HaxxStation: DS Download Station exploit



13 years.

The original DS was released in 2004, and to this day, no hax for Download Play had been made.

Until now.

Gericom found an exploit in DS Download Station, allowing us to run any homebrew we'd like over DS download play.

Source code for dspatch: https://github.com/Gericom/dspatch

Enjoy!

Credits:
Exploit: shutterbug2000, Gericom, and Apache Thunder
Graphics: Jaames, Robz8

And if you want to load unsupported flashcarts on a DSi:

Yes.
Here's Apache Thunder's flashcard launchers edited for HaxxStation. @shutterbug2000 should put this in the first post.
https://www.odrive.com/s/23b9f39c-ae15-4c1b-8ff7-64344fa6f2d2-5939fc7f
 

Attachments

  • dspatch.zip
    19.4 KB · Views: 2,284
  • dspatchv1.1.zip
    19.8 KB · Views: 1,726
Last edited by shutterbug2000,

FIX94

Former Staff
Former Staff
Joined
Dec 3, 2009
Messages
7,284
Trophies
0
Age
30
Location
???
XP
11,248
Country
Germany
Just as a little update to the wii thing, I've spent the last few days REing the ds download station to get an idea of whats going on and now that things are a bit more documented in it I wrote a series of ARM9 patches that allowed me to dump all the data the station sends out onto my gba ram expansion, to accompany that patch I wrote a little program that executed right when I soft reset my flashcart, that then dumped the contents of the ram onto my flashcart sd so now I have a full send cycle worth of data to go through, probably will take me quite a bit but hey, progress :)
 

jerbear64

Well-Known Member
Member
Joined
Dec 10, 2011
Messages
304
Trophies
1
Age
24
XP
381
Country
United States
Just as a little update to the wii thing, I've spent the last few days REing the ds download station to get an idea of whats going on and now that things are a bit more documented in it I wrote a series of ARM9 patches that allowed me to dump all the data the station sends out onto my gba ram expansion, to accompany that patch I wrote a little program that executed right when I soft reset my flashcart, that then dumped the contents of the ram onto my flashcart sd so now I have a full send cycle worth of data to go through, probably will take me quite a bit but hey, progress :)
So if what you're doing is essentially making a reimplementation of the Download Station, would that mean we can theoretically make a version of HaxxStation for the DS as a standalone homebrew rather than needing a Download Station ROM?
 

FIX94

Former Staff
Former Staff
Joined
Dec 3, 2009
Messages
7,284
Trophies
0
Age
30
Location
???
XP
11,248
Country
Germany
So if what you're doing is essentially making a reimplementation of the Download Station, would that mean we can theoretically make a version of HaxxStation for the DS as a standalone homebrew rather than needing a Download Station ROM?
you will still require the rom because it contains the station client signed by nintendo, thats the entry point to all this.
 
D

Deleted User

Guest
Question about the flashcart Launchers: Are those only to load a flashcart in slot-1? or is there more I don't know?
 

FIX94

Former Staff
Former Staff
Joined
Dec 3, 2009
Messages
7,284
Trophies
0
Age
30
Location
???
XP
11,248
Country
Germany
After countless hours trying to get the wii thing any further I decided yesterday to write a patch for the station client to dump its send/receive buffers and realized that while the first bit of menu data always was received fine, no blocks at all afterwards came in and it sat there waiting forever even though I send the exact same data as the station server. Now I've spent a silly amount of time trying all sorts of combinations, buffers, wireless settings and FINALLY found what was causing it: a single byte not being set when sending the next data block, thus the wireless driver thought it always was old data and ignored it :rolleyes:
yep, this was received directly from my wii.
HNI_0051.jpg
Now I just hope sending actual ROMs goes smoothly, if not I can always go debug crazy again, these patches go quite in depth. If I get that done then the idea of sending unsigned DS ROMs to any DS via a wii/wiiu should be fully realized.
 

eduall

Well-Known Member
Member
Joined
May 29, 2014
Messages
568
Trophies
0
XP
1,662
Country
Venezuela
After countless hours trying to get the wii thing any further I decided yesterday to write a patch for the station client to dump its send/receive buffers and realized that while the first bit of menu data always was received fine, no blocks at all afterwards came in and it sat there waiting forever even though I send the exact same data as the station server. Now I've spent a silly amount of time trying all sorts of combinations, buffers, wireless settings and FINALLY found what was causing it: a single byte not being set when sending the next data block, thus the wireless driver thought it always was old data and ignored it :rolleyes:
yep, this was received directly from my wii.
HNI_0051.jpg
Now I just hope sending actual ROMs goes smoothly, if not I can always go debug crazy again, these patches go quite in depth. If I get that done then the idea of sending unsigned DS ROMs to any DS via a wii/wiiu should be fully realized.

Amazing ! :bow::bow:
 

FIX94

Former Staff
Former Staff
Joined
Dec 3, 2009
Messages
7,284
Trophies
0
Age
30
Location
???
XP
11,248
Country
Germany
So, some more updates following up the menu stuff from yesterday.
Sending over files is just the same as sending over that menu data so that part was quite easy, the REAL problem though is consistency, sending things to the ds bios itself never was a problem thanks to it sending a "OK" response with the package number inside so you were sure to never miss a package.
The download station client on the other hand NEVER sends out any "OK" response or package number, meaning yesterday in the span of probably 6 hours trying to get a game sent I was able to get the tetris ds demo sent over like, twice. Oh and that was with sending one package up to 10 times, made each send take a good 10 minutes and still nearly always had it fail with 99.xx% being received, thanks wii wifi chip for being so inconsistent.
Now today I started implementing several indirect checks such as making sure after each send I get a "keep alive" message from the ds as well as a vsync happening and making sure the wii itself did not give me any error directly after sending a package, with all those changes I now pushed down each package to only be sent 3 times, pushing down send time of tetris ds to 3 minutes and over the span of the last 25 minutes of testing this with 3 different ds systems I was able to send over the demo 6 times so I think I am on the right track, hopefully I can somehow make it faster still by at least a little bit, though I fear it will just end up taking quite a bit to send over things and I cant do anything about it because the wii wifi chip is just not as good as the ds ones for this type of stuff.
 

eduall

Well-Known Member
Member
Joined
May 29, 2014
Messages
568
Trophies
0
XP
1,662
Country
Venezuela
So, some more updates following up the menu stuff from yesterday.
Sending over files is just the same as sending over that menu data so that part was quite easy, the REAL problem though is consistency, sending things to the ds bios itself never was a problem thanks to it sending a "OK" response with the package number inside so you were sure to never miss a package.
The download station client on the other hand NEVER sends out any "OK" response or package number, meaning yesterday in the span of probably 6 hours trying to get a game sent I was able to get the tetris ds demo sent over like, twice. Oh and that was with sending one package up to 10 times, made each send take a good 10 minutes and still nearly always had it fail with 99.xx% being received, thanks wii wifi chip for being so inconsistent.
Now today I started implementing several indirect checks such as making sure after each send I get a "keep alive" message from the ds as well as a vsync happening and making sure the wii itself did not give me any error directly after sending a package, with all those changes I now pushed down each package to only be sent 3 times, pushing down send time of tetris ds to 3 minutes and over the span of the last 25 minutes of testing this with 3 different ds systems I was able to send over the demo 6 times so I think I am on the right track, hopefully I can somehow make it faster still by at least a little bit, though I fear it will just end up taking quite a bit to send over things and I cant do anything about it because the wii wifi chip is just not as good as the ds ones for this type of stuff.

one word: amazig!
Thanks Fix64 for this news!
 

eduall

Well-Known Member
Member
Joined
May 29, 2014
Messages
568
Trophies
0
XP
1,662
Country
Venezuela
So, some more updates following up the menu stuff from yesterday.
Sending over files is just the same as sending over that menu data so that part was quite easy, the REAL problem though is consistency, sending things to the ds bios itself never was a problem thanks to it sending a "OK" response with the package number inside so you were sure to never miss a package.
The download station client on the other hand NEVER sends out any "OK" response or package number, meaning yesterday in the span of probably 6 hours trying to get a game sent I was able to get the tetris ds demo sent over like, twice. Oh and that was with sending one package up to 10 times, made each send take a good 10 minutes and still nearly always had it fail with 99.xx% being received, thanks wii wifi chip for being so inconsistent.
Now today I started implementing several indirect checks such as making sure after each send I get a "keep alive" message from the ds as well as a vsync happening and making sure the wii itself did not give me any error directly after sending a package, with all those changes I now pushed down each package to only be sent 3 times, pushing down send time of tetris ds to 3 minutes and over the span of the last 25 minutes of testing this with 3 different ds systems I was able to send over the demo 6 times so I think I am on the right track, hopefully I can somehow make it faster still by at least a little bit, though I fear it will just end up taking quite a bit to send over things and I cant do anything about it because the wii wifi chip is just not as good as the ds ones for this type of stuff.

one word: amazig!
Thanks Fix64 for this news!
 

Luglige

hiatus
Member
Joined
Jan 24, 2016
Messages
1,414
Trophies
1
Location
under your bed
XP
883
Country
Antarctica
My head is broken now but I am finally done with the whole wii thing, now HaxxStation can be used directly from my little homebrew sender.
https://github.com/FIX94/wii-ds-rom-sender/releases/tag/v2.0
It may not be as fast as sending a file directly but at least it works which was hard enough.
Good sir, you understand this more than I do, what does this do and how do I make this work? Without a flashcart?

oh yeah btw that looks good.
 
Last edited by Luglige,

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • BigOnYa @ BigOnYa:
    I only watch tv when i goto bed, it puts me to sleep, and I have a nas drive filled w my fav shows so i can watch them in order, commercial free. I usually watch Married w Children, or South Park
  • K3Nv2 @ K3Nv2:
    Stremio ruined my need for nas
  • BigOnYa @ BigOnYa:
    I stream from Nas to firestick, one on every tv, and use Kodi. I'm happy w it, plays everything. (I pirate/torrent shows/movies on pc, and put on nas)
  • K3Nv2 @ K3Nv2:
    Kodi repost are still pretty popular
  • BigOnYa @ BigOnYa:
    What the hell is Kodi reposts? what do you mean, or "Wut?" -xdqwerty
  • K3Nv2 @ K3Nv2:
    Google them basically web crawlers to movie sites
  • BigOnYa @ BigOnYa:
    oh you mean the 3rd party apps on Kodi, yea i know what you mean, yea there are still a few cool ones, in fact watched the new planet of the apes movie other night w wifey thru one, was good pic surprisingly, not a cam
  • BigOnYa @ BigOnYa:
    Damn, only $2.06 and free shipping. Gotta cost more for them to ship than $2.06
    +1
  • BigOnYa @ BigOnYa:
    I got my Dad a firestick for Xmas and showed him those 3rd party sites on Kodi, he loves it, all he watches anymore. He said he has got 3 letters from AT&T already about pirating, but he says f them, let them shut my internet off (He wants out of his AT&T contract anyways)
  • K3Nv2 @ K3Nv2:
    That's where stremio comes to play never got a letter about it
  • BigOnYa @ BigOnYa:
    I just use a VPN, even give him my login and password so can use it also, and he refuses, he's funny.
  • BigOnYa @ BigOnYa:
    I had to find and get him an old style flip phone even without text, cause thats what he wanted. No text, no internet, only phone calls. Old, old school.
  • Psionic Roshambo @ Psionic Roshambo:
    @BigOnYa, Lol I bought a new USB card reader thing on AliExpress last month for I think like 87 cents. Free shipping from China... It arrived it works and honestly I don't understand how it was so cheap.
    +1
  • BakerMan @ BakerMan:
    fellas
  • BakerMan @ BakerMan:
    would you rather have a 9-5 desk job with poor pay or work for an intergalactic space militia with no guarantee of being paid?
  • BakerMan @ BakerMan:
    basically, normal boring job or halo and/or helldivers irl
  • SylverReZ @ SylverReZ:
    Lol. Have you heard about this?
  • SylverReZ @ SylverReZ:
    I wish the people who make these emulators know the basic primer course on copyright and trademarks.
  • NecroNova @ NecroNova:
    Speaking of emulators, i now have a more genuine use for my 3DS after Artic Base released
  • S @ salazarcosplay:
    How are yall doing
    S @ salazarcosplay: How are yall doing