Hardware N3DS NAND backup possible, I hope.

[Avalynn]

So after testing out a couple different configurations, card readers and various pins this has been the pinout that works (not just for me anymore! )

There may be other motherboards as time goes on that look different, so please check before you do anything. Also this is for educational purposes only and you do so at your own risk. It's taken me a couple hours to get it down but I hope it works for you as well to keep your SysNAND backed up manually or you need to restore an image because it somehow got accidentally updated .

This is for the N3DS XL, just a note but the mobo has the lettering RED-CPU-01.

This is an alternate location on the other side of the board for CLK, it's a test point so it's a large pad to solder to and easier to access.



A ground point that's easy enough to access on the reverse side. There are a lot of them as the board uses a ground pour so you can easily hunt around for one.


Do not use this area (the RED selected area) for a GND point because of the object in blue.

Spoiler: why shouldn't I use this area for GND?

You can't use the ground near the power connector or on it unfortunately
If you check around it, it actually goes though an inductor, or transformer, but I am voting it's being used an inductor, before getting to the ground plane. That adds a little resistance to it and I don't think the inductor is charging since there is no power at the connector.

Inductors start off as a open circuit until their magnetic fields are charged and stabilized which then it acts as a short. The reason for the inductor is to help handle changes in current, since the wall supply is a switching supply the inductor here helps stabilize the switching noise from the charger.

P.S. if you have a good multimeter you can check the resistance of the inductor from other points on the GND plane and there should be a bit of difference.

This is for the N3DS (nonXL), just a note but the mobo has the lettering KTR-CPU-01.

This is an alternate test point on the other side of the board for CLK for the N3DS.



If you are on Windows here is a small guide for backing up the system eMMC using Win32DiskImager.


Using the TekRepublic TUC-300 Reader I was still hitting around 6MB/s with just one DAT line and 21MB/s using all the DAT lines. Please let me know of any error or problems in any of my diagrams, this was fun to figure out. I'll keep you updated


Alright so I've tested it fully (backups and writes) with many systems now of, both of my own and other members here, I can safely say this works well with both the Samsung and Toshiba eMMC.

I updated to 9.5 and then restored my backup of 9.0. I posted a couple images on Page 3 post #60.

Please note the N3DS eMMC does not work in every card reader, it can be hit or miss and this list is not exact but these are known to work with the 3DS and N3DS.

For working card readers I have had good success with the:
Anker® USB 3.0 (68UNMCRD-B2U) : Realtek RTS5306
TekRepublic TUC-300 : Realtek RTS5307

Some other card readers that use the same chipset /controller but have not been tested although should work:
Plugable USB3-FLASH3 -
SIIG JU-MR0E12-S1-
Startech FCREADMICRO3 -

Other card readers that work
SanDisk SDDR-121-A11M (older version Grey) : GL827
Transcend P8 TS-RDP8K : ALCOR AU6476 (Thank you Gamerquest1 and zchtoy)
Anker® USB 3.0 4-Slot Card Reader (A7612) : RT5301 (Ava)

Card reader chipsets known not to work on N3DS with the Samsung eMMC, but may still work on one with the Toshiba and the 3DS/XL eMMC:
GL3220
GL3233
GL834

If anyone has any other card readers they have used with success on both the N3DS Toshiba and Samsung eMMC please let me know so I can add them to the list. Thank you!

A little bit more about the card readers I have tested and what works and what doesn't!

Spoiler: SD Card Reader Info

Okay so here are the card reader controller, makes well enough sense why the Tek-Republic and Anker ones work as they use basically Identical controllers. I wonder what my old Transend TS-RDP5K used to use. Can't find much about the Realtek controllers unfortunately but there are a couple other ones out there that use it from what I have seen. I will be updating as I get / test more that I have access to, also will be adding info from USBDeview v2.41 about each card reader.

Anker® USB 3.0 (68UNMCRD-B2U) : Realtek RTS5306 : Works as decently as the Tek one does, no issues at all on reading or writing

Spoiler: Anker® USB 3.0 (68UNMCRD-B2U)

TekRepublic TUC-300 :Realtek RTS5307 : Works well for me on the 3DS/XL and N3DSXL, my go to reader.

Spoiler: TekRepublic TUC-300

Anker® USB 3.0 4-Slot Card Reader (A7612) : RT5301 :Works well for me on the 3DS/XL and N3DSXL

Spoiler: Anker Card Reader (A7612)

Transcend TS-RDP5K : GL834 Product Info : Sadly I can't get this new one to work for the N3DSXL but still works fine on my 3DS XL

Spoiler: Transcend TS-RDP5K

Transcend TS-RDF5K (USB 3.0) : GL3233 Product Info : Same story as above

Spoiler: Transcend TS-RDF5K (USB 3.0)

SanDisk SDDR-121-A11M (older version Grey) : GL827 Datasheet : I've played around with this did some reads and writes to the 3DS/XL and N3DSXL works but it's a microSD reader, hard to use without an adapter or soldering directly to it.

Spoiler: SanDisk SDDR-121-A11M

So that's the card readers I have and the information I have on them currently. Feel free to chime in with what works for you and what doesn't. As the N3DS eMMC seems to be pickier but not all controllers are made equally and who knows how the firmware on them is. I will add more about them and info

Side Note: Not exactly sure but SIIG, StarTek, and Plugable all make card readers that look just like the TekRepublic one.

Size info for the eMMC's
Samsung 1.21 GB (1,300,234,240 bytes)
Toshiba = 1.84 GB (1,979,711,488 bytes)

A possible way to check if your eMMC image was any good is to look at it with a Hex Editor, I am sure there are better methods though, but this has worked for me. Also as others have said, booting the dump in emuNAND is a good way to check its validity.



Thank you for taking the time to check this out and if you have any questions or comments please ask, I'll do my best to help!


-----------------------------------------------------------------------------------------------------------------------------------

Spoiler: Old Pin map

This is the old Image incase someone finds it any easier to see

Spoiler: Original Post

So I know I posted this in a different thread but I decided I would make a new thread for any input and keeping a record about anything I or someone else figures out.

I've tested the 12 pins around the eMMC both front and back also, the US black N3DS XL I have doesn't use a Samsung eMMC. If anyone knows something about eMMC logic that would be great please get in touch with me.

So I'm pretty sure I've found the DAT 0/1/2/3, as they were pretty obvious just don't know which is which and a couple lines that are definitely clocks. There is a small spike in one of the lines during the clock start up and I wonder if it's the CMD but again i don't have much knowledge on eMMC logic.

I am thinking I am going to utilize my old 3DS and look at that data to give me an idea what each line should look like on system boot up.

It's not very hard to get the N3DS XL into everyone's favorite blue screen of error, hehe.

Also some pretty pictures
PS. - Please ignore the Data part on the top I was playing around with protocol analyzers. Also sorry about the tiny letter and messed up order in the logic analyzer windows.




This is the the pin testing points that I originally used:

 

[Avalynn]

Alright so after analyzing the 3DSXL start up a couple more times, I think I know which pins are for what, so far I am pretty sure I know what CMD is, and CLK at least, now it's a matter of getting the DAT lines in order and that's the hard part. I'll update this when I get something, here's for hoping this all works.

Does anyone know if I can read the whole NAND using only DAT0? or do I need all four?

Anyways I tried with just one line and it's at least showing up in Windows as a drive in my card reader the same way the 3DS-XL and 3DS did. So that's something I guess, now to try for a dump and see how large it is.

Alright so you can't just use one line or I messed something up, N3DS boots fine still, goes into blue screen mode like it should but Win32DiskImager cannot perform the read on it.

 

[Bug_Checker_]

Alright so after analyzing the 3DSXL start up a couple more times, I think I know which pins are for what, so far I am pretty sure I know what CMD is, and CLK at least, now it's a matter of getting the DAT lines in order and that's the hard part. I'll update this when I get something, here's for hoping this all works.

Does anyone know if I can read the whole NAND using only DAT0? or do I need all four?

Anyways I tried with just one line and it's at least showing up in Windows as a drive in my card reader the same way the 3DS-XL and 3DS did. So that's something I guess, now to try for a dump and see how large it is.

Alright so you can't just use one line or I messed something up, N3DS boots fine still, goes into blue screen mode like it should but Win32DiskImager cannot perform the read on it.

This motherboard version looks different than the others I've seen. What is the region/model/firmware?
D0-D3 should be coming from the resistor pack. I believe according to your label/pictures:
A1=D0
A2=D1
A3=D2
A4=D3

 

[Avalynn]

This motherboard version looks different than the others I've seen. What is the region/model/firmware?
D0-D3 should be coming from the resistor pack. I believe according to your label/pictures:
A1=D0
A2=D1
A3=D2
A4=D3

Mine is a USA / N3DS XL/ 9.0
and thank you I think there is just something with my WinDisk Imager cause it is messing up on the normal 3DS' or my card reader, i'll sort this out yet lol

Soooo I finally got it ti read using Win32 Disk Imager at about 3MBs lol, painfully slow for 2GB.
with a size of 1.84 GB (1,979,711,488 bytes). I have no way to test if it works with writing back to it.
I think i need to severely shorten the cables next and try on other readers.

 

[gamesquest1]

Mine is a USA / N3DS XL/ 9.0
and thank you I think there is just something with my WinDisk Imager cause it is messing up on the normal 3DS' or my card reader, i'll sort this out yet lol

Soooo I finally got it ti read using Win32 Disk Imager at about 3MBs lol, painfully slow for 2GB.
with a size of 1.84 GB (1,979,711,488 bytes). I have no way to test if it works with writing back to it.
I think i need to severely shorten the cables next and try on other readers.

if its anything like the 2DS the wires need to be as short as possible, i couldn't get it to detect on like 6 card readers, ended up getting a trancend multi reader TS-RDP8K which worked, but great work btw, are you planning to bite the bullet and see if a restore works?, also what read speeds where you getting?

 

[Avalynn]

if its anything like the 2DS the wires need to be as short as possible, i couldn't get it to detect on like 6 card readers, ended up getting a trancend multi reader TS-RDP8K which worked, but great work btw, are you planning to bite the bullet and see if a restore works?, also what read speeds where you getting?

Ah as I stated 3 MB/s lol. Painfully slow ><
I am going to try a couple larger wires first and shorten them also testing with a couple other reader. I only have a Transend 2.0 which isn't work, and a TekRepublic TUC-300 which is but really slow.

 

[gamesquest1]

Ah as I stated 3 MB/s lol. Painfully slow ><
I am going to try a couple larger wires first and shorten them also testing with a couple other reader. I only have a Transend 2.0 which isn't work, and a TekRepublic TUC-300 which is but really slow.

if you only have dat0 connected it usually is quite slow, like 4-6MB/s, iirc its about 15MB/s if you have dat0-3 hooked up

to put it into perspective, when i had wires that are about the same size as i normally use for the 3ds/3DS XL hooked up to the 2DS i was getting between 2-3MB/s so yeah i know what you mean with it being tedious, but as long as it works i would be happy with 1MB/s ....its not like we should be upgrading and downgrading every day anyway, but this at least might mean n3DS owners can update to higher FW versions for N3DS exclusive titles if we loose emunand compatibility

 

[Avalynn]

if you only have dat0 connected it usually is quite slow, like 4-6MB/s, iirc its about 15MB/s if you have dat0-3 hooked up

I have all the lines hooked up, but I'm not sure if they are correct. Is there an official pin-out yet? Sorry If I have missed it.

 

[gamesquest1]

I have all the lines hooked up, but I'm not sure if they are correct. Is there an official pin-out yet? Sorry If I have missed it.

nope your pioneering

this is what i would assume would be the dat lines pinout

 

[Avalynn]

Well if you are curious in trying yourself or anyone else for that matter here are the pins I am using.

These are the data pins that face towards the screen:


And this is the reverse side for ground:


Though I did find about three places that could work as clock too I think, they have have the same period but one seems to fluctuate a tiny bit, so I'm not using that one but I can post those spots too. Well they are in the first post, B1 and B2.

Also again just for fun, here some more analyzer pictures at the first data chunk when it's turned on
This was the from the 3DSXL (old)

General Overview

Data Lines

CMD Line


And this is from the N3DSXL (new!)
General Overview

Data Lines

CMD Line


So I figure those pins seem correct since I used the pin out info from the old one and got about the same response from the new one but of course data in different places, their memory clocks seem the same though.

 

[gamesquest1]

Well if you are curious in trying yourself or anyone else for that matter here are the pins I am using.

These are the data pins that face towards the screen:
View attachment 15686

And this is the reverse side for ground:
View attachment 15687

Though I did find about three places that could work as clock too I think, they have have the same period but one seems to fluctuate a tiny bit, so I'm not using that one but I can post those spots too. Well they are in the first post, B1 and B2.

hmmmm im tempted now, i kinda said to myself i would leave my n3DS as it is unless needed (accidental update or whatever).....but i do like to mess about with stuff XD

well guess you have the dat lines hooked up how i would of figured they went.....maybe try with only dat0 connected and see what you get in terms of speed

 

[Avalynn]

So I am really hoping I got all those lines correctly and didn't mess any of them up, both the captures from the 3DSXL and the N3DSXL seem to match up, meaning that I would assume (and that's a bad thing to do I know) the pins are somewhat correct but maybe the I've gotten the data pins out of order?

I've been playing with them spawping them around, trying one at a time and the only successful dump I got was from earlier when all were connected but I'll keep you posted if I can do it with only one and it honestly could just be my card readers

 

[Bug_Checker_]

nope your pioneering

this is what i would assume would be the dat lines pinout

I believe your numbering is incorrect. The OP should try my numbering. If I recall I based it off of something like
http://www.psdevwiki.com/ps3/images/8/85/EMMC-BGA169.png

Where "H2" is a nc so they run the trace under that straight to D3 bga pad

 

[Avalynn]

I believe your numbering is incorrect. The OP should try my numbering. If I recall I based it off of something like
http://www.psdevwiki.com/ps3/images/8/85/EMMC-BGA169.png

Where "H2" is a nc so they run the trace under that straight to D3 bga pad

I'll give it another shot again in various configurations. I was basing it off the resistor network in place, like they did with the older 3DSXL
http://3dbrew.org/w/images/2/22/CTR_NAND_pinout_XL.jpg

but then again this comes at completely different angle lol, If only I had bought a xray machine instead of a N3DS j/k.

 

[gamesquest1]

I believe your numbering is incorrect. The OP should try my numbering. If I recall I based it off of something like
http://www.psdevwiki.com/ps3/images/8/85/EMMC-BGA169.png

Where "H2" is a nc so they run the trace under that straight to D3 bga pad

so basically try like this right?
[removed to save future confusion for people ]

unless i just read that completely wrong XD

 

[Avalynn]

Curious, does anyone recognize that memory manufacture logo stamp? I do not keep up with those only MCUs and SoCs unfortunately, and major ones at that lol.

 

[Bug_Checker_]

so basically try like this right?

unless i just read that completely wrong XD

Yes, that was what I was suggesting.
This is based on my memory and the different grouping of the Japanese or EUR N3DS(I seem to recall they were in a tight square. I believe that pinout was
D0=SW
D1=SE
D2=NE
D3=NW
counter clockwise starting at bottom left if the chip was to the right of the pads. Again, if I recall correctly.

 

[Avalynn]

Yes, that was what I was suggesting.
This is based on my memory and the different grouping of the Japanese or EUR N3DS(I seem to recall they were in a tight square. I believe that pinout was
D0=SW
D1=SE
D2=NE
D3=NW
counter clockwise starting at bottom left if the chip was to the right of the pads. Again, if I recall correctly.

So is there an "official" pinout for the EUR and JPN N3DS XL's then?

 

[Bug_Checker_]

So is there an "official" pinout for the EUR and JPN N3DS XL's then?

No, not official just a guess.
I was assuming Motherboard version would be the same/similar and would experiment with NA N3DS. But, Now different motherboards and the Red consoles I have access to are way tooooo close to cut off for 9.4 that they may get returned unopened.

 

[Avalynn]

Alright I managed to get 10 MB/s then it dropped to 3 lol but it's reading with my other reader after cleaning up the wires and joints.

hmm sustained 5,5 MB/s using only one data line now ^^

I'll update my main post with my findings in a bit, but so far i've gotten 5 fulls dumps supposedly.

sooo I tried it using both ways and DAT0 seems to be on A4 or the left most pin.I've tried using second most bottom pin as suggest and it would not show up as a readable drive. I've also tried using the pin method as suggest by Bug_Checker_ but it would start at 10MBs then drop to 3MBs then have an I/O error.