PassME/FlashME, How Do They Work?

[gudenau]

How do PassMe and FlashME jump to the GBA flash cartridges? I have access to the memory on a DS and tried jumping to 0x08000000 but it didn't appear to do anything, what's the correct procedure?

 

[SylverReZ]

These files might help you reverse engineer on how it all works. But, it probably works by bypassing Nintendo's security checks with the use of a real cart, similar to those Wisdom Tree NES/SNES pass thru carts.

 

[metroid maniac]

How do PassMe and FlashME jump to the GBA flash cartridges? I have access to the memory on a DS and tried jumping to 0x08000000 but it didn't appear to do anything, what's the correct procedure?

ARM7 will jump to 0x080000C0.
ARM9 is held in an infinite loop - write the ARM9 entry address to 0x027FFE24 when ready and it will jump there.
These details were taken from GBATEK.
There is a file, ndsloader.bin. If you concatenate this with a .nds file, it will produce a ROM you can write to a GBA flashcart which bootstraps the ARM7 and ARM9 binaries.

 

[gudenau]

ARM7 will jump to 0x080000C0.
ARM9 is held in an infinite loop - write the ARM9 entry address to 0x027FFE24 when ready and it will jump there.
These details were taken from GBATEK.
There is a file, ndsloader.bin. If you concatenate this with a .nds file, it will produce a ROM you can write to a GBA flashcart which bootstraps the ARM7 and ARM9 binaries.

So I need to do something like `mov r15, #0x080000C0` on ARM7 and make sure there's a `mov r15, $` at 0x027FFE24 and make ARM9 jump there?

My flash cart should support DS mode, shocking how easy this sounds.

 

[metroid maniac]

So I need to do something like `mov r15, #0x080000C0` on ARM7 and make sure there's a `mov r15, $` at 0x027FFE24 and make ARM9 jump there?

My flash cart should support DS mode, shocking how easy this sounds.

I don't understand, are you asking how to make a bootable slot-2 cartridge or are you asking how to boot a slot-2 cartridge in NDS mode?

 

[gudenau]

I don't understand, are you asking how to make a bootable slot-2 cartridge or are you asking how to boot a slot-2 cartridge in NDS mode?

I'm trying to get a SLOT-2 flash cart to run in a dev kit for dubious reasons.

 

[FAST6191]

Depending upon the firmware/hardware revision there was a reason for passme2 which instead used save memory I believe it was. Flashme can do what it likes (custom firmware after all).

That said if this is more about using a GBA flash cart as extra space (presumably for code in this instance, on the rare occasions I do anything here I tend to want bulk data or extra RAM for homebrew that I probably did not write) then yeah I don't think there are any particularly exotic incantations needed.

 

[aoikurayami]

Let's not forget that some "newer" phats were able to gain backlight adjust with Flashme...

I wonder what happened to that other replacement FW for NDS...

https://www.darkfader.net/ds/
http://dspassme.jzdocs.com/FlashMe.shtml
https://www.gamebrew.org/wiki/FlashMe

(@FAST6191 are you allergic to links ?)

 

[metroid maniac]

I'm trying to get a SLOT-2 flash cart to run in a dev kit for dubious reasons.

If you want to keep this simple, just concat ndsloader.bin to an .nds file, and write the resulting file to your flashcart.

cat ndsloader.bin myfirmware.nds > myfirmware.ds.gba

I have attached ndsloader.bin as part of the dslazy tool.

If you wanna get a bit more complicated than that, take a look at the scfw.s file from this project I started a little while ago. You can discard the Supercard specific function, but this assembly program shows how you can make a slot-2 ROM which chainloads an embedded _mb.gba or .nds binary.

 

[gudenau]

Depending upon the firmware/hardware revision there was a reason for passme2 which instead used save memory I believe it was. Flashme can do what it likes (custom firmware after all).

That said if this is more about using a GBA flash cart as extra space (presumably for code in this instance, on the rare occasions I do anything here I tend to want bulk data or extra RAM for homebrew that I probably did not write) then yeah I don't think there are any particularly exotic incantations needed.

It's to use it as a flash cart, I have dumped games that I want to use the devkit to stream without nuking/backing up save files. If I can use the slot-2 flash cart for that instead it would be super nice. Unless you know of a way for me to create my own backup carts for the dev unit, this might be the most viable path forward with this.

If you want to keep this simple, just concat ndsloader.bin to an .nds file, and write the resulting file to your flashcart.

cat ndsloader.bin myfirmware.nds > myfirmware.ds.gba

I have attached ndsloader.bin as part of the dslazy tool.

If you wanna get a bit more complicated than that, take a look at the scfw.s file from this project I started a little while ago. You can discard the Supercard specific function, but this assembly program shows how you can make a slot-2 ROM which chainloads an embedded _mb.gba or .nds binary.

Would that let you boot into GBA mode and launch a NDS ROM? I thought the hardware used write-once registers that could only be cleared via a hardware reset.

 

[metroid maniac]

Would that let you boot into GBA mode and launch a NDS ROM? I thought the hardware used write-once registers that could only be cleared via a hardware reset.

No, you have to be inside DS mode to continue running code in DS mode. PassMe/FlashMe do remain in DS mode.

 

[SylverReZ]

Let's not forget that some "newer" phats were able to gain backlight adjust with Flashme...

I wonder what happened to that other replacement FW for NDS...

https://www.darkfader.net/ds/
http://dspassme.jzdocs.com/FlashMe.shtml
https://www.gamebrew.org/wiki/FlashMe

(@FAST6191 are you allergic to links ?)

If I remember correctly, was DarkFader responsible for DS.Brick?

 

[metroid maniac]

If I remember correctly, was DarkFader responsible for DS.Brick?

Yep - I've been on a mission to find those files for a while, actually...

 

[SylverReZ]

Yep - I've been on a mission to find those files for a while, actually...

They're on Archive.org if you do a quick search.