Stargate 3DS - PCB and firmware

[moon_rabbit]

Front of STARGATE 3DS.
It has a SmartFusion2 fpga and an Atmel sam d11 ARM processor.

My guess is that the Atmel chip has something to do with USB or SD card communication.

Back of STARGATE 3DS.
I initially thought it would contain firmware for DS MODE and 3DS MODE, but after dumping the firmware, it turned out not to be the case.

SPI flash = W25Q16JV WSON-8 6x5mm.

SPI flash labeled UP.
1. Contains an ASCII table at the beginning.
2. Almost empty.
3. I'm guessing it has something to do with the Arm chip.
-UPDATE-
This is the SPI FLASH that holds the save file.

SPI flash labeled DOWN.
1. Seems to be a firmware that covers both alex rider(ds) and 3ds.
2. It stores the location of the current 3ds file at 1FF000h.


I only dumped one cartridge, so I don't know if it contains any specific data.

The only thing I saw was 1FF000h, which recorded the location of the 3ds file.
Saving it to a file on the SD card would be a better way, but I don't know why it's writing to the SPI FLASH.

I've attached the dumped firmware.
If anyone is interested, feel free to compare or analyze the firmware.

 

[SylverReZ]

Impressive work so far.

 

[moon_rabbit]

UPDATE 1
Atmel chip is related to USB communication.
It is connected to the two data pins of USB.

When connected to a computer using a micro USB cable, RGB(or Green) LED lights up and nothing happens.
If you hold down one of the buttons on the cartridge that is further away from the USB port while connecting the USB cable,
Red LED pops up and USB serial port appears on the computer.

I don't get any information from the serial monitor program.
I assume that if there is a program implemented, there must be a special command.
I don't know exactly what it is yet.

 

[moon_rabbit]

UPDATE 2 (final)
UP(SPI FLASH) has been corrupted by the act of connecting to the USB.
This corrupted the game's save and only worked after restoring the original data.

It is never recommended to connect the STARGATE 3DS to a USB.
UP(SPI FLASH) is associated with the game's save (SD card) and USB.

 

[4d1xlaan]

UPDATE 2 (final)
UP(SPI FLASH) has been corrupted by the act of connecting to the USB.
This corrupted the game's save and only worked after restoring the original data.

It is never recommended to connect the STARGATE 3DS to a USB.
UP(SPI FLASH) is associated with the game's save (SD card) and USB.

so if you use card2, that isn't a problem? since it saves directly to rom instead

 

[moon_rabbit]

so if you use card2, that isn't a problem? since it saves directly to rom instead

I haven't tried card2, so I don't know.
I thought it would have a widespread effect since so many points in the firmware were changed, but all I saw was a corrupted save.

 

[4d1xlaan]

I haven't tried card2, so I don't know.
I thought it would have a widespread effect since so many points in the firmware were changed, but all I saw was a corrupted save.

do those points keep changing every time you plug it in?

I never used gateway and I dont have one, but I read that you could work around a broken spi flash by converting all your games to card2 instead. if the same workaround works on stargate that could be pretty useful (and maybe the chip can last even longer too, if your games never use it to save)

 

[kijetesantakalu042]

Are you trying to reverse engineer the cart?

 

[moon_rabbit]

do those points keep changing every time you plug it in?

I never used gateway and I dont have one, but I read that you could work around a broken spi flash by converting all your games to card2 instead. if the same workaround works on stargate that could be pretty useful (and maybe the chip can last even longer too, if your games never use it to save)

I haven't seen how this changes since it's not possible to do an in-circuit dump.

Are you trying to reverse engineer the cart?

This is not possible due to my lack of knowledge.

 

[kijetesantakalu042]

This is not possible due to my lack of knowledge.

So what are you doing? Still looks cool so far.

 

[Jayro]

I don't get any information from the serial monitor program.
I assume that if there is a program implemented, there must be a special command.
I don't know exactly what it is yet.

There's also the possibility that something might need to be bridged on the board to enable it.
Either way, I love that you're reverse-engineering this thing. Maybe we can get a RP2040 version of this made someday on the cheap.

 

[SylverReZ]

There's also the possibility that something might need to be bridged on the board to enable it.
Either way, I love that you're reverse-engineering this thing. Maybe we can get a RP2040 version of this made someday on the cheap.

There was a DS flashcart in development called the DSPico, but so far there has never been any more updates since. I'm starting to feel like it's becoming vaporware, kinda similar to Crown3DS.

 

[Jayro]

There was a DS flashcart in development called the DSPico, but so far there has never been any more updates since. I'm starting to feel like it's becoming vaporware, kinda similar to Crown3DS.

The Gameboy flash cart using an RP2040 also never turned up. I guess it was very buggy. I wonder if they'll try again using the newer RP2350 chip. I'd also love to see the GB Interceptor get the RP2350 upgrade, maybe it could finally support color games.

 

[SylverReZ]

The Gameboy flash cart using an RP2040 also never turned up. I guess it was very buggy. I wonder if they'll try again using the newer RP2350 chip. I'd also love to see the GB Interceptor get the RP2350 upgrade, maybe it could finally support color games.

Which one was it? Never heard of a GB flashcart using a Pico.

 

[Jayro]

Which one was it? Never heard of a GB flashcart using a Pico.

https://www.reddit.com/r/raspberry_...0_powered_gameboy_cartridge_video_and_ama_in/

 

[SylverReZ]

https://www.reddit.com/r/raspberry_...0_powered_gameboy_cartridge_video_and_ama_in/

Wow, that board looks so clean. A shame that it didn't arrive in time, though.

 

[moon_rabbit]

There's also the possibility that something might need to be bridged on the board to enable it.
Either way, I love that you're reverse-engineering this thing. Maybe we can get a RP2040 version of this made someday on the cheap.

Since there is no direct connection from the ATMEL chip to the FLASH, I assume the FPGA programs it instead.
After testing a bit more, it seems that simply connecting it doesn't change data.
Most likely, it was the input with PuTTY that changed data.

 

[moon_rabbit]

I bought another one and it arrived today, but it has a save issue.
To check this out, you can make a save with 2 Zelda games and run them alternately and you should be able to figure it out.
My guess is that someone plugged it in and returned.
I'll take it apart and dump it just to be sure.

Post automatically merged: Nov 18, 2024

As expected,UP(SPI FLASH) was corrupted.
So I programmed an existing dump.
I tested it and it now saves properly.
If by any chance you have a Stargate 3ds that won't save, program the UP SPI FLASH.
If by any chance you have a Stargate 3ds that won't save, resolder the UP SPI FLASH.

Post automatically merged: Nov 18, 2024

UP (SPI FLASH) is the save file itself.
I haven't analyzed the save file, but when I look at the save file, it is exactly the same.
I didn't realize this until now.

I'm not exactly sure why it fails to save and then works when I program it.
Maybe it's write protection?
I'll have to investigate a bit more.

 

[Dragon_Types]

Will you make it run the later AP games?

 

[4d1xlaan]

To check this out, you can make a save with 2 Zelda games and run them alternately and you should be able to figure it out.

what happens though?

if you're able to reproduce the problem, can you test if converting to card2 bypasses the problem and lets it work correctly?

what about resetting the save data to factory default with save data filer or something?