Hey All!​

I've been meaning to post this on some forum for a while just to get this information out there, but I managed to extract the save data from my legit Pokemon White Cartridge that 8 or so years ago, showed up with the blue screen of death:

In this post I'll describe my findings from disassembling the cartridge and reverse engineering it.
This did require cracking it open, but my hope is that this post will inspire discussion on how to fix it, and potentially come up with a solution to fix the cartridge itself

Now here's a bit of background and Prior steps I took:​

Don't try my method first!! Follow through with these steps first before cracking your cartridge open.

• I used to inject pokemon into my copy of pokemon white using the GTS and an online app.
• Years later, upon booting the game, the blue screen of death appeared. No startup screen, no nothing.
• I tried cleaning the contacts and the inside of my 3DS, no dice.
• I tried holding up-select-B to run the deletion process, blue screen again.
• I attempted to extract the save data using checkpoint or a similar tool, the save file was blank (all 0x00).
• I attempted to delete the save data using an external tool, no dice again.
• The last thing I did was crack the cartridge open and resolder the connectors in hopes of a loose connection fixing the issue. Nothing.
  • I speak from experience, don't try this UNLESS you have the proper equipment.
    • Microscope, Fine Tip Soldering Iron, Flux Pen, etc.
  • As an aside, I tried to do it over COVID, but ended up joining some connections due to some shoddy equipment. Now that I attend an institution with the proper equipment, I was able to solder under a microscope with flux! I'm extremely lucky it reverted back to its original state.

You see just how frustrating it was to get NO results?? A lot of the forum posts that I've seen try to tackle this issue never seem to get past any of these steps, so I just decided to reverse engineer the damn thing.

The Process​

1. Assuming you've cracked open your cartridge, the pin in question we'll need to identify before anything else is contained on U3 indicated on the board with the white triangle, and in the picture with the red circle. You need to put this pin to ground. (Luckily there's a little slot for that.)
2. Next, you need to have some device that can communicate using SPI. We need to connect power supplies (GND -> 1/17, 3.3v -> 8) as well as SCK (2), CS (6) MOSI (15) and MISO (16). Again, the reference pinout can be found easily by searching "DS Cartridge Pinout" on the web.
3. For this particular save chip, we can confirm it works by Reading the Silicon ID. Enter the command 0x9F using your device, and the EEPROM should return 62 11 00. If this happens, your save may not be far from gone! You can still recover it!!
4. Now here's the big one. We need to read the entirety of the flash memory. As long as you keep the CLK going, it'll keep spitting out data, so all we need to do is keep the clock running long enough to export all relevant data. For Pokémon at least, remember that there are 24 dummy bits (3 Bytes) at the beginning of value 0x000000FF which indicate where the file starts. These MUST BE DELETED in order for it to work on an emulator. Then, read the rest of the 512kbytes of valuable information! To do this just plop in the read command 0x03 and let the data roll in.
5. Now save the data as a binary file with the extension .sav (don't forget to delete those dummy bits), and BOOM! You've got your save back. To confirm it works, import it into an emulator or PKHex.

Reverse Engineering and Architecture Breakdown:​

If you're interested in what my reverse engineering process was, I started by finding out each IC:

• U1 is the ROM. I didn't get a datasheet for this.
• U2 is an onboard CPU suprisingly! I wonder what it controls... Anyway I found a similar CPU's datasheet (RENESAS H838602R) and I'll be using this one's particular port mapping.
• U3 is an OR gate. This took quite a bit of testing to find out, but we'll need to keep this particular chip in mind.
• U4 is the Flash Memory! And here's the chip (Sanyo LE25FW403A)

Those were all the ones I Identified.

Now what I had found from trying to extract the memory before is that U3 (the OR gate) is a protective measure from reading/writing the memory, controlled by U2 (the CPU). It's particular inputs are the onboard CPU and CS2 (pin 6) on the cartridge pinout (can easily be found on the web), and it outputs to the CS on the flash memory.
Now what was going on when I supplied power to the cartridge was that the CPU was providing a HIGH voltage to the OR gate, effectively blocking the CS2 pin from controlling the CS pin on the flash memory. To neutralize it, I shorted the CPU's input pin (p83) to ground, now CS2 controls the CS pin

With this out the way we can dump the full contents of memory without the pesky OR gate getting in the way.


Soooo yeah. As the first image shows, I was able to get my save data from years back!
Maybe there's a way to reverse engineer the cartridge so that I and others can play on normal hardware again? Again, hopefully this inspires discussion on fixing this problem permanently!

Looking forward to hearing back everyone,
~Schollidazed.

 

[4d1xlaan]

so you didn't actually fix the error, why title the thread as if you did?

all that's gonna happen is that people will end up on this thread from an internet search and then be disappointed that it doesn't actually do what it claims to do

being able to recover save data is nice, but people expect to actually fix their game lol

 

[schollidazed]

so you didn't actually fix the error, why title the thread as if you did?

I'll remove the errant prefixes and tweak the title a bit if I can. But here's a few reasons:

1. This is at least some way to alleviate the issue, this extracting save data method wasn't anywhere before now.
2. My hope is that we can actually reach a proper solution here. I’ve included the technical info that I could find, and am willing to hit the ground running on this.
3. I was a little excited to get this information out there. Just wanted to share it somewhere helpful.

 

[AlamosIT]

Amazing!
This could be very helpful!