Hacking [mini-review] R4i-Kit B9S -- Dual Card Ntrboot

[zoogie]

Disclaimer: I purchased this product from modchipsdirect.com with my own money and I'm not in any way involved with their advertising or PR.

Overview:
This is a strange little number. An unannounced and unhyped pre-flashed dual card ntrboot thingy sold only at one retailer: modchipsdirect (that I'm aware of). The kit is priced at $15 + $5 shipping. The directions on how to use the card are on the product's page at modchipsdirect.com.

First, lets start out with some pictures as it shows straight away how unusual this ntrboot solution is:


Egad! They don't come with stickers!
But its got a useless sd card and an awesome magnet!

Grey Card:
Ok, the grey card on the left is the ntrboot card. It needs the supplied (unbranded) microSD card in order for it to work (any other microsd is fine too). It should be noted that this sd card is useless for anything but getting ntrboot to work. When I inserted it into a PC, the OS responded by asking to format the disk. I did, and Windows said it could not be formatted. Interestingly, the card shows only 8MB of space available. It's clear the purpose of this card is just to enable ntrboot, and a real sd card was likely passed over to keep the kit's price down.

When I actually got around to testing the grey card's ntrboot functionality, well, it went pretty well. It loads boot.firm from the sd card and does its thing pretty much. The supplied neodymium magnet was quite powerful and had no problem triggering the 3ds's sleep switch. The card is using the official boot9strap_ntr v1.3, as revealed by a bootloader dump. I have no idea what clone this card actually is, but it did respond to "R4 SDHC Dual Core" in the latest commit of ntrboot_flasher. Interestingly, the dump was encrypted, but simply removing the decrypt function in the source code led to a dump containing a fully intact firm payload at 0x7E00. I've attached the flasher log and backup.bin in case some bright people like @Kitlith @dark_samus3 and @AngelSL can maybe find some use of them.

White Card:
Now to the white DS mode card. I'm pretty sure this card is the r4isdhc.com.cn dual core 2017 (Deep Labyrinth icon), and that's pretty good news. I say that because I simply inserted my other .com.cn microSD in the white card and it just worked. This particular card runs the excellent Wood firmware, is compatible with 11.6, and doesn't have any time bombs -- sweet! The firmware can be downloaded here, a detail the seller really should have mentioned.

Pros:
+ good value
+ easy to use - no switches or software needed to switch ntrboot <--> DS mode
+ good DS card
+ excellent magnet

Cons:
- nearly useless microSD card
- instructions are copy-pasted and lacking in details
- nothing is labeled

Recommended:
Yes

 

[Technicmaster0]

The PCBs look kinda ace3ds related with the white line between contacts and chips. But they have no label so IDK.

/edit
Another point for something like Ace3DS would be that you need a MicroSD in NTRBoot mode (like ace3ds X). Maybe OP can test the Ace3DS AOS with the DS flashcard?

/edit 2
The first pcb actually looks very similar to gw blue card/ace3ds "003" and "L-C": https://gbatemp.net/threads/analysis-on-the-gateway-3ds-blue-cart-updateable.357103/#post-4834510

 

[zoogie]

The PCBs look kinda ace3ds related with the white line between contacts and chips. But they have no label so IDK.

Another point for something like Ace3DS would be that you need a MicroSD in NTRBoot mode (like ace3ds X). Maybe OP can test the Ace3DS AOS with the DS flashcard?

The white card is an ace3ds clone most likely. It is exactly this
https://github.com/ntrteam/flashcart_core/issues/6#issuecomment-340230813
That card is labeled as a r4isdhc.com.hk but it's really an r4isdhc.com.cn. It was also purchased from modchipsdirect.
I'm not quite sure what you mean by AOS. I would probably test it once I find out.

The grey card is an actual r4isdhc.com.hk dual core (or r4igold.cc clone). That's my guess anyway based on it working with ntrboot flasher prototype support.

 

[Technicmaster0]

The white card is an ace3ds clone most likely. It is exactly this
https://github.com/ntrteam/flashcart_core/issues/6#issuecomment-340230813
That card is labeled as a r4isdhc.com.hk but it's really an r4isdhc.com.cn. It was also purchased from modchipsdirect.
I'm not quite sure what you mean by AOS. I would probably test it once I find out.

The grey card is an actual r4isdhc.com.hk dual core (or r4igold.cc clone). That's my guess anyway based on it working with ntrboot flasher prototype support.

I mean the AOS from http://ace3ds.com/ace-3ds-download.html

/edit
That actually seems to match with a r4isdhc.hk ntrboot card that got teasered in some pictures:

 

[zoogie]

I mean the AOS from http://ace3ds.com/ace-3ds-download.html

/edit
That actually seems to match with a r4isdhc.hk ntrboot card that got teasered in some pictures:

Didn't work. It loads _dsmenu.dat not _ds_menu.dat. Renaming it to _dsmenu.dat didn't work either.
Interesting theory on that new flashcard you posted.

Edit: it does appear like those two firmwares are related by looking at them under a hex editor.

 

[Technicmaster0]

Interesting theory on that new flashcard you posted.

The "leak" happened at least two weeks ago.

 

[thisisallowed]

Didn't work. It loads _dsmenu.dat not _ds_menu.dat. Renaming it to _dsmenu.dat didn't work either.
Interesting theory on that new flashcard you posted.

Edit: it does appear like those two firmwares are related by looking at them under a hex editor.

Also, the PCBs are simillar.

 

[Technicmaster0]

Edit: it does appear like those two firmwares are related by looking at them under a hex editor.

Yes, both of them are wood. Tho I think that the cards have different encryption keys.

 

[Cuphat]

Thanks for this zoogie, I was curious what carts those were. It's good news that the DS cart runs Wood.

I assume the ntrboot cart probably doesn't have enough flash space to do anything interesting, but most people just need it to chainload SafeB9SInstaller.

 

[Technicmaster0]

Thanks for this zoogie, I was curious what carts those were. It's good news that the DS cart runs Wood.

I assume the ntrboot cart probably doesn't have enough flash space to do anything interesting, but most people just need it to chainload SafeB9SInstaller.

I'd assume that the ntrboot cart is a normal flashcard that got flashed. It's unlikely that they changed anything at a hardware level.

 

[Cuphat]

I'd assume that the ntrboot cart is a normal flashcard that got flashed. It's unlikely that they changed anything at a hardware level.

Yes, but some carts have more flash space for FIRMs than others. The DSTT, for instance, can't ntrboot B9S 1.2 or below because the FIRM is larger than the available space. That is the reason why B9S 1.3 was released with less padding so that it could fit.

BTW, by "anything interesting", I mean things like this. It sounds like it may be an r4isdhc.com card and I'm unsure if r4isdhc.com cards have enough space for that.

 

[zoogie]

Thanks for this zoogie, I was curious what carts those were. It's good news that the DS cart runs Wood.

I assume the ntrboot cart probably doesn't have enough flash space to do anything interesting, but most people just need it to chainload SafeB9SInstaller.

It's got a 1MB flash with remnants of a spongebob rom, but unfortunately, the current ntrboot_flasher code's write command doesn't work with it (I yolo'd the restore feature but it had no effect)
dark_samus's comments on it from github:
https://github.com/ntrteam/flashcart_core/issues/3#issuecomment-349098890

So who knows what it is at this point.

edit: finally found something that looks very close to the grey card:
https://github.com/ntrteam/flashcart_core/issues/33#issuecomment-327547730
An older gateway blue card. One of the types that has a spongebob icon.

 

[tranfeer]

Too complex.
Why not using only one card and a switch?
Users can change the mode of the card by pushing the switch.
There is no need to find a hacked console to flash the card.

--------------------- MERGED ---------------------------

The users should choose the best solution.

 

[Technicmaster0]

Too complex.
Why not using only one card and a switch?
Users can change the mode of the card by pushing the switch.
There is no need to find a hacked console to flash the card.

You don't have to find a hacked console to flash the card with this. It's one NTRBoot preflashed card and one card for DS games. I'd say that it's cheaper and simpler than a switch.

 

[zoogie]

Here's a little something interesting:
https://github.com/ntrteam/flashcart_core/issues/33#issuecomment-350378260

This kit is a REALLY good deal now

 

[Mark2333]

What, first I think it is the r4i b9s from r4i-sdhc.com but later what is it? I'm confused.

 

[ROBRSG]

Used this one, purchased from the same Modchipsdirect.com and I can strongly recommend this card.

I don't even think there's room mistake when using this kit.

 

[enodeb]

This card (white version)
Didn't work on my US ver. N3DS but works on my friend's JP ver. N3DS
Same sdcard, same flash card.
No idea why.

 

[TurdPooCharger]

This card (white version)
Didn't work on my US ver. N3DS but works on my friend's JP ver. N3DS
Same sdcard, same flash card.
No idea why.

Give it a go with either
(1) NTR Launcher
or
(2) stage 2 series of launchers.

These might or might not help.

 

[send0]

I used this to unbrick my n3ds, except I got the cards backwards. I used the white card for ntrboot and b9s. It worked just fine. I haven't tried to use the grey/black card yet.