What Is The ATF01 chip

Discussion in 'R4 DS' started by reveng, Dec 28, 2007.

Dec 28, 2007

What Is The ATF01 chip by reveng at 3:57 AM (10,112 Views / 0 Likes) 31 replies

  1. reveng
    OP

    Member reveng GBAtemp Regular

    Joined:
    Dec 16, 2007
    Messages:
    127
    Country:
    United States
    Does anyone know what the ATF01 chip is on the R4DS board?

    [​IMG]

    Its manufacturer and part number?

    Is it an ASIC?
    Is it an FPGA?
    Is it something else .....


    Cheers for any insights.
    R.....
     


  2. sylux92

    Member sylux92 GBAtemp Fan

    Joined:
    Apr 15, 2007
    Messages:
    445
    Country:
    United States
    Its definitely not an FPGA, it would be a lot more expensive if it had one.
     
  3. reveng
    OP

    Member reveng GBAtemp Regular

    Joined:
    Dec 16, 2007
    Messages:
    127
    Country:
    United States
    Agreed, also the pin count would be probabily larger.

    I've looked up the R4ds company's website,

    http://www.gelinelec.com/Product.asp?BigCl...e%20Accessories

    they seem to produce a lot of CD/DVD rom replacement parts so maybe its a simple DSP that they use on their CD/DVD peripherals!!!

    I spent a humongous 2 day googling session and came up with zilch, trawled thru a lot of chipmakers datasheets [​IMG]

    R....
     
  4. sylux92

    Member sylux92 GBAtemp Fan

    Joined:
    Apr 15, 2007
    Messages:
    445
    Country:
    United States
    Where didyou get that information?
     
  5. Grimalkin

    Member Grimalkin Waaaaaaaah!

    Joined:
    Jun 9, 2006
    Messages:
    1,173
    Country:
    Canada
    All I got from searching is that it's: "a controller chip."

    Every other website is in Russian.
     
  6. reveng
    OP

    Member reveng GBAtemp Regular

    Joined:
    Dec 16, 2007
    Messages:
    127
    Country:
    United States
    Mega google session, I think I typed in "R4DS China" and sorta found it.


    R..
     
  7. reveng
    OP

    Member reveng GBAtemp Regular

    Joined:
    Dec 16, 2007
    Messages:
    127
    Country:
    United States

    Yeah, I got that "a controller chip" then followed the links and got nowhere, "no datasheet" sorta responces

    I think the ATMEL site might be a good place to scour, their chips begin with AT!!

    http://www.atmel.com

    look for something with 48pins and runs with maybe a 40mhz or multiples freq


    R...
     
  8. cory1492

    Member cory1492 GBAtemp Maniac

    Joined:
    Jun 23, 2005
    Messages:
    1,489
    Location:
    Home, WhereElse?
    Country:
    Canada
    It's a custom asic, meaning they likely made the die themselves or contracted a manufacturer to make it specific for their purpose (hence both epoxied bump and chip packages, and definitely no public datasheets or actel overheads like cost.)
     
  9. reveng
    OP

    Member reveng GBAtemp Regular

    Joined:
    Dec 16, 2007
    Messages:
    127
    Country:
    United States
    I agree its probibaly a custom chip, but even if it is, Datasheet information can still be attained for the components used within the chip. I.E microcontroller core, memory controller, dsp... as these are usually off the shelf components.

    For example:

    Atmel customer specific ICs

    So a lot of information could be gleemed...

    Its not for anything serious I'm just curious about the hardware and its functionality.

    R....
     
  10. reveng
    OP

    Member reveng GBAtemp Regular

    Joined:
    Dec 16, 2007
    Messages:
    127
    Country:
    United States
    If anyone knows what language the R4DS Firmware is in, 8051, Arm, Pics, Zilog ...?

    That would tell us what core to look for on the Silicon.
    Also could run in thru a disassembler and see if we could figure what other bits might be on the Silicon with the Core.


    R....
     
  11. cory1492

    Member cory1492 GBAtemp Maniac

    Joined:
    Jun 23, 2005
    Messages:
    1,489
    Location:
    Home, WhereElse?
    Country:
    Canada
    You would need to get a dump of the firmware (provided it is not hard wired to work a specific way wrather than being a processor with firmware/data areas) before you could say. It's unlikely that such data is even dumpable without significant work (aka: microprobes, xray, die dissection, timing attacks etc.) It might be interesting to see what the leads that aren't attached to anything are actually doing, you'd never know unless you check (and have the tools available to check with) - could even be some form of jtag/boundary scan or similar interface.

    Not going to say it isn't an atmel, but ATF could be anything - even just a acronym for an internal name printed on just to keep their lines sorted and give visual queues for inspectors... for example - "asic trans flash V01 August 12" could easily explain the silkscreen.

    http://en.wikipedia.org/wiki/Application-s...egrated_circuit
    Do realize that a custom ASIC is not the same thing as a FPGA, mainly for the fact that an FPGA is re-programmable. There is no need to run any specific known core as they are generally set up to "emulate" after a fashion complex circuitry (though they can emulate cores, like ARM implemented on an actel). In the R4's case, they are implementing two serial interfaces to an SD interface and a fairly significant (when talking about asics at any rate) chunk of embedded data memory which apparently is not updateable - and even possibly some form of crypt engine to deal with DS boot up.
     
  12. reveng
    OP

    Member reveng GBAtemp Regular

    Joined:
    Dec 16, 2007
    Messages:
    127
    Country:
    United States
    Hi Cory,
    Thanks for the responce, yes I am aware the differences in FPGA's over ASICs, with FPGA more like designing/programming your own silicon over the ASIC's off the shelf solutions (very simplistic analogy).

    I only made the slight assertion that the chip could be a ASIC it may be something entirely different. The parts count on the R4 board is so small, it screams of a high level of intergration and of course makes it really diffictult to investigate whats under the hood.

    Holes see in all these devices to be investigated are.
    1) Firmware or OS updates (although this just seems to be the NDS boot loader)
    2) Price (cheap somestime means low off the shelf tech).
    3) The signal busses. (device to flash, device to NDS) cant see that giving much away.
    4) Find a really early version of the R4 cart in the hope that the circuitry was unrefined.

    Unfortunately I havent got the tools to polish away micons to expose the layers, actually or the patience, [​IMG]
    Ohhh wouldnt a JTAG interface be nice [​IMG] , guess we'll never know what the unused pins are?

    I cant see why all the secrecy surrounds what is exactly in these "flash Card" devices. If you look at the last 24c3 conference you will be overwhelmed by the amount of information "Hackers/Homebrewers" put out. I suppose its all about money and competition at the end of the day, which is a shame as knowledge is power... Afterall these devices are based on the ground work of others that freely put the information out there, Dark Fader, Natrium ect....

    Innovation comes from experimentation, secrecy stifles innovation.
    Early mods like the Xbox/Xodus stuff gave out much more information.
    Shame TeamXodus didnt stick to that mindset on the DS Xtreme [​IMG] .

    Still my lust for wanting to know whats under the hood remains...

    R....

    P.S the 24c3 hacking the xbox360 is a good youtube watch, a simple 16bit compare instruction flaw, how we laughed. [​IMG]
    Yeah, I know Microsoft have patched it, but the reverse engineering journey was a joy to watch. Maybe I'll go to the conference next year, looks more fun the E3, GDC, AGC....

    Disclaimer:
    I'm not at all interested at all in the "backup" functionality of these cards, just their potential for development and a desire for knowledge...
     
  13. reveng
    OP

    Member reveng GBAtemp Regular

    Joined:
    Dec 16, 2007
    Messages:
    127
    Country:
    United States
    If anyone has got any DEAD R4DS they would like to sent me, I'd love to dissolve the epoxy blob off the chip and look whats inside.

    Let me know.

    R....
     
  14. ackers

    Member ackers GBAtemp Advanced Fan

    Joined:
    Jul 17, 2007
    Messages:
    990
    Country:
    United Kingdom
    What does that mean? And speak English please I have no idea what you and cory are talking about [​IMG]
     
  15. Grimalkin

    Member Grimalkin Waaaaaaaah!

    Joined:
    Jun 9, 2006
    Messages:
    1,173
    Country:
    Canada
    It's obviously him signing his alias on every post:

    R = reveng.

    And, if you don't understand what they're posting then don't post. Their posts are clearly in legible English.

    reveng: I might have a spare R4DS laying around. I'll try to find it, it was my old spring version of the R4DS if that matters to you.
     
  16. ackers

    Member ackers GBAtemp Advanced Fan

    Joined:
    Jul 17, 2007
    Messages:
    990
    Country:
    United Kingdom
    I didn't mean it in a nasty way. It's just that I don't understand what "microprobes, xray, die dissection, timing attacks etc." are. I don't speak geek, so whatever.

    And what's the point in signing it 'R....' it's not like we can't read his name above his avatar.
     
  17. Grimalkin

    Member Grimalkin Waaaaaaaah!

    Joined:
    Jun 9, 2006
    Messages:
    1,173
    Country:
    Canada
    Eh, I see... Although, most of this information can be found via google. [​IMG]

    Also, I agree. The R... is getting annoying to look at.
     
  18. reveng
    OP

    Member reveng GBAtemp Regular

    Joined:
    Dec 16, 2007
    Messages:
    127
    Country:
    United States
    [​IMG] [​IMG]

    Sorry you could not understand Ackers, let me try and explain some stuff.

    There are two versions of the R4DS circuitboard one with a ceramic chip and the other with the chip just glued on the cicuit board with a blob of Epoxy resin see above.

    Myself and Cory where just engaged in a debate over what the ATF01 chip is on the circuit board and the techniques you could employ to find out. "microprobes, xray, die dissection, timing attacks etc." are those techniques...

    Unfortunately humans being humans we use a lot of abbreviations, "how many of your friends do you address with their full names?". Software Engineering has so many abbreviations "acronyms" it makes things difficult to follow, even for an engineer [​IMG]

    Here's some of the Acronyms, just click on the links.
    CPU's
    FPGA's
    ASIC's
    JTAG
    DarkFader
    Natrium
    24C3
    E3
    GDC
    AGC

    The rest I will leave up to you and your web browser to seek out all that is unknown [​IMG]

    If you find out anything about the ATF01 in your research be sure to post it here.
     
  19. reveng
    OP

    Member reveng GBAtemp Regular

    Joined:
    Dec 16, 2007
    Messages:
    127
    Country:
    United States
    Hi Grimalkin,

    If its the circuit board with the chip glued thats the one im interested in.
    Hopefully I might be able to dissolve the epoxy with the chip in situ.
    That would then give us the info on what connections are going to the Die.

    If the springs broken the cart still usually works, mines been broken from almost day one...

    thanks again for the offer, much appreciated, but dont send it if its still fuctional keep it as a backup.
     
  20. Grimalkin

    Member Grimalkin Waaaaaaaah!

    Joined:
    Jun 9, 2006
    Messages:
    1,173
    Country:
    Canada
    Seeing as I have like.. 5 flash carts. Functional or not, it doesn't matter to me. (And yes, it still works. Including the spring)

    I'm still looking for it, but I had to go to work. So I'll reply later on tonight.

    EDIT Off-Topic: Woo, 800 posts.
     

Share This Page