Weird R4 Firmware.bin dump

[Jammyjoe05]

Hey all,
I am at my wits end trying to get this R4i-SDHC to work. I have managed to get it to boot with ntr launcher on stock kernel but it's behaving weird so I did a GM9 dump on it. I got a very weird ouput (at least its not similar to any examples I have seen...) and I was wondering what to do from here...
I have attached below the output from the firmware.bin and som images of my cart. Thanks in advance for any help!!!
p.s. I have other working flashcards, this one is sentimental. So yes I know I can replace it, but I want to fix it

 

[a_username_that_is_cool]

Looks like it's incomplete, FF and 00 are NULL bytes and I'm pretty sure that the file should cut off when it's gotten to the system memory/null bytes

 

[Jammyjoe05]

Looks like it's incomplete, FF and 00 are NULL bytes and I'm pretty sure that the file should cut off when it's gotten to the system memory/null bytes

ahh right. okay. I am new to this stuff but willing to learn.

It used to work before the 1.4.5E update but it then got blacklisted. I used cfw as an attempt to try enable it again.

Ultimately it would open through ntr launcher but it was acting up. Any suggestions as to how to fix this? I have attached the firmware bin below

 

[moon_rabbit]

https://github.com/DS-Homebrew/GodMode9i/blob/master/arm9/source/dumpOperations.cpp

The GM9 will not dump properly because it only contains EEPROM information from commercial cartridges.
You will need to use a programmer like ch341a to dump it.

 

[Patxinco]

https://gbatemp.net/download/firmwa...3ds-www-r4i-sdhc-com-english-clone-fix.37690/

 

[Jayro]

If you just need the correct firmware for the cartridge, I think @SylverReZ could point you to the right files.

 

[SylverReZ]

Hey all,
I am at my wits end trying to get this R4i-SDHC to work. I have managed to get it to boot with ntr launcher on stock kernel but it's behaving weird so I did a GM9 dump on it. I got a very weird ouput (at least its not similar to any examples I have seen...) and I was wondering what to do from here...
I have attached below the output from the firmware.bin and som images of my cart. Thanks in advance for any help!!!
p.s. I have other working flashcards, this one is sentimental. So yes I know I can replace it, but I want to fix it



View attachment 438615View attachment 438616View attachment 438613View attachment 438614
View attachment 438612

The flash dump is likely corrupted for all I know. Depending on the revision of cart you have, the firmware layout is different (except for the 2014+ carts).

If I find an unbricked firmware, I'll update the post.

 

[Jammyjoe05]

The GM9 will not dump properly because it only contains EEPROM information from commercial cartridges.
You will need to use a programmer like ch341a to dump it.

oh right ok. I will have a look at this!
It could be a bit over my current competencies but I love a challenge. is this example ok? (it won't let me do links yet):

Post automatically merged: May 23, 2024

The flash dump is definitely corrupted. There doesn't seem to be any title metadata or the ROM, and depending on the revision of cart you have, the firmware layout is different (except for the 2014+ carts).

If I find an unbricked firmware, I'll update the post.

ahhh that would be amazing!

Yeah thats what was confusing me, because I was using a thread on this forum (about changing a flashcards icon) as a reference, and their hex data stuff looked a lot different to mine...

When I used the debug screen in NTR Launcher this is what came up:
Detected Cart Name: TOP TF/SD DS
Detected Cart Game ID: TTDS

and this text file was dumped out in gm9 when I attempted to dump the cartridge:

 

[moon_rabbit]

oh right ok. I will have a look at this!
It could be a bit over my current competencies but I love a challenge. is this example ok? (it won't let me do links yet):
View attachment 438637

Yes, that's fine.
Sometimes it doesn't work well in-circuit.
In most cases, it's recommended to remove the EEPROM with a hot air station and solder it to the board before using it.
You can also use SOP-8 sockets without soldering.

 

[Jammyjoe05]

Yes, that's fine.
Sometimes it doesn't work well in-circuit.
In most cases, it's recommended to remove the EEPROM with a hot air station and solder it to the board before using it.
You can also use SOP-8 sockets without soldering.

Ahh ok. I do have a gas solder iron, however I have neglected the tips. I think it actually has a hot air attachment, but it's better if I can avoid soldering to be honest.

I have ordered it anyway as it was only a few quid

Post automatically merged: May 23, 2024

The flash dump is likely corrupted for all I know. Depending on the revision of cart you have, the firmware layout is different (except for the 2014+ carts).

If I find an unbricked firmware, I'll update the post.

Also, I don't know if it was clear in the images because I took them on my phone- The board itself says the words "B2-V1.1". I tried to find anything similar on the ntr team flashcart_core issues section (the post reply button is being super picky about what I say) but "Issue 14" on their repo was as close as I got.

(or potentially the "issue 35" one? except my one does not have the large chip on the back, it is just flat and red with the traces of the pcb showing).

 

[Jammyjoe05]

The flash dump is likely corrupted for all I know. Depending on the revision of cart you have, the firmware layout is different (except for the 2014+ carts).

If I find an unbricked firmware, I'll update the post.

any luck finding an unbricked firmware? A member in the discord channel also now needs the same firmware because we both... might have messed it up

 

[SylverReZ]

Also, I don't know if it was clear in the images because I took them on my phone- The board itself says the words "B2-V1.1". I tried to find anything similar on the ntr team flashcart_core issues section (the post reply button is being super picky about what I say) but "Issue 14" on their repo was as close as I got.

(or potentially the "issue 35" one? except my one does not have the large chip on the back, it is just flat and red with the traces of the pcb showing).

I've only got R4i backups for B2-V2.1 BO1 and B6-V2.B. I'll keep looking for you, and if not, then somebody else might provide their dump. Or, the other option is to buy another R4 card.

 

[Jammyjoe05]

I've only got R4i backups for B2-V2.1 BO1 and B6-V2.B. I'll keep looking for you, and if not, then somebody else might provide their dump. Or, the other option is to buy another R4 card.

Ahh I see, thank you for getting back to me! I was wondering though, considering this some form of DSTT/DSTTi clone, would it be possible to flash it with firmware from a different card?...of course provided it has the same insides

And on that; The discussions that I had with other people on this card point to the card's kernel not necessarily being the issue but rather the way it's handled by the DSI. The same card seemingly boots up on a 1.4 firmware DSi fine, however something prevents in from booting on firmware 1.4.5E.

Could simply editing the headers for the cart enable it to boot again, just as the title/icon can be changed? The card still boots to the stock kernel and even now jankily autoboots twighlight (although I cant switch between SD and the Cartridge). So as it stands, don't know whether the dump itself was a bad dump and maybe the card is not "bricked" as of yet... but it sure looks funky when I try to select it in NTRLauncher.

Maybe theres an issue with the patches on it. IIRC the card is meant to "automatically patch" itself, but maybe thats whats tripping it up.

Atp I don't really have an answer, but I will report back if/when this CH341A programmer arrives

(Also I had an idea for a future feature in TWL++ Menu although I understand that it is easier said than done: considering programs can detect what flashcard you have, would it not be feasible to have a flashcard setup utility. Run through the main SD, the utility would detect the card used in slot one and the files could be downloaded to the SD card and transferred to the flashcard with a computer... or the relevant install instructions with the folder names required, potentially demystifying the set up processes for some people. It could provide the option to autoboot twighlight or the dual boot option maybe. food for thought )

 

[SylverReZ]

Ahh I see, thank you for getting back to me! I was wondering though, considering this some form of DSTT/DSTTi clone, would it be possible to flash it with firmware from a different card?...of course provided it has the same insides

That depends on whichever flashcart you got. The r4i-sdhc.com 2014+ cards if I recall, all have the same boards with the marking of B6-V2.B (could be wrong, though). Just because this is a DSTT(i) clone, doesn't mean that flashing the firmware with an OG DSTT(i) firmware will work.

And on that; The discussions that I had with other people on this card point to the card's kernel not necessarily being the issue but rather the way it's handled by the DSI. The same card seemingly boots up on a 1.4 firmware DSi fine, however something prevents in from booting on firmware 1.4.5E.

The only thing keeping the cart from booting on newer firmwares is the flashcart's firmware, which is stored directly on the SPI flash chip. To put it in perspective, in order for the cartridge to boot, the ROM must be signed in order to bypass security checks, which is why you may see a different game on the HOME Menu, such as Danny Phantom or Alex Rider. These manufacturers use a retail ROM, while also adding a launcher to boot into the kernel. Without it, the flashcart would not otherwise be recognised by the system.

Nintendo has released multiple updates for the DSi and 3DS that update their cart blacklist, which is a hidden system title in the system's firmware that prevents certain carts and/or title IDs from starting, including flashcarts.

 

[Jammyjoe05]

That depends on whichever flashcart you got. The r4i-sdhc.com 2014+ cards if I recall, all have the same boards with the marking of B6-V2.B (could be wrong, though). Just because this is a DSTT(i) clone, doesn't mean that flashing the firmware with an OG DSTT(i) firmware will work.


The only thing keeping the cart from booting on newer firmwares is the flashcart's firmware, which is stored directly on the SPI flash chip. To put it in perspective, in order for the cartridge to boot, the ROM must be signed in order to bypass security checks, which is why you may see a different game on the HOME Menu, such as Danny Phantom or Alex Rider. These manufacturers use a retail ROM, while also adding a launcher to boot into the kernel. Without it, the flashcart would not otherwise be recognised by the system.

Nintendo has released multiple updates for the DSi and 3DS that update their cart blacklist, which is a hidden system title in the system's firmware that prevents certain carts and/or title IDs from starting, including flashcarts.

Ohh right I see what you mean now. Well one is pre 2014 iirc which might explain why it has a different board number.
I was wrong then! I see what you mean about the firmware issue. Is there a way to change this then with an appropriate SPI flasher? I would add that I am not that advanced. My card shows as Miami nights, so would it be feasible just to change the title ID?

If I sent the untrimmed gm9 output with the nds file would that be useful? or is there a better way to dump the flashcard firmware?

Post automatically merged: May 28, 2024

That depends on whichever flashcart you got. The r4i-sdhc.com 2014+ cards if I recall, all have the same boards with the marking of B6-V2.B (could be wrong, though). Just because this is a DSTT(i) clone, doesn't mean that flashing the firmware with an OG DSTT(i) firmware will work.


The only thing keeping the cart from booting on newer firmwares is the flashcart's firmware, which is stored directly on the SPI flash chip. To put it in perspective, in order for the cartridge to boot, the ROM must be signed in order to bypass security checks, which is why you may see a different game on the HOME Menu, such as Danny Phantom or Alex Rider. These manufacturers use a retail ROM, while also adding a launcher to boot into the kernel. Without it, the flashcart would not otherwise be recognised by the system.

Nintendo has released multiple updates for the DSi and 3DS that update their cart blacklist, which is a hidden system title in the system's firmware that prevents certain carts and/or title IDs from starting, including flashcarts.

I just opened the rom it uses with tinke and it looks really wrong

 

[Jammyjoe05]

I've only got R4i backups for B2-V2.1 BO1 and B6-V2.B. I'll keep looking for you, and if not, then somebody else might provide their dump. Or, the other option is to buy another R4 card.

**UPDATE**

I believe these two firmware bins could be the same. I used a HexFiend to compare them and it turned out that they were identical except for about 30 ish characters on line 3000? One is from a post which describes how to restore another flashcart from the same company:

TO CLARIFY: This restores the card to a working state after it has been bricked, in this case playing NDS roms. Once it is working again you can use the official flasher to revert it back to being able to use ntrboot.

Hey all,

Thanks to an oversight by the R4 team, loads of us were left with bricked r4i-B9S cards. But thanks to the help of so many people over on the thread below (I'll post the link at the end) there is now a method to unbrick the card!

I've provided the files in a zip below (links to their source will be below as well).

* Copy these files to your 3DS memory card
* Make sure your r4i-B9S card is in the gamecard slot
* Boot your 3DS holding start and select ntrboot_flasher from the chain loader
* Press A at the red screen and then select "R4iSDHC family"
* Press the "Restore flash" option and wait.

It should read the backup and then start writing the chunks one by one (32 in total). Once it is completed, when you boot your 3DS the gamecard should show up as Touch! Bomberman Land.

And that's it! You can now restore it to the B9S installer mode and back to the DS mode as normal using the official flasher from the r4i-SDHC website....

My card bricked itself seemingly after updating and would return a "Error: Bad header CRC" So nothing to lose here I guess.

Will update with progress!!

Post automatically merged: Jun 2, 2024

**UPDATE**

I believe these two firmware bins could be the same. I used a HexFiend to compare them and it turned out that they were identical except for about 30 ish characters on line 3000? One is from a post which describes how to restore another flashcart from the same company:

My card bricked itself seemingly after updating and would return a "Error: Bad header CRC" So nothing to lose here I guess.

Will update with progress!!

UPDATE IT FAILED!!! Trying other methods whilst I wait for a chip programmer

 

[moon_rabbit]

https://gbatemp.net/threads/r4isdhc-4-0b-released-kernel-is-now-expires-on-2024.522097/
Have you used this firmware before?
This is the r4isdhc.com firmware, but it's worth a try.

https://github.com/ntrteam/ntrboot_flasher/issues/103
There is also an ntrboot_flasher that supports forced write.

 

[Jammyjoe05]

https://gbatemp.net/threads/r4isdhc-4-0b-released-kernel-is-now-expires-on-2024.522097/
Have you used this firmware before?
This is the r4isdhc.com firmware, but it's worth a try.

https://github.com/ntrteam/ntrboot_flasher/issues/103
There is also an ntrboot_flasher that supports forced write.

Thank you for the reply!

I will give that a go but I am not holding out much hope

It keeps giving me a flashcart failed to setup when using a DSi so I am going to give it another go with the 3DS.

I think it is fully bricked, and I am going to have to wait till my chip programmer arrives. The tracking info says it should be here by the 12th...

Post automatically merged: Jun 3, 2024

https://gbatemp.net/threads/r4isdhc-4-0b-released-kernel-is-now-expires-on-2024.522097/
Have you used this firmware before?
This is the r4isdhc.com firmware, but it's worth a try.

https://github.com/ntrteam/ntrboot_flasher/issues/103
There is also an ntrboot_flasher that supports forced write.

Also I can't find a clean flash-rom anywhere, so I don't actually know what I could do to restore it even if I were to have a flash chip programmer...

I don't know what the relevance is but if I have the data sheet for the chip, could it use the same firmware as another card with the same chip or does that not correlate... I think it's a Maxcronix model with the number MX25L1635D

I see a lot of MX29.... being shown on other people's DSTT logs and dumps etc... but I don't understand these things enough to know whether the 29 or 25 at the start is anything other than a hardware revision or something else.

I have attached the data sheet below in case someone has any info I can use

 

[moon_rabbit]

MX29 series looks different from a regular SOP-8 EEPROM.
Neoprogrammer will show you how the chip should be connected to the CH341A.
It's easy to get if you google it.

The MX25L1635D looks like a normal spi25 connection.

If you have the same card, it will be easier to recover.
I don't expect firmware on the internet to be much different.
Didn't get any firmware?

 

[Jammyjoe05]

MX29 series looks different from a regular SOP-8 EEPROM.
Neoprogrammer will show you how the chip should be connected to the CH341A.
It's easy to get if you google it.


View attachment 440560

The MX25L1635D looks like a normal spi25 connection.

If you have the same card, it will be easier to recover.
I don't expect firmware on the internet to be much different.
Didn't get any firmware?

Thank you for this. I will use this when I try fix it! I didn't find any firmware files specifically for my one though.

I tried your firmware but it didnt work I keep getting invalid CRC error when using NTR Launcher and it makes my 3ds freeze when I put it in.

The card also no longer appears as a card in my dsi as I think the header error means there's no title in it. Also in flashing this new firmware which I was trying to use, the card dump now shows as touch bomberman?, and that is a bit confusing as it used to have a Miami nights icon... but thats only when I dump it in NTRFLASHER as GM9 doesn't recognise it as having anything on there. It shows as an empty cart.

(Aside from the technical side, I'm so annoyed at myself because I should have just left it. Support may have been added later on to make it usable but I had to go and try update it and mess it up :/)