Read and set individual pins of GBA port

Discussion in 'NDS - Emulation and Homebrew' started by mammastuffing, Oct 15, 2015.

  1. mammastuffing
    OP

    mammastuffing GBAtemp Regular

    Member
    107
    25
    Aug 7, 2015
    Hi,

    I'm trying to write software for the DS which allows me to overwrite the data on cheap bootleg games. Most of these bootlegs still have their WR pin attached and I've seen multiple examples where this has been done. However I have never seen it been done using a DS. So I'm trying to write something that allows me to flash these old bootlegs.

    I've never done any programming for the DS prior to this so this will be a first. Ideally I would like to access the pins of the GBA port by being able to set/read them.

    Any ideas how this can be done?
     
  2. Coto

    Coto GBAtemp Addict

    Member
    2,385
    426
    Jun 4, 2010
    Chile
    nor / flashcarts have embedded an onboard memory controller set up to mount itself as read-only (gba address) at 0x08000000 - 0x09ffffff (0x01ffffff addressable before it becomes a mirror each 32M). except the 0x0e000000 -- 0x0e00FFFF that uses 8 bit read/writes used for external save/read chip

    So you would have to need the onboard nor memory controller mapped somewhere (doubt is between the addresses listed above), then send commands of unlock/initialize (set idle instead locked read mode), so the chip is ready to receive commands such as read/write, then hack your nor read/write driver that handles dldi fat/plain sd controller commands if rom fetches are coming from slot 1, so they are written to onboard nor slot2. Something like ez 3 in 1 gba rom exploader does.

    I actually might get a clone gba cart for trying this, because I want to know if cloned game logic is using a hacked save handler or if saveram/eeprom/flashram is actually used. And that would mean a romhaxxed save handler (i really wonder if its doing the above to save/read in game)
     
  3. mammastuffing
    OP

    mammastuffing GBAtemp Regular

    Member
    107
    25
    Aug 7, 2015
    I'm not sure if I understand correctly. Do you mean that there is a register within the flash memory that can be altered to allow write to the rest of the memory?

    If that is the case it should be possible to iterate over every address in the cart and detect if it is writable somewhere? And if it is it should be an indication of where "commands" can be sent to the cart?
     
  4. Coto

    Coto GBAtemp Addict

    Member
    2,385
    426
    Jun 4, 2010
    Chile
    I would have to reverse engineer the save handler, but mostly , yes. Basically the memory controller onboard the GBA Cart is mapped at an address that the GBA CPU can reach. Or at least that's how gba exp loader did

    More like

    - reset from READ to PROGRAM mode

    - wait for idle

    - send WRITE once you got the word/halfword/byte from slot 1

    - repeat until all blocks have been written (say if the gba executable is given in bytes, and the WRITE NOR Command receives only halfwords (2 bytes), then romsize/2 of each WRITE command then iterate each address by 2.

    https://www.micron.com/~/media/documents/products/data-sheet/nor-flash/parallel/m29w/m29w_512mb.pdf

    Page 26.

    But again, I would/will need to see what the save handler does really.