FIXED!!! Investigating Wood 1.62 NAND save problems

davidmorom

Active Member
OP
Newcomer
Joined
Mar 24, 2017
Messages
31
Trophies
0
Age
37
XP
217
Country
Update: the file "Ace3DS+ R4iLS Clones Wood Kernel 1.62.rar" now also contains a patched "_DS_MENU.DAT" for orginal Ace3DS+. THIS IS UNTESTED, as I don't have an original Ace3DS+, but it should work, the code is really the same.

Problem Fixed!!!

After thinking a lot on this, I took a look at the Wood 1.25 open source code, and this gave me an idea on where the problem could be. I decoded the kernel (_DSMENU.DAT) using r4denc.exe and disassembled it with ndsdis2.exe. After a lot of trial an error (a LOT LOT), I just found the instruction responsible of generating the wrong addresses. It's a simple "mov r6,#0x9" that needs to be changed to "mov r6,#0x0". This "#0x9" is used a bit later in the code to shift the sector address 9 bits to the left (same as multiplying by 512), which is totally unneeded and breaks game compatibility. After modifying the instruction, the shift is not executed, and Wario Ware D.I.Y and Jam with the Band work and save the game flawlessly, as they are suppossed to be.

I want to share the modified kernel for the two flashcarts I own, Blue Gateway and Ace3DS+ R4iLS Aliexpress Clone (as this card is referenced in https://github.com/DS-Homebrew/flashcard-archive):

GW.jpg
ACE.jpg

If anyone has one of these two flashcarts (or another similar variant) and is interested in trying it, it would be nice to see if it works. If you have a similar flashcart that uses another Wood variation and these files don't work for you, please PM me with your kernel, and I can try to apply the same patch, providing the kernel is similar enough (very likely).

I hope this is useful for anyone.

Original post

As I have several Ace3DS+ clones and a Blue Gateway, I have been investigating the issue Wood 1.62 has with the two games that use NAND save type, Wario Ware D.I.Y and Jam with the Band. I know this two games work fine trough Twilight Menu and nds-bootstrap, but I think it would be great if they also work natively.

This is what I have found so far:

Wood 1.62 have specific code for dealing with NAND save type, and despite the fact that it is severely flawed, it kinda works. When you run one of these two games by first time, the kernel creates an empty 32MB sav file, and an 256KB sav.fix file, which is the interesting one.

This sav.fix file contains a list of 32 bits integers, that point to the address of every 512-byte block of the sav file on the SD card. The problem is that this pointers are byte pointers, but when they are used to access the actual save file, they are used as 512-bytes block pointers, thus the real accessed addresses are wrong.

If very specific conditions are met, these games can work and save just fine:

  • The 32MB save file must be allocated at a very low sector count, so its starting position multiplied by 512 fits inside the SD card
  • The SD card must be big enough so that the wrong sav file starting position, plus the effective save size (8MB for Jam, 16MB for Wario), multiplied by 512, still fits inside the card

If both conditions are met the game will run and save fine, but with a very important consideration: the save will not be written to the 32MB sav file, but to disperse sectors along the SD card instead. Because of this, you cannot have more games in the card, as you take the risk that they become partially overwritten when Wario or Jam save the game.

Taking previous information into account, the games can be guaranteed to work on a 32GB or bigger SD card by following these directions:

  • Format the SD card in FAT32
  • Create an empty 32MB file with the same name as the ROM, but with sav extension. It's mandatory to be the first file copied, so it is allocated at a very low sector
  • Copy the kernel of the flashcart
  • Copy the Wario or Jam ROM file, just one of them, with the same name as the previous save file
  • Do not copy more games, as there is a big chance they get corrupted when Wario or Jam saves the game

At this point, is obvious that the solution would be to write sector addresses instead of byte addresses into the sav.fix file. I tried to modify the file, but it is regenerated every time the game is launched. I also tried to mark it as read only, but then the kernel throws an error about not enough free space and refuses to launch the game.

The only solution would be to modify the kernel itself, so correct values are written to the sav.fix file. Unfortunately, as far as I know, we don't have the source code of this specific Wood variant, and I don't have the necessary skills nor tools to debug the machine code.

So I leave here this information just in case is useful for anyone trying to run the games, or anyone with the necessary skills to investigate it deeper.

It is very sad we still don't have an updated open source version of Wood, with 100% ROM compatibility and capable to run on all known clones and variants.
 

Attachments

  • Blue Gateway Wood Kernel 1.62.rar
    3.3 MB · Views: 7
  • Ace3DS+ R4iLS Clones Wood Kernel 1.62.rar
    4 MB · Views: 8
Last edited by davidmorom,

Kaoid

Kai
Member
Joined
Feb 29, 2012
Messages
168
Trophies
1
XP
557
Country
United Kingdom
This is really impressive, you've fixed a game a lot of people with R4iLS clones couldn't play (without involving nds-boostrap) :)

In regards to the archive, once its been confirmed to be stable and not have broken other games, your version will likely replace the one on the archive (along with a possible port to the EX4 Flashcart).
 

davidmorom

Active Member
OP
Newcomer
Joined
Mar 24, 2017
Messages
31
Trophies
0
Age
37
XP
217
Country
Thanks for your replies. It was a very stupid bug, indeed. I don't understand how the original developers didn't fix it back then. It seems like this whole wood kernel thing is a VERY big mess, with a lot of versions, variations, clones...
 
  • Like
Reactions: stl25

davidmorom

Active Member
OP
Newcomer
Joined
Mar 24, 2017
Messages
31
Trophies
0
Age
37
XP
217
Country
Comes from no where, fixes long standing issue, posts solution, post even packages, reports to get topic marked as "Solved".

View attachment 453001

:rofl2::rofl2::rofl2:

At first, I identified the problem, but I didn't think I was able to solve it, not at least without the source code, as my ARM knowledge and DS debugging capabilities are absolutely zero. But thinking about it, some ideas came to my mind. In the end, I was very lucky that it was a very simple fix.
 
  • Like
Reactions: linuxares

linuxares

The inadequate, autocratic beast!
Global Moderator
Joined
Aug 5, 2007
Messages
13,774
Trophies
3
XP
19,183
Country
Sweden
:rofl2::rofl2::rofl2:

At first, I identified the problem, but I didn't think I was able to solve it, not at least without the source code, as my ARM knowledge and DS debugging capabilities are absolutely zero. But thinking about it, some ideas came to my mind. In the end, I was very lucky that it was a very simple fix.
So you're the hero we needed, but didn't deserve. Check!
 

Kaoid

Kai
Member
Joined
Feb 29, 2012
Messages
168
Trophies
1
XP
557
Country
United Kingdom
I have found one bug so far. The R4TF.nds file used for resetting from moonshell 2 back to the Wood firmware, it still works but upon reset the wood r4 theme/assets are not loaded, causing all the screen to be mainly black. This doesn't occur on the unpatched Wood R4 for R4iLS.

It's not a big deal, and the official kernel doesn't include this soft reset file, but could be interesting to look at.

EDIT: Used the Ace3DS+ .dat for reset by mistake, all good now. I have also tested several other games and they all appear to work fine.
 
Last edited by Kaoid,

charlieSIGMA

Member
Newcomer
Joined
Aug 13, 2007
Messages
9
Trophies
1
XP
300
Country
Brazil
Tried this on an Ace3DS X purchased in July 2024 on a New 3DS XL and it works.

I also carried my save from my r4ids.cn R4i gold 3DS RTS to the Ace 3DS X and the save is patched and continues working.
 

davidmorom

Active Member
OP
Newcomer
Joined
Mar 24, 2017
Messages
31
Trophies
0
Age
37
XP
217
Country
I have found one bug so far. The R4TF.nds file used for resetting from moonshell 2 back to the Wood firmware, it still works but upon reset the wood r4 theme/assets are not loaded, causing all the screen to be mainly black. This doesn't occur on the unpatched Wood R4 for R4iLS.

It's not a big deal, and the official kernel doesn't include this soft reset file, but could be interesting to look at.

EDIT: Used the Ace3DS+ .dat for reset by mistake, all good now. I have also tested several other games and they all appear to work fine.
Good to know! Anyway, I've modified your "R4TF.nds" to load "_DSMENU.DAT" instead of "_DS_MENU.DAT", so you don't need to have both files, which I think was the origin of your mistake. Use it if you like.
 

Attachments

  • R4TF (loads _DSMENU.DAT).zip
    37 KB · Views: 7

ghjfdtg

Well-Known Member
Member
Joined
Jul 13, 2014
Messages
1,425
Trophies
2
XP
3,508
Country
Did you test this with a microSD 2 GB or smaller? The reason i ask is because they use byte addressing instead of sectors (but usually still use 512 bytes granularity of access).
 
  • Like
Reactions: 4d1xlaan

davidmorom

Active Member
OP
Newcomer
Joined
Mar 24, 2017
Messages
31
Trophies
0
Age
37
XP
217
Country
Did you test this with a microSD 2 GB or smaller? The reason i ask is because they use byte addressing instead of sectors (but usually still use 512 bytes granularity of access).
Yes, I did, and it works too. It was one of the first things I tried, indeed, because I thought the same as you (by the way, is there anoyone still using 2GB or less SDs with this flashcarts?).

The original code is designed to only shift the sectors numbers when an non SDHC card is used, but for whatever reason it shifts them always. But these games don't even work fine on the original kernel when using a non SDHC card, because the "sav.fix" file is mean to always content sector numbers. The 9 bits shift is done at runtime, only when a non SDHC card is used. In fact, if you use a non SDHC card with the original kernel, two 9 bits shifts are applied, one when generating the "sav.fix" file and another one at runtime, which produces an overflow in the address, an generates totally unexpected results. I tested this deeply before I tried to patch the kernel.

I think the original developers, at some time, refactored the way they manage the difference between SD and SDHC, but forgot to change this part of the code. Who knows.

You can check this github issue I posted a moment ago if you want further details:
https://github.com/DS-Homebrew/flashcard-archive/issues/36
 
  • Like
Reactions: 4d1xlaan

BETA215

Member not found
Member
Joined
Dec 30, 2014
Messages
413
Trophies
0
Location
they/them | 0xDEAD brain
XP
2,020
Country
Argentina
We should bully the WOOD dev to open-source it. (playfully, not harmfully)
No way. Unless you want to burn the few bridges that are still present, it isn't a topic to discuss with whoever might still be around us from that team. There's a reason why it stopped being open source, and why they seem to still haven't changed their mind years and years later.

Just recently EZ-Flash took Wood R4 and modified it for their own flashcard (such a terrible execution, it's so incredibly bad). Chinese manufacturers can't stop milking the dead cow Wood R4 is, whether with the clones (some even include a Wood4TT kernel in their flashcards that doesn't even works) or this now recently released flashcard. So convincing them of making the last version open source seems something pretty far from happening.

Again, I'm all in for making it open source, I want it too. Sometimes you just gotta do what you can, and see if things change someday.
 

ICCAFSN

Member
Newcomer
Joined
May 28, 2007
Messages
12
Trophies
1
Website
Visit site
XP
261
Country
United States
Very nice work! I tested this out on my AliExpress Ace3DS+ clone using the _DS_MENU.DAT file. I only tried it out with WarioWare DIY, but saving works correctly for me now. Thanks!
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    K3Nv2 @ K3Nv2: https://youtube.com/shorts/jDY79X0ESXo?si=1kdsMxCD8lekNzVF +1