Hardware nand flash dump (3ds xl)

[anubis66679]

It is perfectly normal for any OS to recognize no filesystem, as there is no filesystem.

fair enough , but its just the win32disk pog doesn't get it either, I've also tried Roadkil's Disk Image prog too.

 

[anubis66679]

Try a different windows version/pc ?
Try de/reinstalling your SD Card readers driver.
Try using your Laptops/PCs built in SD card reader.
Try a different USB based SD Card reader.
Check your wiring on the SD Adapter.

Try a different windows version/pc ?
Try de/reinstalling your SD Card readers driver.
Try using your Laptops/PCs built in SD card reader.
Try a different USB based SD Card reader.
Check your wiring on the SD Adapter.

maybe a multi card reader isnt the way to go then, its just that i have tried the micro SD Card adapter method and it didnt work, or maybe im following the guide wrong, maybe someone could be nice enough to an update on micro sd card tutorials, so far ive tried 3 sd card adapters but they are cheap and dont have the push in spring pop out thingy.it seems simple and im doing something stupid here.

 

[Squirrel61]

This is all very interesting stuff! It reminds me of the days of the PSP-1000, when I was installing UP chips and later used just an XD card as "external NAND", including dual-boot solutions with a hidden switch. Sadly, starting with the PSP-2000 series, the NAND got integrated in the CPU and this kind of hacking wasn't possible anymore. I hope Nintendo will keep using a separate NAND in future models for a long time, because it would be very nice to have a dual-boot 3DS with 4.5 for the Gateway card and the newest version for, well, just having the newest firmware.

Maybe tomorrow I'll take my soldering tools to create an adapter for my 3DS XL (which is on 6.2.0 already, without NAND backups) and I've also started searching for a 3DS or XL on a lower firmware. I'll let you know the progress and I'll be happy to help with anything.

Btw. the PSP-1000 was hackable and downgradable, because the 1.5 firmware wasn't signed nor encrypted and could be transferred from any PSP to any other (the same goes for the 1.0 firmware btw. but that was only available on Japanese PSPs). I guess Nintendo didn't make such a mistake on the first 3DS firmware?

 

[Coto]

Has anybody tried creating a NAND dump, then flashing it back onto a common SD card, and connecting DAT0,GND,CMD,VDD?

 

[Squirrel61]

That could indeed be interesting for creating a dual-boot system.

 

[justinkb]

Has anybody tried creating a NAND dump, then flashing it back onto a common SD card, and connecting DAT0,GND,CMD,VDD?

that makes no sense at all. if those are connected, it will give bootloader error. what exactly was your idea here? it's not like the 3DS would read the sdcard instead of its nand... it's only a dump interface (think sink, not source).

 

[Coto]

not reading nand, and reading from SD? But the problem would be to d/c the NAND. (given DAT0/1/2) are SD standards

joining the party too: hehe

Spoiler

I'll do three dumps, check they're the same, then write one of them back to NAND then turn on the console.

edit:

Spoiler

 

[Squirrel61]

that makes no sense at all. if those are connected, it will give bootloader error. what exactly was your idea here? it's not like the 3DS would read the sdcard instead of its nand... it's only a dump interface (think sink, not source).

That's not true. As far as I know, nobody in this forum has tried to connect a real SD card to the 3DS. The 3DS will give a bootloader error when a cardreader, which generates its own clock signal, is connected. But a real SD card would rely on the 3DS clock. But as Coto says, the problem would be to disconnect the Dx lines (all four!) from the nand. If there's an easy way to do that, a dual-boot would be possible.

 

[3DSGuy]

Here are some bootrom errors with causes, so you may be able to diagnose bad soldering:

CMD is connected to DAT0. Or CLK is getting signal from one of the DAT lines.

00F800FE
00000000 00000000
00000200 00000000

CMD is connected to CLK. (Other DAT lines may be connected to this aswell, no way to tell)

00F800FE
00000000 00000000
00000400 00000000

CMD is connected to DAT1

00F800EF
FFFFFFFF FFFFFFFF
00000003 00000000

CMD is connected to DAT2

00F800EF
FFFFFFFF FFFFFFFF
00000007 00000000

DAT lines are connected to other DAT lines

00F800EF
FFFFFFFF FFFFFFFF
00000022 00000000

DAT line(s) are connected to GND

00F800EF
FFFFFFFF FFFFFFFF
00000024 00000000

(CMD is connected to CLK) AND (DAT lines are connected to other DAT lines). But the CMD/CLK connection and DAT/DAT connection are not connected to each other.

00F800EF
FFFFFFFF FFFFFFFF
00000005 00C00000

 

[0nethe]

Here are some bootrom errors with causes, so you may be able to diagnose bad soldering:

CMD is connected to DAT0. Or CLK is getting signal from one of the DAT lines.

00F800FE
00000000 00000000
00000200 00000000

CMD is connected to CLK. (Other DAT lines may be connected to this aswell, no way to tell)

00F800FE
00000000 00000000
00000400 00000000

CMD is connected to DAT1

00F800EF
FFFFFFFF FFFFFFFF
00000003 00000000

CMD is connected to DAT2

00F800EF
FFFFFFFF FFFFFFFF
00000007 00000000

DAT lines are connected to other DAT lines

00F800EF
FFFFFFFF FFFFFFFF
00000022 00000000

(CMD is connected to CLK) AND (DAT lines are connected to other DAT lines). But the CMD/CLK connection and DAT/DAT connection are not connected to each other.

00F800EF
FFFFFFFF FFFFFFFF
00000005 00C00000

That's great but which one shows all good soldering ?

 

[n1ghty]

That's great but which one shows all good soldering ?

I think I have seen two different "good" Errorcodes (maybe Samsung/Toshiba NAND).

One of it is:

00F800FF
DFDFFFFF FFFFFFFF
00000005 00000000

 

[Coto]

Just updated to 6.2.1.0U

and downgraded..

proof: (before)

Spoiler

after

Spoiler

note: if you solder GND at one of the normally open cartridge "inserted" solders (those close one from another, left side from NAND), you can't use a cartridge while the SD adapter is connected.. it'll confuse NAND by receiving two kind of clocks from both 3DS & SD

 

[0nethe]

Just updated to 6.2.1.0U

and downgraded..

proof:

Spoiler

note: if you solder GND at one of the normally open cartridge "inserted" solders (those close one from another, left side from NAND), you can't use a cartridge while the SD adapter is connected.. it'll confuse NAND by receiving two kind of clocks from both 3DS & SD

Uh ? A picture would be a better explaination for me

 

[anubis66679]

why is it that windows always wants to format my 3dsxl as it does not recognize its format? its just that no one else seems to come across this, ive atempted this over a couple of weeks now and still no luck, ive even change sd card readers and went out and brought more appropriate wire and redid and rechecked.... one thing i have noticed is under windows disk management it does say drive H unknown 950MBs...

there,s a row of four different resistors next to the DAT0, CMD, and CLK solder points, does anyone know if its possible to buy these anywhere? ive been trying this mod to the point that ive damaged the legs on one of them i think, its hard to see, anyway i have two 3ds xls and both of them are stuck on blue screen when i finally decided to take wiring away. and here i thought i did a good tidy job of the mod. ive never had problems in this kind of thing before , expensive mistake

 

[Devin]

^ That bottom photo is from Gonzo's NAND dumper.

You have to had dumped your 3DS on 4.1-4.5 previously to downgrade your 3DS to work with the GW3DS.

 

[Squirrel61]

Maybe you can include a link to that forum? It most probably looks like the forum member made a nand backup from the 4.2 firmware before upgrading and now uses the 4 wires from the interface in the below pic (which originally has been posted earlier in this thread) to restore the backup to his 3DS.

I know that at least one firmware version has been dumped and decrypted. I also suspect that some readers of this thread have access to this decrypted firmware.

What I like to know is if someone has already tried to flash this decrypted firmware to the nand of the 3DS. In my opinion, there are several possibilities of what will happen when you try to boot the 3Ds on a decrypted firmware, from which I will list the most obvious.

1. The bootrom checks if the firmware is encrypted before booting, detects that it isn't and refuses to boot with a blue or black screen.
2. The bootrom doesn't check if the firmware is encrypted and tries to boot it, but the crypto-engine still tries to decrypt it, turning perfectly executable code into garbage. The 3DS most probably will freeze or switch off.
3. The bootrom doesn't check if the firmware is encrypted and tries to boot it, the crypto-engine recognizes it as unencrypted and passes the code unaltered. This would be the most interesting case, because the 3DS will probably boot perfectly well. If this is the case, it could possibly offer a way to downgrade the 3DS, so it's really important to know this.

I just got the idea about this when I was thinking of the good old times of early PSP hacking, when people discovered that although the PSP firmware was fully encrypted and signed, it was possible to replace some of the firmware modules with decrypted, unsigned versions and the PSP would still boot. This was the start of PSP CFW. The basic of PSP-1000 downgrading was flashing an unencrypted, unsigned dump of the 1.5 firmware, because that firmware would boot perfectly well and thus could easily be transferred from one PSP to another. All of this got disabled in later versions btw.

 

[mr. fancypants]

so if theres a way tomake the 3ds read unecrypted NAND dumps, you can downgrade your 3ds xl with a NAND dump from another 3ds xl?

 

[Pong20302000]

What I like to know is if someone has already tried to flash this decrypted firmware to the nand of the 3DS.

indeed interesting

i believe the firmware that was dumped and got out was 2.1.0-3

 

[mr. fancypants]

indeed interesting

i believe the firmware that was dumped and got out was 2.1.0-3

dumped and decrypted? now only if the 3ds could read decrypted nand files and your back on 2.1

 

[Squirrel61]

indeed interesting

i believe the firmware that was dumped and got out was 2.1.0-3

Afaik, that's the only firmware that has gone public in decrypted form (although I haven't found it yet for downloading otherwise I would try to flash it myself). But I'm sure the Gateway team have more versions, at least the 4.1-4.5 versions and possibly also the 6.x.

dumped and decrypted? now only if the 3ds could read decrypted nand files and your back on 2.1

That's what I mean. And from 2.1 it's easy to upgrade to 4.5 using a game that includes the update.