Hacking Im going to have a 3DS decapped, i need help

[jpoopdog]

Im going to commission the decapping and delayering of a 3ds, currently im talking to the company that will be doing the decapping and SEM imaging.

Ive run into a hitch, given i dont know much about the process im not sure what im asking for. I REALLY want to see this through, i got pretty angry about the 3dsbrew scam.

Anywho, what ive been suggested by my request in reverse engineering the SOC is "block investigation", its my understanding that it will reveal an xray and physical scan of each layer, im not however sure if that will reveal the data we need, or will it?

Otherwise, can someone inform me of what i should be requesting so we get all the neccesary information, ide hate to pay all that money and get nothing out of it. Its my understanding we need the "boot codes", from the scan in particular, what would give us this?

 

[Foxi4]

The "scam" was not directly associated with 3Dbrew, it was merely somewhat encouraged. As far as delayering is concerned, they will simply dissolve the SOC's cover, make photographs of the outer layer, remove the layer, make more photos etc. until they get to the very bottom. Some X-rays may be involved as well. Will it reveal a lot of information? Maybe. It will be pretty costly though, so be prepared for that. The 3DS's CPU isn't an ordinary chip - it's a densly-populated, multi-layered circuit. Delayering it effectively requires an advanced laboratory - not something you can do at any random facility dealing with delayering circuits.

 

[octopus]

Well, to get the general idea about decapping process check this site: http://psxdev.ru/news
It’s about some dedicated enthusiasts decapping PS1 processor since July 2013. I’m sorry, it’s in Russian, but I think it illustrates the process pretty good. Use google translate if you wish. Actually, they sent the chips to someone in America for decapping; they trace the microschemes and figure out how they work, document it and etc.

 

[jpoopdog]

im confident that they will be able to get EVERYTHING dont worry about that, but, i still dont know what it is we actually need, or how it is to be obtained.

 

[Foxi4]

im confident that they will be able to get EVERYTHING dont worry about that, but, i still dont know what it is we actually need, or how it is to be obtained.

If it's a laboratory capable of handling the job then all you need to do is provide them with a SoC to decap and ask for the highest possible resolution of the photographs.

 

[cracker]

That is some craziness there (PS1 decap info). By the time it is all figured out the [Four]DS might be at its end of life... Or ssspwn might be released.

 

[Rob Blou]

yeah you should wait for the new 3ds

 

[Foxi4]

yeah you should wait for the new 3ds

I don't think the two CPU's will be substantially different - from what I understand they're just planning to make the N3DS run at a higher frequency, much like it was the case with the DSi.

 

[WulfyStylez]

PS1 decap is a poor indicator of viability. We're talking something that was made on an 800- or 600-nm process versus something on a 90nm (surprisingly actually still kinda old) process. I don't know if any labs can handle these smaller processes yet. Plus you wanna image the entire chip? If it's even possible, it'll be exorbitantly expensive.

And what do you think you'll get out of it besides bootrom, keyx and such? It doesn't directly aid developing hacks.

 

[jpoopdog]

specifically though what should i ask of them, like, what am i meant to "ensure" is read in whole, like what would be specifically what i need to ensure gets read

 

[Foxi4]

PS1 decap is a poor indicator of viability. We're talking something that was made on an 800- or 600-nm process versus something on a 90nm (surprisingly actually still kinda old) process. I don't know if any labs can handle these smaller processes yet. Plus you wanna image the entire chip? If it's even possible, it'll be exorbitantly expensive.

And what do you think you'll get out of it besides bootrom, keyx and such? It doesn't directly aid developing hacks.

It may give some pointers as far as extracting data or figuring out which solder point could potentially be used to dump what. That being said, it's not as much help as people give it credit.

specifically though what should i ask of them, like, what am i meant to "ensure" is read in whole, like what would be specifically what i need to ensure gets read

They will probably ask you how many layers the chip has to determine how to slice into it.

Description of the depackaging process: http://gaasedelen.blogspot.com/2014/03/depackaging-nintendo-3ds-cpu.html

45nm lithography, approx. 8-10 metallic layers, first being power and ground.

More information about the die and high-resolution photos: http://siliconpr0n.org/archive/doku.php?id=azonenberg:nintendo:3ds_xl_cpu

 

[daicon]

And what do you think you'll get out of it besides bootrom, keyx and such? It doesn't directly aid developing hacks.

You don't think emulators would benefit from the documentation? I think it'd have an impact on effort other than hacks.

 

[jpoopdog]

i just realized i dont know which chip is the SOC, which chip, needs to be delayered, its previously been my understanding to be the cpu, right?

they need more pics so ill have to open my 3ds for them, with more pics

 

[gamesquest1]

or you can just take them off the internet

 

[Snailface]

i just realized i dont know which chip is the SOC, which chip, needs to be delayered, its previously been my understanding to be the cpu, right?

they need more pics so ill have to open my 3ds for them, with more pics

http://3dbrew.org/wiki/File:CTR_Front.jpg
(a tiny hint: the soc has "CPU" written on it )

That's the original 3ds. just send them the whole motherboard with your demands and a king's ransom.

 

[gman666]

i just realized i dont know which chip is the SOC, which chip, needs to be delayered, its previously been my understanding to be the cpu, right?

they need more pics so ill have to open my 3ds for them, with more pics

Soo your not asking for money? Great Guy! Here's an image courtesy of Ifixit. The red area is the SOC.
Edit: Oops Snailface already posted it

 

[bkifft]

Before paying for your own decap you might also want to check http://www.techinsights.com/reports...market-reports/Report-Profile/?ReportKey=7595 , they did a full device teardown including a decap (low res pic: http://m.eet.com/media/1114759/nintendo_3ds_teardown8.jpg) and sell the report for 7k$.

 

[cracker]

Wow... That seems just a bit illegal. *Goes to play on his GW*

 

[Normmatt]

Before paying for your own decap you might also want to check http://www.techinsights.com/reports...market-reports/Report-Profile/?ReportKey=7595 , they did a full device teardown including a decap (low res pic: http://m.eet.com/media/1114759/nintendo_3ds_teardown8.jpg) and sell the report for 7k$.

I think you mean http://www.techinsights.com/reports...market-reports/Report-Profile/?ReportKey=7355

 

[gamesquest1]

I think you mean http://www.techinsights.com/reports...market-reports/Report-Profile/?ReportKey=7355

Neither of those would be sufficient would they, one is just a tear down, the other would only be the top and bottom layers of the processor