How does original R4 DS auto-boots?

Discussion in 'NDS - Flashcarts and Accessories' started by Sonic0509, Aug 18, 2016.

  1. Sonic0509
    OP

    Sonic0509 Sometimes I'm Maryushi3

    Member
    180
    8
    Feb 1, 2008
    Poland
    Poland
    After hacking my 2DS and getting my beloved original R4DS to work again I finally returned to 2DS' home menu, and to my surprise something in game card slot icon appeared. Actually it appeared blank but detected something is inside (probably since thanks to CFW blocked flashcards are not blocked anymore). However trying to run it just left me with an error forcing to turn off the console. This made me think... how does the R4 makes the original DS and DSL autoboot into it? Is it some kind of icon exploit (like bannerbomb for Wii), is DS vulnerable to something like a game title exploit or is it something else completely?

    So there I am, asking this what seems like not so stupid question. How does original R4DS achieves auto-booting (and why doesn't it work that way on hacked 3DS)?
     
  2. Alex658

    Alex658 GBAtemp Maniac

    Member
    1,150
    340
    Jun 4, 2010
    Venezuela
    Venezuela
    IIRC the original set of flashcarts for DS phat/lite like R4, M3, N5, DSTT and other clones took advantage of a flaw in the DS original firmware (acted as an improved PASSme) which lead it to autoload.

    This would no longer work on DSi and 3ds since now the system asks for a bootloader (a game's name and last name/developer info) before let it be recognized or booting if this info is not valid or complete.

    Feel free to correct me though
     
  3. Sonic0509
    OP

    Sonic0509 Sometimes I'm Maryushi3

    Member
    180
    8
    Feb 1, 2008
    Poland
    Poland
    Thanks for replying! :)
    It seems like you're right about it working like a passcard, since it adds up quite well with this paragraph from an article I've found thanks to you giving a lead about the PASSme :D
    In case someone else wants to know but also wants tl;dr version: It's possible to modify a NDS game's header (icon, title, publisher. year) so that it points to another location (outside the space intended for the header) containing some code to execute. As for R4 (and probably most clones), it looks like the header contains just the bare minimum needed to make DS run code stored on it.

    Now, I assume that it doesn't work on 3DS the normal way because the code header points to is not executed from the same location as "normal" NDS code that would run after selecting an icon from DS' menu. But this one is just one huge
    assumption.
     
  4. Swiftloke

    Swiftloke Hwaaaa!

    Member
    1,770
    1,516
    Jan 26, 2015
    United States
    Nowhere
    Really? That's very interesting! No wonder the original r4 has an invalid header! I'll go read the article, I was wondering this too. Thanks! :D
     
    Sonic0509 likes this.
  5. FAST6191

    FAST6191 Techromancer

    pip Reporter
    23,342
    9,124
    Nov 21, 2005
    It is simpler than that
    http://problemkaputt.de/gbatek.htm#dscartridgeheader
    Header Overview (loaded from ROM Addr 0 to Main RAM 27FFE00h on Power-up)
    Address Bytes Expl.
    01Fh 1 Autostart (Bit2: Skip "Press Button" after Health and Safety)
    (Also skips bootmenu, even in Manual mode & even Start pressed)

    Basically it, and several other DS flash carts, used a sort of undocumented or at least unused in commercial games (maybe it was a device check/repair cart thing) feature of the DS firmware.

    If you want to read more on the overlay bait and switch used by DS flash carts with DSi and 3ds compatibility (at least until save checks came along)
    https://hackmii.com/2010/02/lawsuit-coming-in-3-2-1/

    Also of passing interest
    http://pineight.com/ds/pass/
    I should note that smea did a little proof of concept DS exploit using a DS game that took in audio a while back
     
    Technicmaster0 and Sonic0509 like this.
  6. Swiftloke

    Swiftloke Hwaaaa!

    Member
    1,770
    1,516
    Jan 26, 2015
    United States
    Nowhere
    Hmmm. I'll be reading all those links. Thanks!
     
  7. Sonic0509
    OP

    Sonic0509 Sometimes I'm Maryushi3

    Member
    180
    8
    Feb 1, 2008
    Poland
    Poland
    I can't believe it's just literally 2 bits (or even a single bit if you look at it right) that makes it all possible.

    I've read all those links. It's bit too late for me (1:20 am at time of writing this post) to understand completely all the technical aspects but I can't say it wasn't a fun read. Thanks so much :D

    But still one question remains: why won't 3DS boot autobooting R4 cartridge normally even when it's whitelisted (or not blacklisted... I'm never sure how it works in 3DS' case)? Could it be that (like @Alex658 said) 3DS expects fully correct/proper header (completely ignoring the autoboot flag) or just flips off every autobooting cartridge, or maybe R4 autoboots different code than selecting it from menu would?
    Any idea if there is an autobooting flashcard that also has a proper header?


    Also, that sound exploit... Smealum is just an insane guy :wtf:


    Oh, and one more thing. Thank you so much for replying to this thread. I expected to get "if it werks it werks" kind of answers ^_^


    And another thing. It seems like R4 is getting pretty "powerful" in 3DS scene (insert :yayR4: here)
     
    Last edited by Sonic0509, Aug 19, 2016
  8. Technicmaster0

    Technicmaster0 GBAtemp Psycho!

    Member
    3,055
    627
    Oct 22, 2011
    Gambia, The
    I think that it I read somewhere that it was used for Demo/debug cards.

    It's really simple. Every DS ROM (and therefor every flashcard as well) has it's own header (later official headers got copied to get compatible with DSi/3DS). The console reads the header before it boots the game to get the information like the icon, the text etc. There's one bit, one information in the header that you can change so that the card autoboots. It was used by nintendo itself and is no exploit/bug.
    This feature doesn't work with DSi/3DS anymore because the flashcards have to copy the headers of official games which don't have the feature enabled.