub, so in theory we can make more.

From poking around in the SLOT-2 memory a bit it looks like ARDS might upload a small firmware blob to the Trainer Toolkit's ROM address space and then uses the SRAM address space for serial communications. This is a part that would require more work I feel.

I have successfully managed to write a little program that can dump memory from the DS without using the Datel software and I haven't crashed yet, so maybe it's just the Windows program that's causing crashes?

One day in the future I do want to make some similar hardware for the DS, I just need to learn more about programmable logic and board design stuff before I can really get into this stuff. I do plan on getting a MSO at some point, maybe next year...

 

[turtleisaac]

Are you familiar with the protocol that the trainer toolkit uses to communicate with the DS via slot2? I've been trying to research this myself lately, trying to figure out the pins used and the timings

 

[Aheago]

I do have the hardware and someone has a reverse engineered schematic and board layout on GitHub, so in theory we can make more.

From poking around in the SLOT-2 memory a bit it looks like ARDS might upload a small firmware blob to the Trainer Toolkit's ROM address space and then uses the SRAM address space for serial communications. This is a part that would require more work I feel.

I have successfully managed to write a little program that can dump memory from the DS without using the Datel software and I haven't crashed yet, so maybe it's just the Windows program that's causing crashes?

One day in the future I do want to make some similar hardware for the DS, I just need to learn more about programmable logic and board design stuff before I can really get into this stuff. I do plan on getting a MSO at some point, maybe next year...

I have an old dsi action replay with a microsd card slot if it will help your efforts at all

I remember their pc software being so terrible back in the day(would stop responding constantly) or just refusing to connect to the card most of the time

 

[turtleisaac]

I do have the hardware and someone has a reverse engineered schematic and board layout on GitHub, so in theory we can make more.

From poking around in the SLOT-2 memory a bit it looks like ARDS might upload a small firmware blob to the Trainer Toolkit's ROM address space and then uses the SRAM address space for serial communications. This is a part that would require more work I feel.

I have successfully managed to write a little program that can dump memory from the DS without using the Datel software and I haven't crashed yet, so maybe it's just the Windows program that's causing crashes?

One day in the future I do want to make some similar hardware for the DS, I just need to learn more about programmable logic and board design stuff before I can really get into this stuff. I do plan on getting a MSO at some point, maybe next year...

Do you have a link to the reverse engineered schematic/board layout on GitHub? Unfortunately google isn’t being very helpful with searches related to the datel trainer toolkit

 

[gudenau]

Do you have a link to the reverse engineered schematic/board layout on GitHub? Unfortunately google isn’t being very helpful with searches related to the datel trainer toolkit

Tada: https://github.com/Modman/REF1790-NDS-Trainer-Toolkit

 

[SylverReZ]

Could also go with the MCU firmware maybe? (but I don't think that's even allowed here).

 

[gudenau]

Could also go with the MCU firmware maybe? (but I don't think that's even allowed here).

How does the cart use it and how does one dump it?

 

[SylverReZ]

How does the cart use it and how does one dump it?

I don't have one to confirm this.

Post automatically merged: Dec 28, 2022

I've also seen that the same user posted schematics for the Action Replay/GameShark PC dongle. A nice touch to a piece of software that barely works and therefore requiring a specific version of the game for the codes to hopefully work without crashing.

 

[gudenau]

I don't have one to confirm this.

Post automatically merged: Dec 28, 2022

I've also seen that the same user posted schematics for the Action Replay/GameShark PC dongle. A nice touch to a piece of software that barely works and therefore requiring a specific version of the game for the codes to hopefully work without crashing.

Wasn't there a homebrew thing that could bootstrap the trainer?

Post automatically merged: Dec 29, 2022

To make a dump of your Trainer Toolkit, you need a Trainer Toolkit and
an Action Replay (v1.52 or higher). Boot the DS with the AR and the TT
(plugged into the PC). Launch the TT software, open the Hex View, and make a
dump of the 0x08800000~0x08800930 area.

Interesting.