Hacking Sadly a clone card owner, just a single question.

[Jayro]

Can't the clone card devs just swap out the GW logos and version numbers with their own, and keep all functionality the same..?

 

[lambstone]

Can't the clone card devs just swap out the GW logos and version numbers with their own, and keep all functionality the same..?

Can't we swap out our eyes for cameras?

No. It really isn't that simple.

 

[Jayro]

But once decrypted, you can edit everything you want and re-encrypt with ease... I fail to see the difficulty in this. It seems no different than editing something like isolinux menu entries on an Ubuntu ISO image, saving it, and running it with the changes applied.

 

[Armadillo]

So, are all the pins on a game cart not used then? As there are spares left over for gateway jtag programming, or do they double up for another function when the cart is just used normally.

 

[Mr_Pichu]

But once decrypted, you can edit everything you want and re-encrypt with ease... I fail to see the difficulty in this. It seems no different than editing something like isolinux menu entries on an Ubuntu ISO image, saving it, and running it with the changes applied.

A lot of work that goes into making a clone card, so given the GW FPGA update, a new generation of clones is only possible after careful reverse engineering. Getting the support software right isn't an easy matter either, there is obfuscation, encryption, plus undoubtably other challenges. So no, it is not an easy matter to clone GW's magic.

After all the trouble in the scene, I am quite sure people will think twice before going the route of a cloned solution.

So, are all the pins on a game cart not used then? As there are spares left over for gateway jtag programming, or do they double up for another function when the cart is just used normally.

You design your hardware with the capability to update itself, this is done by incorporating the JTAG programming logic into your FPGA project. With the right software and design implementation the FPGA can literally program itself. As this feature was not exposed till now, the cloners could not reverse engineer it.

 

[Sparticus515]

But once decrypted, you can edit everything you want and re-encrypt with ease... I fail to see the difficulty in this. It seems no different than editing something like isolinux menu entries on an Ubuntu ISO image, saving it, and running it with the changes applied.

Linux is open source, GWs software is heavily obfuscated and requires a lot of work. Add to the fact that the software is designed to run specifically on Gateways hardware and not clone hardware and that adds an even bigger obstacle. Also, I've read that clones didn't connect pins to the JTAG header which makes updating the FPGA impossible without a hardware solution (but I don't know much about this so I'm not sure).

 

[Mr_Pichu]

Can't the clone card devs just swap out the GW logos and version numbers with their own, and keep all functionality the same..?

The GW secret sauce is in the FPGA and that is protected. Even with the updater the FPGA programming data is encrypted.

 

[tofast4u]

I emailed the R4i Deluxe 3DS team, and they emailed me back saying they will release an update very soon. I don't know if we should believe them but who knows a response is better than nothing, hopefully its not just empty promises.

 

[Saturosias]

With the right software and design implementation the FPGA can literally program itself.

Iirc, an FPGA's logic arrays can not reprogram themselves, they require an external device -- they can by themselves 'reprogram' the on-board SPI flash, however.

 

[mznova]

The physical FPGA aside, we should recall that the clone programmers STILL have not been able to steal Gateway's 2.0b2 firmware. They attempted to and caused a bricking fiasco and reverted back to 2.0b1, but pretending it was an "update". If they can't modify 2.0b2 which is just a tiny step up from 2.0b1, it is highly unlikely that they could replicate 2.1 Omega when the amount of new features and obscurity is huge. (By obscurity, I mean they probably made some changes to the FPGA to run their code in a different way than before)

 

[Saturosias]

They attempted to and caused a bricking fiasco and reverted back to 2.0b1, but pretending it was an "update".

Oh no no, they reverted to 1.2, far too scared to stick with EmuNAND (despite there still being no 2.0b1 brick reports, excluding one very questionable Spanish forum member).

 

[masterzero]

Oh no no, they reverted to 1.2, far too scared to stick with EmuNAND (despite there still being no 2.0b1 brick reports, excluding one very questionable Spanish forum member).

Yes lol , that guy prolly had 3.3 or 3.2 and didn't even care. I use myself 3.0 and no brick , which there shouldn't be even if the clone team guys told me they had some report because there can't be brick code there !!!

BTW don't be so sad , they have also replied me

SOON !!! XD will it be the same soon as gateway? Even then I would also like to think ( I'm not THAT desperate for a 2.0 tho , it's just to laugh on some people ) that an answer instead of just ignoring may mean something

 

[kyogre123]

SOON !!! XD will it be the same soon as gateway? Even then I would also like to think ( I'm not THAT desperate for a 2.0 tho , it's just to laugh on some people ) that an answer instead of just ignoring may mean something

Yes, it means that they don't want to lose sales.

By the way, the MT-Card has been out for a while...

 

[masterzero]

Yes, it means that they don't want to lose sales.

By the way, the MT-Card has been out for a while...

Maybe 4.0 is just adaptation of mt-card firmware. Which I would be happy enough because multirom would be enough for me and just for the commodity of not having to burn the games each time ( I don't like having multiple games to play just because I won't beat any that way...) , pokemon and AC are a bit useless without online.

I dunno , I think being the cheaper option they have no need to lie , I'm going to take their "Soon" like gateway users did , even if I'm not THAT desperate for a 2.0

I have sent them a mail anyways telling them it's good news and if it's a "Gateway soon" or something near next month XD

 

[DAHU75]

PLease post a link for this pictures on gateway and R4I or other

A couple of community members traced where the FPGA's JTAG pins lead to on the corresponding PCBs for both the Gateway and the Clone Carts and even posted pictures to show exactly how one could trace where these pins terminated.

On the Gateway, they lead to contacts placed facing towards the front of the cart. These were clearly meant to connect to the contacts on the cart slot of the 3DS when the Gateway Red Cart was inserted into the console.

In contrast, clone carts had these JTAG pins lead to contacts facing the back of the cart. These would not come into contact with anything when the clone cart is inserted into a 3DS. The contacts could, however, could possibly have been designed to be accessible through a separate, unknown specialized device.

.

 

[b00100100]

The GW secret sauce is in the FPGA and that is protected. Even with the updater the FPGA programming data is encrypted.

Microsemi's (ACTEL) FPGA's image files on these FPGA's were broken a while ago, and it is possible to read back the FPGA image even if the flag to encypt was turned on by GW. I'm 99% sure I could extract the GW FPGA firmware, but honestly I have more important things to spend my time on.

 

[b00100100]

Iirc, an FPGA's logic arrays can not reprogram themselves, they require an external device -- they can by themselves 'reprogram' the on-board SPI flash, however.

Depends on the FPGA actually... For these Microsemi (Actel) FPGA's, they are flashed based and do not have the ability of doing "partial reconfiguration" so you are correct that these Microsemi (Actel) FLASH based FPGA's can not reprogram themselves. For SRAM based FPGA's (Xilinx and ALtera), they lose their image on each powercycle and get programmed automatically from a boot flash memory device. I've actually written FPGA code that would request new FPGA's over Ethernet, reprogram the FLASH memory via JTAG, and then after verifying it copied the image correctly the FPGA would kill itself and initiate a reprogram. It was a cool system I designed. Finally a lot of newer FPGAs are supporting "partial reconfiguration" and are coming integrated with different SOC's... Most of those FPGAs can support reprogramming themselves or at least a subset of themselves.

 

[Riku]

R4i Gold 3DS Deluxe:
http://i.imgur.com/sKIyxUC.jpg

Gateway 3DS:
http://i.imgur.com/SdLghCK.jpg

 

[DAHU75]

thanks Riku

ave you where the pin jtag go to the chip tor pins nimber on gateway?

same picture for gateway that R4I witch tck,td0,td1 etc

thanks you

 

[Riku]

I have a question for you guys: do you have any confirmation of OMEGA update actually reprogramming FPGA via JTAG and not just updating part stored on SPI? Because you don't need JTAG for that and this may be the reason for R4 making decision removing it in first place. So there's still a small hope left.