Out of curiosity, how did you set up the NAND image for booting in No$GBA? I haven't found anything as to indicate what needs to be named what, nor what needs to be placed where. I should be getting my DSi back next week so I can dump my BIOS files that are needed, but it'd be nice to know what I need to name them and where they go. Or does No$ issue prompts when it attempts to boot from the DSi BIOS files?
Homebrew [RELEASE] TWLTool - DSi downgrading, save injection, etc multitool
- Thread starter WulfyStylez
- Start date
- Views 188,059
- Replies 728
- Likes 51
Yeah, LAUNCH_RIGHTS sounds somewhat like ticket or region error. But I am sure that I have the tickets & everything in the eMMC image. Only thing that might be wrong is that the bootcode in BIOS ROM might initialize a region flag or some AES keys which I am not aware of yet - that could cause stuff like region/decryption errors.
The error is fired here (in Launcher of european 1.4E firmware):
Code:
;------------------
;in: r0 = ptr to title_id,etc (2777800h)
; [r0+00h] = title.id.lsw = "PINH" (for camera)
; [r0+04h] = title.id.msw = 05,00,03,00
; [r0+08h] = 0007h
026A5778 B5F0 push r4-r7,r14
026A577A B085 add sp,-14h
026A577C 1C04 mov r4,r0 ;ptr to title.id, ...and... more info
026A577E F01EFEBB bl 26C44F8h ------> timer? sync? random?
026A5782 8920 ldrh r0,[r4,8h]
026A5784 0700 lsl r0,r0,1Ch ;\isolate bit3-1
026A5786 0F40 lsr r0,r0,1Dh ;/
026A5788 2803 cmp r0,3h
026A578A D10D bne 26A57A8h ;okay
026A578C 6820 ldr r0,[r4] ;title.id.lsw
026A578E 6861 ldr r1,[r4,4h] ;title.id.msw
026A5790 F024FDCC bl 26CA32Ch ------>
026A5794 2800 cmp r0,0h
026A5796 D007 beq 26A57A8h ;okay
026A5798 4939 ldr r1,=2798C40h
026A579A 6088 str r0,[r1,8h]
026A579C 2012 mov r0,12h ;tok_12h_txt_error_check_title_launch_rights_failed
026A579E F7FDFE69 bl 26A3474h ;errorThe notyet's are warning about unemulated I/O ports, either completely unemulated ones, or, in this case, only 32bit reads being unemulated (normally port 4004D00h is accessed in 16bit units, and I wasn't sure if the hardware does implement 32bit reading at all, although now mention it, I see some functions using 32bit reads for that I/O port).
That sounds like this code (from ARM7 boot sectors):
Code:
37B81A8 E59F0148 ldr r0,=3FFC400h
37B81AC E5D00220 ldrb r0,[r0,220h] ;[3FFC620h]
37B81B0 E3500000 cmp r0,0h
37B81B4 0A000000 beq 37B81BCh ;@@keep_keys
37B81B8 EB00065E bl 37B9B38h ;set_aes_key1x_and_key3_parts ;-AES (CPU ID)
@@keep_keys:1) it could contain the correct keys, then "bl 37B9B38h" would initialize some AES words.
2) it could be zerofilled, then "bl 37B9B38h" would be skipped (and the ROM bootcode be required to have already initialized that AES keys).
Either one should work on hardware (and no$gba). Not sure what happened in your case, sounds as if [3FFC620h] was nonzero, but also not containing the correct XOR values.
I've actually already modified my BIOSes with keys where they should be, thus why I was able to boot at all. The issue was specifically in boot2, at 0x37bB4c and 0x37b9b60. Then, if both of those were nopped to not write the invalid keyX parts, another would be thrown at 0x37B9B74. Patching that last one would finally give me a successful boot to the menu.
As for the menu failing out, I may look into it myself and tell you if I find anything interesting.
Ah, that'd be an issue and a half to solve then. We'd probably have to wait for this RSA signing to be reverse-engineered, if it ever does happen. I do have some ideas as to how to work around it, but I highly doubt it'd work.
Yes, that's in the function I talked of above. Ah, now I got it, you do probably have the correct keys in ROM/RAM (ie. are probably having a better dump than myself, I am only having zeroes at [3FFC620h..3FFC62Fh] , and then the non-emulated port 4004D00h reads are causing the problem.
If you could look into the menu problem would be fantastic!
My understanding is that RSA cannot be reversed. We are only having the public key (so we can decrypt/verify the signatures), but not the private key (so we cannot encrypt/generate signatures). Options would be stealing the private key from Nintendo, or brute-forcing the key, both unlikely to happen in next some centuries.
But you could probably use sudokuhax to load the launcher/shop manually, and then patch and execute it (eg. first use the unpatched launcher to start sudoku, then use the patched launcher to start an import game). One problem might be that the ARM7 SCFG registers are disabled, and the launcher might refuse to work state.
That's definitely a possibility. I'll play around with that once I get my DSi back next week and see what happens. I also happen to have a few tools that may do something, but I don't even know if they'll run let alone be of any use.
Edit: An interesting note I should perhaps make, but I was fooling around with a DSi I had a few years ago when the AceKard 2i was a thing, and I changed the language setting by using the DS BIOS rom through my AK2i, and for some reason some DSiWare actually failed to start even though I bought them (I think it was Mario Clock and Calculator that did this) although the DSi Main Menu was unaffected. Perhaps with this advent into the DSi I can investigate this and see if I can identify what caused it.
Edit 2: And it's shit like this why we should have a DSi section here.
Last edited by loco365,
I seem to have got the "LAUNCH_RIGHTS" error to disappear after adding some parital/fake emulation for the atheros wifi firmware upload. But after passing the "LAUNCH_RIGHTS" check, I am still getting "an error has occurred" displayed on the screen (maybe because the wifi firmware upload stuff is still incomplete, or maybe for some other reason).
Anyways, at the moment it doesn't make sense to debug what is going on in no$gba (v2.8b) since the current unreleased version is already fixed some of the problems.
Anyways, at the moment it doesn't make sense to debug what is going on in no$gba (v2.8b) since the current unreleased version is already fixed some of the problems.
- Joined
- Jan 7, 2014
- Messages
- 14,600
- Trophies
- 4
- Location
- Another World
- Website
- www.gbatemp.net
- XP
- 25,207
- Country
Well, I'm looking forward to the next version to take a look at DSiWare. Also, I'm predicting that my DSi will be back next week so I can take a look at WinterMute's BIOS dumping utility. Out of curiosity, what size of BIOS files do you have, and what size should I expect them to be if they're a proper, full dump with both upper and lower regions?
Yup, it'll be heading on its way to you Monday morning.
- Joined
- Jul 14, 2011
- Messages
- 305
- Trophies
- 1
- Location
- Somewhere
- Website
- www.tozeleal.orgfree.pt
- XP
- 1,380
- Country
What OS is twltool-v1.1.zip intended to be used with? I tried twltool.exe, and Win98 is telling me that I need a newer version of windows. Then I tried on a Win7 notebook, and that is telling me that I must find out if my OS is 32bit or 64bit (after doing that, I assume that I will then know if I am having a 32bit OS or 64bit OS, and that twltool doesn't work on it either way).
- Joined
- Feb 9, 2015
- Messages
- 321
- Trophies
- 0
- Age
- 31
- Location
- The state with lots of wives
- XP
- 428
- Country
I am using win7 64bit with no issues... might I ask why on earth you are using Win98?
Are you martin the creator of no$gba?
No S**t yes he is, give people here a clap! xd , He picked up on my PM Jhon591 from NGemu and was interested in this topic here for good reasons.
nocash, on win7s notebook right click on my computer see properties, it will tell you what the OS is under System type .
EDIT, don't forget if a system is 64bit and you are using a copy of 32bit windows you will have the same issue, Windows also has to match the PC max like 64bit windows for 64bit system, 32bit windows on 64bit pc no go, I'll check when I get home, my pc is 64 bit + win, Just a tip .
Last edited by drwhojan,
, Reason: added info
Yeah, it's a x64 executable. You need a 64 bit windows. Or just ask @WulfyStylez to compile a 32 bit version.
Source code should be with TWLTool, compiling a 32bit executable shouldn't be an issue, unless the cases aren't set up in the makefile. I'd try and compile a 32bit version myself, but I'm running VS2010, and I'm too lazy to update it right now. TWLTool was built in VS2012 without compatibility set so I can't open its solution file, ha ha
OK, compiled a 32 bit version. Uploaded the whole updated zip here.
EDIT: no longer needs the vs2013 dlls
Last edited by piratesephiroth,
-
DinohScene
That cat suit twink
-
-
-
-
@
TwoSpikedHands:
yall im torn... ive been hacking away at tales of phantasia GBA (the USA version) and have so many documents of reverse engineering i've done -
@
TwoSpikedHands:
I just found out that the EU version is better in literally every way, better sound quality, better lighting, and there's even a patch someone made to make the text look nicer
-
@
TwoSpikedHands:
Do I restart now using what i've learned on the EU version since it's a better overall experience? or do I continue with the US version since that is what ive been using, and if someone decides to play my hack, it would most likely be that version?
-
@
Sicklyboy:
@TwoSpikedHands, I'll preface this with the fact that I know nothing about the game, but, I think it depends on what your goals are. Are you trying to make a definitive version of the game? You may want to refocus your efforts on the EU version then. Or, are you trying to make a better US version? In which case, the only way to make a better US version is to keep on plugging away at that one
-
@
Sicklyboy:
I'm not familiar with the technicalities of the differences between the two versions, but I'm wondering if at least some of those differences are things that you could port over to the US version in your patch without having to include copyrighted assets from the EU version
-
@
TwoSpikedHands:
@Sicklyboy I am wanting to fully change the game and bend it to my will lol. I would like to eventually have the ability to add more characters, enemies, even have a completely different story if i wanted. I already have the ability to change the tilemaps in the US version, so I can basically make my own map and warp to it in game - so I'm pretty far into it!
-
@
TwoSpikedHands:
I really would like to make a hack that I would enjoy playing, and maybe other people would too. swapping to the EU version would also mean my US friends could not legally play it
-
@
TwoSpikedHands:
I am definitely considering porting over some of the EU features without using the actual ROM itself, tbh that would probably be the best way to go about it... but i'm sad that the voice acting is so.... not good on the US version. May not be a way around that though
-
-
@
The Real Jdbye:
@TwoSpikedHands just switch, all the knowledge you learned still applies and most of the code and assets should be the same anyway -
@
The Real Jdbye:
and realistically they wouldn't
be able to play it legally anyway since they need a ROM and they probably don't have the means to dump it themselves -
-
-
-
-
@
Karma177:
do y'all think having an sd card that has a write speed of 700kb/s is a bad idea?
trying to restore emunand rn but it's taking ages... (also when I finished the first time hekate decided to delete all my fucking files
) -
-
-
-
@
Karma177:
@The Real Jdbye it hasn't given me any error trying to write things on it so I don't really think it's faulty (pasted 40/50gb+ folders and no write errors)
-
-
@
DinohScene:
when SD cards/microSD write speeds drop below a meg a sec, they're usually on the verge of dying
@
DinohScene:
when SD cards/microSD write speeds drop below a meg a sec, they're usually on the verge of dying