Hacking [Idea] Gateway without two carts?

[gudenau]

Since the FPGA is upgradeable in the GW card. So we should be able to drop a copy of CN or OOT on it's sd card and it could load the rom for the normal firm. Later in the GW menu or the GW firm it could switch the card into it's 'rom mode'.

Anyone like this?

 

[Inaki]

Hehe... some days ago I thought _they_ ( GateWay themselves ) could possibly ( probably ) do that themselves with a FPGA update.

1. The GW cartridge starts in OOT or CN clone mode; that is, it acts as an original CN or OOT game cartridge ( including the gateway exploit fitted in its savegame slots ) and you can load it.
2. The FPGA in the GW cartridge waits for some "magic" request ( which could be any trigger like asking for an specific sector a given times in a row or something more hardcore like using some developer specific functionality... ).
3. When this "magic" trigger arrives, it simulates a cartridge swap and enters normal GW cartridge mode ( the mode we have all been seeing till now ).

Problems with this:

- Big issue or practical issue: the need for a way to update the cartridge FPGA. It would require an already exploited scenario ( old 3ds, original OOT or CN in new 3ds,... ). But, maaaybe, they already included a secret way of updating the FPGA by direct microSD read when the cartridge is inserted in any 3ds and just prowered on ( I mean, like in lots of devices, you put a "update.bin" in the microSD and it always checks for that file just after booting and being powered by the 3ds ).
- Legal issue and not that big: legal issue of including the original OOT or CN cartridge content ( maybe saveable by reading the rom file from the microSD card as it is done now for the backups. Maybe name it STARTUP.3DS or put it in another parition in the microSD or... whatever )
Does all this make sense guys/gals ?

 

[Nollog]

I doubt this is possible.

 

[freejak13]

I'd say it's possible but then part of gateway's featureset would include the sky3ds-like functionality of cart emulation. Not sure if gateway would be willing to 'copy' a competitor's features.

 

[gudenau]

Hehe... some days ago I thought _they_ ( GateWay themselves ) could possibly ( probably ) do that themselves with a FPGA update.

1. The GW cartridge starts in OOT or CN clone mode; that is, it acts as an original CN or OOT game cartridge ( including the gateway exploit fitted in its savegame slots ) and you can load it.
2. The FPGA in the GW cartridge waits for some "magic" request ( which could be any trigger like asking for an specific sector a given times in a row or something more hardcore like using some developer specific functionality... ).
3. When this "magic" trigger arrives, it simulates a cartridge swap and enters normal GW cartridge mode ( the mode we have all been seeing till now ).

Problems with this:

- Big issue or practical issue: the need for a way to update the cartridge FPGA. It would require an already exploited scenario ( old 3ds, original OOT or CN in new 3ds,... ). But, maaaybe, they already included a secret way of updating the FPGA by direct microSD read when the cartridge is inserted in any 3ds and just prowered on ( I mean, like in lots of devices, you put a "update.bin" in the microSD and it always checks for that file just after booting and being powered by the 3ds ).
- Legal issue and not that big: legal issue of including the original OOT or CN cartridge content ( maybe saveable by reading the rom file from the microSD card as it is done now for the backups. Maybe name it STARTUP.3DS or put it in another parition in the microSD or... whatever )
Does all this make sense guys/gals ?

You would need to have the game to get a copy. :-P (Right?)

I doubt this is possible.

Why not?

 

[jimskeet2002]

Do you think that if it was possible gateway wouldn't have done it this way instead of releasing an exploit that requires additional hardware even if they said that there won't be any need of additional hardware?

 

[freejak13]

Do you think that if it was possible gateway wouldn't have done it this way instead of releasing an exploit that requires additional hardware even if they said that there won't be any need of additional hardware?

We have no idea why gateway does what it does but the fact is, there's a chip in the gw card that can be programmed to do the same thing a sky3ds can (minus the physical button). Gateway can theoretically be programmed to operate in two modes.

 

[Nollog]

Why not?

because i doubt the gateway card has all the required bits n bobs to imitate a retail cart.

If it did, they'd probably have just been a sky instead of having all the emunand and what not from the start.

 

[gamesquest1]

i was originally thinking they would go for something like this....im thinking this is what the huge delay was probably for (looking into it time), im sure they would of at least looked into the possibility, might just be that its not wired up in a way that can function as a retail cart....could also be that its going to take a while to get it ready and this is their cartless solution plan, but its taking longer than expected to get it all set up

 

[gudenau]

Do you think that if it was possible gateway wouldn't have done it this way instead of releasing an exploit that requires additional hardware even if they said that there won't be any need of additional hardware?

I think they are a little lazy.

because i doubt the gateway card has all the required bits n bobs to imitate a retail cart.

If it did, they'd probably have just been a sky instead of having all the emunand and what not from the start.

That is how it worked at first. :-/ Is it not?

i was originally thinking they would go for something like this....im thinking this is what the huge delay was probably for (looking into it time), im sure they would of at least looked into the possibility, might just be that its not wired up in a way that can function as a retail cart....could also be that its going to take a while to get it ready and this is their cartless solution plan, but its taking longer than expected to get it all set up

Thanks! You get how hard this can be.

 

[Inaki]

jimskeet2002:
Do you think that if it was possible gateway wouldn't have done it this way instead of releasing an exploit that requires additional hardware even if they said that there won't be any need of additional hardware?

For me it would still be the logical step, I mean, they are working in something like this but, meanwhile and by now they give us the possibility to launch the GW mode by using a real OOT or CN cart. They keep working on having the GW cart simulate a real OOT or CN in the future but this step they have ( OOT and CN based exploit launching ) is needed. It is like a first milestone in their roadmap, the second milestone is getting rid of an original OOT or CN by adding the initial boot mode for their GW cart, the mode where the cart does raw reading of an OOT or CN rom from the microSD. There's that milestone 0 though, which they should have implemented in some previous firmware and the one that new GW carts should be shipping with from some time ago, the autonomous ( read: that does not require an exploit scenario ) update system where the cart detects, reads and applies an FPGA update from the microSD.

EDIT: It would make a lot of sense that they actually have that initial milestone 0 in place. For mass producing GW carts, it may be easier to have an autonomous update system than using some other method like SPI or something...

nollog:
because i doubt the gateway card has all the required bits n bobs to imitate a retail cart.

If it did, they'd probably have just been a sky instead of having all the emunand and what not from the start.

I don't see this being a reason, for them this "simulate initial original cart" mode is only a necessary step for their stuff afterwards. Also, I don't know the technical requirements and the limitations of their FPGA, but an IP for reading FAT32/exFAT seems way more complex and resource ( as in logic gates needed ) hungry than the 3ds cartridge protocol. I am speculating here and I may be wrong if there's cartridge-side crypto or others, but I doubt so.

 

[gudenau]

For me it would still be the logical step, I mean, they are working in something like this but, meanwhile and by now they give us the possibility to launch the GW mode by using a real OOT or CN cart. They keep working on having the GW cart simulate a real OOT or CN in the future but this step they have ( OOT and CN based exploit launching ) is needed. It is like a first milestone in their roadmap, the second milestone is getting rid of an original OOT or CN by adding the initial boot mode for their GW cart, the mode where the cart does raw reading of an OOT or CN rom from the microSD. There's that milestone 0 though, which they should have implemented in some previous firmware and the one that new GW carts should be shipping with from some time ago, the autonomous ( read: that does not require an exploit scenario ) update system where the cart detects, reads and applies an FPGA update from the microSD.

EDIT: It would make a lot of sense that they actually have that initial milestone 0 in place. For mass producing GW carts, it may be easier to have an autonomous update system than using some other method like SPI or something...



I don't see this being a reason, for them this "simulate initial original cart" mode is only a necessary step for their stuff afterwards. Also, I don't know the technical requirements and the limitations of their FPGA, but an IP for reading FAT32/exFAT seems way more complex and resource ( as in logic gates needed ) hungry than the 3ds cartridge protocol. I am speculating here and I may be wrong if there's cartridge-side crypto or others, but I doubt so.

Yes fat32 eould be worse than raw io, but not by to much. Then of course the 3ds files that get dumped are still encrypted.

 

[typ0]

We have no idea why gateway does what it does but the fact is, there's a chip in the gw card that can be programmed to do the same thing a sky3ds can (minus the physical button). Gateway can theoretically be programmed to operate in two modes.

Proof/source?

 

[Inaki]

Yes fat32 eould be worse than raw io, but not by to much. Then of course the 3ds files that get dumped are still encrypted.

so yeah, no cartridge-side crypto. I mean that doing the 3ds cart protocol, with the exception of the security handshake part ( which sky3ds knows, at least to a needed extent, although maybe not perfect ), is probably easier/smaller than reading files from the microSD and other things the GW FPGA does.

 

[gudenau]

Proof/source?

The FPGA update process. Look it up. ;-)

 

[typ0]

The FPGA update process. Look it up. ;-)

This implies that the actual GW Red card can be flashed to give the exact same function the Sky3DS cart has. Nothing else needed/no changes to any of the card whatsoever?

 

[gudenau]

This implies that the actual GW Red card can be flashed to give the exact same function the Sky3DS cart has. Nothing else needed/no changes to any of the card whatsoever?

Yep, this is how it used to work.

 

[Inaki]

The FPGA update process. Look it up. ;-)

That milestone 0 I spoke about, the autonomous update process, would require file reading from the microSD ( which they already have for normal rom loading ) and working on its own. Maybe blinking the led while flashing and turning it on or off when finished, or changing color...

 

[gudenau]

That milestone 0 I spoke about, the autonomous update process, would require file reading from the microSD ( which they already have for normal rom loading ) and working on its own. Maybe blinking the led while flashing and turning it on or off when finished, or changing color...

I feel that may not be possable... But you should have the retail cart in the first place.
I do not know that much about fpga though.

 

[Nollog]

Maybe 6 months from now, maybe more given the time zone gateway are in (soon), they'll probably make a gateway plus or new gateway or something that does this.