Hacking [Idea] Gateway without two carts?

gudenau

Largely ignored
OP
Member
Joined
Jul 7, 2010
Messages
3,822
Trophies
1
Location
/dev/random
Website
www.gudenau.net
XP
4,171
Country
United States
Since the FPGA is upgradeable in the GW card. So we should be able to drop a copy of CN or OOT on it's sd card and it could load the rom for the normal firm. Later in the GW menu or the GW firm it could switch the card into it's 'rom mode'.

Anyone like this?
 
  • Like
Reactions: Inaki

Inaki

Well-Known Member
Member
Joined
Jan 23, 2014
Messages
278
Trophies
0
Age
41
XP
564
Country
Hehe... some days ago I thought _they_ ( GateWay themselves ) could possibly ( probably ) do that themselves with a FPGA update.

1. The GW cartridge starts in OOT or CN clone mode; that is, it acts as an original CN or OOT game cartridge ( including the gateway exploit fitted in its savegame slots ) and you can load it.
2. The FPGA in the GW cartridge waits for some "magic" request ( which could be any trigger like asking for an specific sector a given times in a row or something more hardcore like using some developer specific functionality... ).
3. When this "magic" trigger arrives, it simulates a cartridge swap and enters normal GW cartridge mode ( the mode we have all been seeing till now ).

Problems with this:

- Big issue or practical issue: the need for a way to update the cartridge FPGA. It would require an already exploited scenario ( old 3ds, original OOT or CN in new 3ds,... ). But, maaaybe, they already included a secret way of updating the FPGA by direct microSD read when the cartridge is inserted in any 3ds and just prowered on ( I mean, like in lots of devices, you put a "update.bin" in the microSD and it always checks for that file just after booting and being powered by the 3ds ).
- Legal issue and not that big: legal issue of including the original OOT or CN cartridge content ( maybe saveable by reading the rom file from the microSD card as it is done now for the backups. Maybe name it STARTUP.3DS or put it in another parition in the microSD or... whatever )
Does all this make sense guys/gals ?
 

freejak13

Well-Known Member
Newcomer
Joined
Jan 30, 2006
Messages
76
Trophies
0
XP
254
Country
United States
I'd say it's possible but then part of gateway's featureset would include the sky3ds-like functionality of cart emulation. Not sure if gateway would be willing to 'copy' a competitor's features.
 

gudenau

Largely ignored
OP
Member
Joined
Jul 7, 2010
Messages
3,822
Trophies
1
Location
/dev/random
Website
www.gudenau.net
XP
4,171
Country
United States
Hehe... some days ago I thought _they_ ( GateWay themselves ) could possibly ( probably ) do that themselves with a FPGA update.

1. The GW cartridge starts in OOT or CN clone mode; that is, it acts as an original CN or OOT game cartridge ( including the gateway exploit fitted in its savegame slots ) and you can load it.
2. The FPGA in the GW cartridge waits for some "magic" request ( which could be any trigger like asking for an specific sector a given times in a row or something more hardcore like using some developer specific functionality... ).
3. When this "magic" trigger arrives, it simulates a cartridge swap and enters normal GW cartridge mode ( the mode we have all been seeing till now ).

Problems with this:

- Big issue or practical issue: the need for a way to update the cartridge FPGA. It would require an already exploited scenario ( old 3ds, original OOT or CN in new 3ds,... ). But, maaaybe, they already included a secret way of updating the FPGA by direct microSD read when the cartridge is inserted in any 3ds and just prowered on ( I mean, like in lots of devices, you put a "update.bin" in the microSD and it always checks for that file just after booting and being powered by the 3ds ).
- Legal issue and not that big: legal issue of including the original OOT or CN cartridge content ( maybe saveable by reading the rom file from the microSD card as it is done now for the backups. Maybe name it STARTUP.3DS or put it in another parition in the microSD or... whatever )
Does all this make sense guys/gals ?

You would need to have the game to get a copy. :-P (Right?)

I doubt this is possible.

Why not?
 

jimskeet2002

Well-Known Member
Member
Joined
Jan 8, 2009
Messages
492
Trophies
0
XP
413
Country
Greece
Do you think that if it was possible gateway wouldn't have done it this way instead of releasing an exploit that requires additional hardware even if they said that there won't be any need of additional hardware?
 
  • Like
Reactions: omegart

freejak13

Well-Known Member
Newcomer
Joined
Jan 30, 2006
Messages
76
Trophies
0
XP
254
Country
United States
Do you think that if it was possible gateway wouldn't have done it this way instead of releasing an exploit that requires additional hardware even if they said that there won't be any need of additional hardware?

We have no idea why gateway does what it does but the fact is, there's a chip in the gw card that can be programmed to do the same thing a sky3ds can (minus the physical button). Gateway can theoretically be programmed to operate in two modes.
 

gamesquest1

Nabnut
Global Moderator
Joined
Sep 23, 2013
Messages
15,153
Trophies
2
XP
12,226
i was originally thinking they would go for something like this....im thinking this is what the huge delay was probably for (looking into it time), im sure they would of at least looked into the possibility, might just be that its not wired up in a way that can function as a retail cart....could also be that its going to take a while to get it ready and this is their cartless solution plan, but its taking longer than expected to get it all set up
 

gudenau

Largely ignored
OP
Member
Joined
Jul 7, 2010
Messages
3,822
Trophies
1
Location
/dev/random
Website
www.gudenau.net
XP
4,171
Country
United States
Do you think that if it was possible gateway wouldn't have done it this way instead of releasing an exploit that requires additional hardware even if they said that there won't be any need of additional hardware?

I think they are a little lazy.


because i doubt the gateway card has all the required bits n bobs to imitate a retail cart.

If it did, they'd probably have just been a sky instead of having all the emunand and what not from the start.

That is how it worked at first. :-/ Is it not?


i was originally thinking they would go for something like this....im thinking this is what the huge delay was probably for (looking into it time), im sure they would of at least looked into the possibility, might just be that its not wired up in a way that can function as a retail cart....could also be that its going to take a while to get it ready and this is their cartless solution plan, but its taking longer than expected to get it all set up


Thanks! You get how hard this can be.
 

Inaki

Well-Known Member
Member
Joined
Jan 23, 2014
Messages
278
Trophies
0
Age
41
XP
564
Country
jimskeet2002:
Do you think that if it was possible gateway wouldn't have done it this way instead of releasing an exploit that requires additional hardware even if they said that there won't be any need of additional hardware?

For me it would still be the logical step, I mean, they are working in something like this but, meanwhile and by now they give us the possibility to launch the GW mode by using a real OOT or CN cart. They keep working on having the GW cart simulate a real OOT or CN in the future but this step they have ( OOT and CN based exploit launching ) is needed. It is like a first milestone in their roadmap, the second milestone is getting rid of an original OOT or CN by adding the initial boot mode for their GW cart, the mode where the cart does raw reading of an OOT or CN rom from the microSD. There's that milestone 0 though, which they should have implemented in some previous firmware and the one that new GW carts should be shipping with from some time ago, the autonomous ( read: that does not require an exploit scenario ) update system where the cart detects, reads and applies an FPGA update from the microSD.

EDIT: It would make a lot of sense that they actually have that initial milestone 0 in place. For mass producing GW carts, it may be easier to have an autonomous update system than using some other method like SPI or something...

nollog:
because i doubt the gateway card has all the required bits n bobs to imitate a retail cart.

If it did, they'd probably have just been a sky instead of having all the emunand and what not from the start.

I don't see this being a reason, for them this "simulate initial original cart" mode is only a necessary step for their stuff afterwards. Also, I don't know the technical requirements and the limitations of their FPGA, but an IP for reading FAT32/exFAT seems way more complex and resource ( as in logic gates needed ) hungry than the 3ds cartridge protocol. I am speculating here and I may be wrong if there's cartridge-side crypto or others, but I doubt so.
 

gudenau

Largely ignored
OP
Member
Joined
Jul 7, 2010
Messages
3,822
Trophies
1
Location
/dev/random
Website
www.gudenau.net
XP
4,171
Country
United States
For me it would still be the logical step, I mean, they are working in something like this but, meanwhile and by now they give us the possibility to launch the GW mode by using a real OOT or CN cart. They keep working on having the GW cart simulate a real OOT or CN in the future but this step they have ( OOT and CN based exploit launching ) is needed. It is like a first milestone in their roadmap, the second milestone is getting rid of an original OOT or CN by adding the initial boot mode for their GW cart, the mode where the cart does raw reading of an OOT or CN rom from the microSD. There's that milestone 0 though, which they should have implemented in some previous firmware and the one that new GW carts should be shipping with from some time ago, the autonomous ( read: that does not require an exploit scenario ) update system where the cart detects, reads and applies an FPGA update from the microSD.

EDIT: It would make a lot of sense that they actually have that initial milestone 0 in place. For mass producing GW carts, it may be easier to have an autonomous update system than using some other method like SPI or something...



I don't see this being a reason, for them this "simulate initial original cart" mode is only a necessary step for their stuff afterwards. Also, I don't know the technical requirements and the limitations of their FPGA, but an IP for reading FAT32/exFAT seems way more complex and resource ( as in logic gates needed ) hungry than the 3ds cartridge protocol. I am speculating here and I may be wrong if there's cartridge-side crypto or others, but I doubt so.

Yes fat32 eould be worse than raw io, but not by to much. Then of course the 3ds files that get dumped are still encrypted.
 

Inaki

Well-Known Member
Member
Joined
Jan 23, 2014
Messages
278
Trophies
0
Age
41
XP
564
Country
Yes fat32 eould be worse than raw io, but not by to much. Then of course the 3ds files that get dumped are still encrypted.

so yeah, no cartridge-side crypto. I mean that doing the 3ds cart protocol, with the exception of the security handshake part ( which sky3ds knows, at least to a needed extent, although maybe not perfect ), is probably easier/smaller than reading files from the microSD and other things the GW FPGA does.
 

Inaki

Well-Known Member
Member
Joined
Jan 23, 2014
Messages
278
Trophies
0
Age
41
XP
564
Country
The FPGA update process. Look it up. ;-)

That milestone 0 I spoke about, the autonomous update process, would require file reading from the microSD ( which they already have for normal rom loading ) and working on its own. Maybe blinking the led while flashing and turning it on or off when finished, or changing color...
 

gudenau

Largely ignored
OP
Member
Joined
Jul 7, 2010
Messages
3,822
Trophies
1
Location
/dev/random
Website
www.gudenau.net
XP
4,171
Country
United States
That milestone 0 I spoke about, the autonomous update process, would require file reading from the microSD ( which they already have for normal rom loading ) and working on its own. Maybe blinking the led while flashing and turning it on or off when finished, or changing color...
I feel that may not be possable... But you should have the retail cart in the first place.
I do not know that much about fpga though.
 

Nollog

Well-Known Member
Member
Joined
Oct 10, 2008
Messages
2,964
Trophies
0
XP
1,325
Country
Ireland
Maybe 6 months from now, maybe more given the time zone gateway are in (soon), they'll probably make a gateway plus or new gateway or something that does this.
 
General chit-chat
Help Users
    Veho @ Veho: helfcare