Hacking DS Titles + Flashcart nonfunctional (White screen)

Joined
Jan 1, 2018
Messages
7,292
Trophies
2
XP
5,842
Country
United States
Of course, I am open to it! That's very interesting.
Good to hear! Check back tomorrow afternoon-ish eastern time (12-3pm). What's in store is not quite ready yet. Still some back-to-back bricking and unbricking to do on both my n3DSXL and niece's on long term loaned n3DS. I think I've found the perfect clean slate nvram image that should fix this DS mode brick once and for all. The last hurdle involves some gm9 scripting to create that image for a given 3DS system.

(I kinda burnt out from programming atm, lol)
 

ghjfdtg

Well-Known Member
Member
Joined
Jul 13, 2014
Messages
843
Trophies
0
XP
1,954
Country
It's noteworthy that a system format + first time setup also restores the NVRAM to a clean state. This error is just a generic one which shows up when TWL/AGB_FIRM detects anything wrong. The white screen is harder to debug and could be related to wrongly configured hardware (corruption through force poweroff or whatever).Maybe even caused by the MCU.
 
Joined
Jan 1, 2018
Messages
7,292
Trophies
2
XP
5,842
Country
United States
Oh gosh of course, and I can't thank you enough, please take as much time as you need!
  1. Download the 001skeith - NVRAM debrick test.7z archive from the link provided to you by private message. Click on the download icon.
    • NOTE: Because of some uncertainty behind this idea, I ask that you don't share or post the link for public safety. Thank you.
  2. Extract the 3ds, gm9, luma, and boot.3dsx to the root of the microSD card with 7-Zip.
  3. Insert the microSD card into the n2DSXL, turn the system on, and hold the (START) button to access GodMode9.
  4. Press (HOME) → Scripts...Create new NVRAM.bin (prototype).
    • This will make a fresh nvram.bin image found at sdmc:/3ds/3DS_NVRAMtool directory.
    • If there was any previous nvram.bin at that directory, that one will be renamed to nvram_000.bak.
  5. The script should exit GodMode9 after reading out "Booting to HOME Menu...".
  6. Open the Homebrew Launcher3DS_NVRAMtoolPress B to write nvram.bin to 3DS → press (START) to exit app.
  7. Press (HOME) → ☒ Close to exit Homebrew Launcher. Check the DS(iWare) games.
  8. If the DS(iWare) games work again, continue with creating the Nintendo DS Profile as seen in post #17.
 
Last edited by TurdPooCharger,
  • Like
Reactions: Alexander1970

001skeith

Member
OP
Newcomer
Joined
Feb 1, 2020
Messages
14
Trophies
0
Age
21
XP
40
Country
United States
  1. Download the 001skeith - NVRAM debrick test.7z archive from the link provided to you by private message. Click on the download icon.
    • NOTE: Because of some uncertainty behind this idea, I ask that you don't share or post the link for public safety. Thank you.
  2. Extract the 3ds, gm9, luma, and boot.3dsx to the root of the microSD card with 7-Zip.
  3. Insert the microSD card into the n2DSXL, turn the system on, and hold the (START) button to access GodMode9.
  4. Press (HOME) → Scripts...Create new NVRAM.bin (prototype).
    • This will make a fresh nvram.bin image found at sdmc:/3ds/3DS_NVRAMtool directory.
    • If there was any previous nvram.bin at that directory, that one will be renamed to nvram_000.bak.
  5. The script should exit GodMode9 after reading out "Booting to HOME Menu...".
  6. Open the Homebrew Launcher3DS_NVRAMtoolPress B to write nvram.bin to 3DS → press (START) to exit app.
  7. Press (HOME) → ☒ Close to exit Homebrew Launcher. Check the DS(iWare) games.
  8. If the DS(iWare) games work again, continue with creating the Nintendo DS Profile as seen in post #17.
Thank you.
After completing this, DS games/Connections still do not work. Settings is noticeably quicker to open though, and the process of turning off the system after getting the error message is much faster too. (Before, I would have to hold the power button down several times, first to shut the screen off, and then to get it to actually power off completely.)
I also checked the directory to see if the .bin has been deposited there, and it was.
 
  • Like
Reactions: Alexander1970
Joined
Jan 1, 2018
Messages
7,292
Trophies
2
XP
5,842
Country
United States
Thank you.
After completing this, DS games/Connections still do not work. Settings is noticeably quicker to open though, and the process of turning off the system after getting the error message is much faster too. (Before, I would have to hold the power button down several times, first to shut the screen off, and then to get it to actually power off completely.)
I also checked the directory to see if the .bin has been deposited there, and it was.
:(

I'm starting to believe your broken DS mode is due to a NVRAM brick but one that's hardware based where that drop you mentioned might have damaged the WiFi chip. NVRAM is basically the original DS firmware.
There's the possibility the 'clean slate' reflash values I wrote in that gm9 script's nvram.bin dump works for the n3DSXL and n3DS but not for the n2DSXL. Like what @ghjfdtg stated, performing a Format System Memory does wipe (most of) the tail end portion of the NVRAM. However, I observed a section found within block 0x1F300-1F3FF does not get erased in a system reformat where if this is left as-is, can cause the DS mode to boot with the white screens and where only the (HOME) button is responsive.

Because you noted your n2DSXL showed some improvement after the nvram.bin reflash, here's another idea to try. The instructions below is a simulated (or temporary) Format System Memory that should reset the latter section of the NVRAM to what your n2DSXL would typically create it as blank/empty state. This is again going off the assumption my n3DSXL and n3DS NVRAM empty state is different and incompatible for the n2DSXL.
  1. In GodMode9, go in the [1:] SYSNAND CTRNAND. Hold (R)-shoulder and press (X) on the data folder. Rename this folder to data2.
    • :!: Be careful! Pressing only the (X) button will bring up the delete option.
  2. Press (START) to exit GodMode9. The n2DSXL should bring up the new user setup.
  3. The NVRAM should have been reset by now in the background. Ignore creating a new profile.
  4. Turn off the n2DSXL, turn it back on, and go back to GodMode9. Press (X) on the dummy data folder to delete it. Rename data2 back to data.
  5. Boot to HOME Menu... *cross fingers*

If the last attempt doesn't pan out, we may need to continue our conversation in PM.
 
Last edited by TurdPooCharger,
  • Like
Reactions: Alexander1970

001skeith

Member
OP
Newcomer
Joined
Feb 1, 2020
Messages
14
Trophies
0
Age
21
XP
40
Country
United States
:(

I'm starting to believe your broken DS mode is due to a NVRAM brick but one that's hardware based where that drop you mentioned might have damaged the WiFi chip. NVRAM is basically the original DS firmware.
There's the possibility the 'clean slate' reflash values I wrote in that gm9 script's nvram.bin dump works for the n3DSXL and n3DS but not for the n2DSXL. Like what @ghjfdtg stated, performing a Format System Memory does wipe (most of) the tail end portion of the NVRAM. However, I observed a section found within block 0x1F300-1F3FF does not get erased in a system reformat where if this is left as-is, can cause the DS mode to boot with the white screens and where only the (HOME) button is responsive.

Because you noted your n2DSXL showed some improvement after the nvram.bin reflash, here's another idea to try. The instructions below is a simulated (or temporary) Format System Memory that should reset the latter section of the NVRAM to what your n2DSXL would typically create it as blank/empty state. This is again going off the assumption my n3DSXL and n3DS NVRAM empty state is different and incompatible for the n2DSXL.
  1. In GodMode9, go in the [1:] SYSNAND CTRNAND. Hold (R)-shoulder and press (X) on the data folder. Rename this folder to data2.
    • :!: Be careful! Pressing only the (X) button will bring up the delete option.
  2. Press (START) to exit GodMode9. The n2DSXL should bring up the new user setup.
  3. The NVRAM should have been reset by now in the background. Ignore creating a new profile.
  4. Turn off the n2DSXL, turn it back on, and go back to GodMode9. Press (X) on the dummy data folder to delete it. Rename data2 back to data.
  5. Boot to HOME Menu... *cross fingers*

If the last attempt doesn't pan out, we may need to continue our conversation in PM.

When I first started trying to figure this out, I saw a video of some guy opening up his 3ds to reseat something that would fix his ds mode error (seems like he said "Wireless card", not sure if it's the same). I considered trying it, but I just couldn't get the screws out for the life of me. Maybe it was for the best LOL.
Anyway.... I'm very sad to tell you that your lovingly crafted instructions were fruitless on my end.
 
  • Like
Reactions: Alexander1970
Joined
Jan 1, 2018
Messages
7,292
Trophies
2
XP
5,842
Country
United States
When I first started trying to figure this out, I saw a video of some guy opening up his 3ds to reseat something that would fix his ds mode error (seems like he said "Wireless card", not sure if it's the same). I considered trying it, but I just couldn't get the screws out for the life of me. Maybe it was for the best LOL.
Anyway.... I'm very sad to tell you that your lovingly crafted instructions were fruitless on my end.
Oh, that wireless card removal and reinsertion trick only works on the o3DS, o3DSXL, and o2DS (pre-2015 batch??). The n3DS, n3DSXL, newer production o2DS, and n2DSXL have their WiFi chips soldered directly to the motherboards.

***

PM sent*.
 
Last edited by TurdPooCharger,
  • Like
Reactions: Alexander1970
Joined
Jan 1, 2018
Messages
7,292
Trophies
2
XP
5,842
Country
United States
@001skeith, as promised, here's an explanation (and the reveal to others) why your DS mode is bricked. Just needed some time to photo edit stuff.

This is an example of what the NVRAM should look like for a (o/n)(2/3)DS(i)(XL/LL)(phat/lite). There are differences in the flag values between different models, but no need to get bogged down about the finer details of those.

NVRAM diagram.png


From your n2DSXL that was same day Pigeon Air Express shipped to me and returned back to you so that I could quickly examine your NVRAM with very little downtime and fast turnaround, this is what your actual NVRAM dump looks like.
001skeith_bricked_NVRAM.png

I wish I could give you some good news, but I'm afraid that won't help because of the bad news.

Bad News
The several homebrews I found that can interact with the NVRAM in any meaningful way [ 3DS_NVRAMtool / NVRAM Flash Manager / GodMode9 / Advanced DS Profile ], none of them seem able make edits to the portion between 0x00000-1F2FFF (the part that's junked). There are also [ TWLTool / Gateway 3DS NVRAM Installer / Super NDS firmware editor ], but I don't think those can be used as they either require a working DS mode or don't actually make edits directly to the onboard NVRAM.

@zoogie, I'd hate to put you on the spot, but can we get a second opinion about this? Is there any way to completely reflash the entire 128 KB of that NVRAM?


Good News... depending if the bad news can be resolved.

It's very much possible to rebuild that n2DSXL's nvram.bin image by borrowing a donor n2DSXL's nvram.bin image (for the WiFi version and other similar settings), edit in the original MAC Address (check in System SettingsInternet SettingsOther InformationConfirm MAC Address -or- GodMode9 → [2:] SYSNAND TWLN/sys/log/inspect.log), correct the CRC16 hash for that specific block, erase the rest of everything below the DS firmware header, and lastly make the empty DS Profiles 1 and 2.
 
Last edited by TurdPooCharger,

zoogie

playing around in the dsiware
Developer
Joined
Nov 30, 2014
Messages
8,297
Trophies
2
XP
13,184
Country
Micronesia, Federated States of
@001skeith, as promised, here's an explanation (and the reveal to others) why your DS mode is bricked. Just needed some time to photo edit stuff.

This is an example of what the NVRAM should look like for a (o/n)(2/3)DS(i)(XL/LL)(phat/lite). There are differences in the flag values between different models, but no need to get bogged down about the finer details of those.

View attachment 195457

From your n2DSXL that was same day Pigeon Air Express shipped to me and returned back to you so that I could quickly examine your NVRAM with very little downtime and fast turnaround, this is what your actual NVRAM dump looks like.

I wish I could give you some good news, but I'm afraid that won't help because of the bad news.

Bad News
The several homebrews I found that can interact with the NVRAM in any meaningful way [ 3DS_NVRAMtool / NVRAM Flash Manager / GodMode9 / Advanced DS Profile ], none of them seem able make edits to the portion between 0x00000-1F2FFF (the part that's junked). There are also [ TWLTool / Gateway 3DS NVRAM Installer / Super NDS firmware editor ], but I don't think those can be used as they either require a working DS mode or don't actually make edits directly to the onboard NVRAM.

@zoogie, I'd hate to put you on the spot, but can we get a second opinion about this? Is there any way to completely reflash the entire 128 KB of that NVRAM?


Good News... depending if the bad news can be resolved.

It's very much possible to rebuild that n2DSXL's nvram.bin image by borrowing a donor n2DSXL's nvram.bin image (for the WiFi version and other similar settings), edit in the original MAC Address (check in System SettingsInternet SettingsOther InformationConfirm MAC Address -or- GodMode9 → [2:] SYSNAND TWLN/sys/log/inspect.log), correct the CRC16 hash for that specific block, erase the rest of everything below the DS firmware header, and lastly make the empty DS Profiles 1 and 2.
Below 0x1f300 on wifi flash is read only by design. I suspect this user has a hardware problem if the read only data is corrupted.
Is godmode9 also showing that garbled output?
 
Joined
Jan 1, 2018
Messages
7,292
Trophies
2
XP
5,842
Country
United States
Below 0x1f300 on wifi flash is read only by design. I suspect this user has a hardware problem if the read only data is corrupted.
Is godmode9 also showing that garbled output?
Thank you for your help setting in the last missing piece to this mystery puzzle, @zoogie. :)

That would be an unfortunate yes. :(

From one of the instructions @001skeith followed in post #24, the nvram.bin image he restored was actually dumped in GodMode9 from [M:] MEMORY VIRTUAL/nvram.mem. That's a 1-to-1 copy of what 3DS_NVRAMtool extracts it as. Other than erasing everything after 0x1F300 with FF's and filling in empty DS profiles, the script I had him use left intact everything before 0x1F300.

@001skeith, you made the correct call getting another 3DS system. It still sucks your seller didn't mention he bricked the n2DSXL's DS mode. While this NVRAM hardbrick may have won this debug round, we at least now know how to spot this bug and have another good reason to try to avoid dropping our systems.
 

001skeith

Member
OP
Newcomer
Joined
Feb 1, 2020
Messages
14
Trophies
0
Age
21
XP
40
Country
United States
Thank you for your help setting in the last missing piece to this mystery puzzle, @zoogie. :)

That would be an unfortunate yes. :(

From one of the instructions @001skeith followed in post #24, the nvram.bin image he restored was actually dumped in GodMode9 from [M:] MEMORY VIRTUAL/nvram.mem. That's a 1-to-1 copy of what 3DS_NVRAMtool extracts it as. Other than erasing everything after 0x1F300 with FF's and filling in empty DS profiles, the script I had him use left intact everything before 0x1F300.

@001skeith, you made the correct call getting another 3DS system. It still sucks your seller didn't mention he bricked the n2DSXL's DS mode. While this NVRAM hardbrick may have won this debug round, we at least now know how to spot this bug and have another good reason to try to avoid dropping our systems.

Thank you guys so much for all your hard work! It's nice to be at the bottom of it, even if it can't be salvaged. ^_^^_^ I learned A LOT from this.
 

ghjfdtg

Well-Known Member
Member
Joined
Jul 13, 2014
Messages
843
Trophies
0
XP
1,954
Country
The read-only part of the flash should be writable but it requires tiny soldering™. There should be a pin on the flash responsible for hardware write protection which is either pulled high or low. I have no idea how this part of the flash can corrupt in the first place.
 
  • Like
Reactions: TurdPooCharger
Joined
Jan 1, 2018
Messages
7,292
Trophies
2
XP
5,842
Country
United States
The read-only part of the flash should be writable but it requires tiny soldering™. There should be a pin on the flash responsible for hardware write protection which is either pulled high or low. I have no idea how this part of the flash can corrupt in the first place.
This is for those who might come across a fully corrupt or hardbricked NVRAM, wishing to either replace the NVRAM chip and/or reflash the entirety of the 128 KB nvram.bin image. As time passes and the 3DS systems out there become much older (10+ years), some of us may need to resort to these repair measures due to the nature of flash storage eventually erasing itself.


(1) Digi-Key product search results for...
(2) Mouser product search results for...


For the [ o3DS / o3DSXL / o2DS (early batch) ] models, it might be easier to get a replacement WiFi module board.
NVRAM (old 3DS series).png


For the [ n3DSXL / n3DS / o2DS (later batch) / o2DSXL ] models, the location of that NVRAM chip will vary.
NVRAM (New 3DS XL).png



Close up and clear pictures of later production o2DS where the WiFi chip is baked on the motherboard are hard to find.
NVRAM (Old 2DS, baked WiFi chip).png


Again, uncertainty for the n2DSXL.
NVRAM (New 2DS XL).png
 
Last edited by TurdPooCharger,
  • Like
Reactions: KleinesSinchen

ghjfdtg

Well-Known Member
Member
Joined
Jul 13, 2014
Messages
843
Trophies
0
XP
1,954
Country
Flash can corrupt over time and lose data without touching it, yes. But we are talking 20+ years before this happens on high density NAND flash (as used in SD cards, SSDs and more). These SPI flashs probably hold their data much longer (should be stated in the datasheet how long they guarantee safe data storage).

And yeah, looks to me like the resistor is connected to ground. It's less obvious in later pictures but can be verified with a multimeter on continuity. I would not just remove the resistor but pull the pin high because floating pins can read anything due to noise.
 

Physicist_569

Member
Newcomer
Joined
Jun 8, 2012
Messages
9
Trophies
0
XP
473
Country
Hi! I just experienced the "black screen DS mode" whenever I launch Twilight Menu, DS Cartridge, DS Download Play, Nintendo DS Connections, etc. I tried NVRAM fix (https://gbatemp.net/threads/recover-ds-mode-after-an-nvram-brick-eg-after-using-a-ds-bricker.516444/), TWLFix-CFW (plus the system update), and a CTRTransfer without any success.

The weird thing is that anything DS-related ran fine without my SD Card inserted. It turns out the culprit for me was TWLPatcher, specifically the twlbg.xci file it creates within the luma/sysmodules folder. Deleting this solves everything. I think it may have been corrupted since rerunning TWLPatcher and having it create a new luma/sysmodules/twlbg.xci is ok now. :)
 
General chit-chat
Help Users
  • No one is chatting at the moment.
    Veho @ Veho: There's even a TV series.