Hacking What Is The ATF01 chip

reveng

Well-Known Member
OP
Member
Joined
Dec 16, 2007
Messages
127
Trophies
0
XP
4
Country
United States
Does anyone know what the ATF01 chip is on the R4DS board?

R4DSSide1_s.jpg


Its manufacturer and part number?

Is it an ASIC?
Is it an FPGA?
Is it something else .....


Cheers for any insights.
R.....
 

reveng

Well-Known Member
OP
Member
Joined
Dec 16, 2007
Messages
127
Trophies
0
XP
4
Country
United States
Its definitely not an FPGA, it would be a lot more expensive if it had one.

Agreed, also the pin count would be probabily larger.

I've looked up the R4ds company's website,

http://www.gelinelec.com/Product.asp?BigCl...e%20Accessories

they seem to produce a lot of CD/DVD rom replacement parts so maybe its a simple DSP that they use on their CD/DVD peripherals!!!

I spent a humongous 2 day googling session and came up with zilch, trawled thru a lot of chipmakers datasheets
wacko.gif


R....
 

reveng

Well-Known Member
OP
Member
Joined
Dec 16, 2007
Messages
127
Trophies
0
XP
4
Country
United States
All I got from searching is that it's: "a controller chip."

Every other website is in Russian.


Yeah, I got that "a controller chip" then followed the links and got nowhere, "no datasheet" sorta responces

I think the ATMEL site might be a good place to scour, their chips begin with AT!!

http://www.atmel.com

look for something with 48pins and runs with maybe a 40mhz or multiples freq


R...
 

cory1492

Well-Known Member
Member
Joined
Jun 23, 2005
Messages
1,497
Trophies
1
Location
Home, WhereElse?
XP
334
Country
Canada
It's a custom asic, meaning they likely made the die themselves or contracted a manufacturer to make it specific for their purpose (hence both epoxied bump and chip packages, and definitely no public datasheets or actel overheads like cost.)
 

reveng

Well-Known Member
OP
Member
Joined
Dec 16, 2007
Messages
127
Trophies
0
XP
4
Country
United States
It's a custom asic, meaning they likely made the die themselves or contracted a manufacturer to make it specific for their purpose (hence both epoxied bump and chip packages, and definitely no public datasheets or actel overheads like cost.)

I agree its probibaly a custom chip, but even if it is, Datasheet information can still be attained for the components used within the chip. I.E microcontroller core, memory controller, dsp... as these are usually off the shelf components.

For example:

Atmel customer specific ICs

So a lot of information could be gleemed...

Its not for anything serious I'm just curious about the hardware and its functionality.

R....
 

reveng

Well-Known Member
OP
Member
Joined
Dec 16, 2007
Messages
127
Trophies
0
XP
4
Country
United States
If anyone knows what language the R4DS Firmware is in, 8051, Arm, Pics, Zilog ...?

That would tell us what core to look for on the Silicon.
Also could run in thru a disassembler and see if we could figure what other bits might be on the Silicon with the Core.


R....
 

cory1492

Well-Known Member
Member
Joined
Jun 23, 2005
Messages
1,497
Trophies
1
Location
Home, WhereElse?
XP
334
Country
Canada
You would need to get a dump of the firmware (provided it is not hard wired to work a specific way wrather than being a processor with firmware/data areas) before you could say. It's unlikely that such data is even dumpable without significant work (aka: microprobes, xray, die dissection, timing attacks etc.) It might be interesting to see what the leads that aren't attached to anything are actually doing, you'd never know unless you check (and have the tools available to check with) - could even be some form of jtag/boundary scan or similar interface.

Not going to say it isn't an atmel, but ATF could be anything - even just a acronym for an internal name printed on just to keep their lines sorted and give visual queues for inspectors... for example - "asic trans flash V01 August 12" could easily explain the silkscreen.

http://en.wikipedia.org/wiki/Application-s...egrated_circuit
Do realize that a custom ASIC is not the same thing as a FPGA, mainly for the fact that an FPGA is re-programmable. There is no need to run any specific known core as they are generally set up to "emulate" after a fashion complex circuitry (though they can emulate cores, like ARM implemented on an actel). In the R4's case, they are implementing two serial interfaces to an SD interface and a fairly significant (when talking about asics at any rate) chunk of embedded data memory which apparently is not updateable - and even possibly some form of crypt engine to deal with DS boot up.
 

reveng

Well-Known Member
OP
Member
Joined
Dec 16, 2007
Messages
127
Trophies
0
XP
4
Country
United States
You would need to get a dump of the firmware (provided it is not hard wired to work a specific way wrather than being a processor with firmware/data areas) before you could say. It's unlikely that such data is even dumpable without significant work (aka: microprobes, xray, die dissection, timing attacks etc.) It might be interesting to see what the leads that aren't attached to anything are actually doing, you'd never know unless you check (and have the tools available to check with) - could even be some form of jtag/boundary scan or similar interface.

Not going to say it isn't an atmel, but ATF could be anything - even just a acronym for an internal name printed on just to keep their lines sorted and give visual queues for inspectors... for example - "asic trans flash V01 August 12" could easily explain the silkscreen.

http://en.wikipedia.org/wiki/Application-s...egrated_circuit
Do realize that a custom ASIC is not the same thing as a FPGA, mainly for the fact that an FPGA is re-programmable. There is no need to run any specific known core as they are generally set up to "emulate" after a fashion complex circuitry (though they can emulate cores, like ARM implemented on an actel). In the R4's case, they are implementing two serial interfaces to an SD interface and a fairly significant (when talking about asics at any rate) chunk of embedded data memory which apparently is not updateable - and even possibly some form of crypt engine to deal with DS boot up.

Hi Cory,
Thanks for the responce, yes I am aware the differences in FPGA's over ASICs, with FPGA more like designing/programming your own silicon over the ASIC's off the shelf solutions (very simplistic analogy).

I only made the slight assertion that the chip could be a ASIC it may be something entirely different. The parts count on the R4 board is so small, it screams of a high level of intergration and of course makes it really diffictult to investigate whats under the hood.

Holes see in all these devices to be investigated are.
1) Firmware or OS updates (although this just seems to be the NDS boot loader)
2) Price (cheap somestime means low off the shelf tech).
3) The signal busses. (device to flash, device to NDS) cant see that giving much away.
4) Find a really early version of the R4 cart in the hope that the circuitry was unrefined.

Unfortunately I havent got the tools to polish away micons to expose the layers, actually or the patience,
blink.gif

Ohhh wouldnt a JTAG interface be nice
unsure.gif
, guess we'll never know what the unused pins are?

I cant see why all the secrecy surrounds what is exactly in these "flash Card" devices. If you look at the last 24c3 conference you will be overwhelmed by the amount of information "Hackers/Homebrewers" put out. I suppose its all about money and competition at the end of the day, which is a shame as knowledge is power... Afterall these devices are based on the ground work of others that freely put the information out there, Dark Fader, Natrium ect....

Innovation comes from experimentation, secrecy stifles innovation.
Early mods like the Xbox/Xodus stuff gave out much more information.
Shame TeamXodus didnt stick to that mindset on the DS Xtreme
mad.gif
.

Still my lust for wanting to know whats under the hood remains...

R....

P.S the 24c3 hacking the xbox360 is a good youtube watch, a simple 16bit compare instruction flaw, how we laughed.
biggrin.gif

Yeah, I know Microsoft have patched it, but the reverse engineering journey was a joy to watch. Maybe I'll go to the conference next year, looks more fun the E3, GDC, AGC....

Disclaimer:
I'm not at all interested at all in the "backup" functionality of these cards, just their potential for development and a desire for knowledge...
 

reveng

Well-Known Member
OP
Member
Joined
Dec 16, 2007
Messages
127
Trophies
0
XP
4
Country
United States
If anyone has got any DEAD R4DS they would like to sent me, I'd love to dissolve the epoxy blob off the chip and look whats inside.

Let me know.

R....
 

Grimalkin

Waaaaaaaah!
Member
Joined
Jun 9, 2006
Messages
1,173
Trophies
0
Website
Visit site
XP
141
Country
Canada
R....

What does that mean? And speak English please I have no idea what you and cory are talking about
huh.gif

It's obviously him signing his alias on every post:

R = reveng.

And, if you don't understand what they're posting then don't post. Their posts are clearly in legible English.

reveng: I might have a spare R4DS laying around. I'll try to find it, it was my old spring version of the R4DS if that matters to you.
 

ackers

Well-Known Member
Member
Joined
Jul 17, 2007
Messages
990
Trophies
0
Age
33
Website
Visit site
XP
126
Country
R....

What does that mean? And speak English please I have no idea what you and cory are talking about
huh.gif

It's obviously him signing his alias on ever post:

R = reveng.

And, if you don't understand what they're posting then don't post. Their posts are clearly in legible English.

reveng: I might have a spare R4DS laying around. I'll try to find it, it was my old spring version of the R4DS if that matters to you.
I didn't mean it in a nasty way. It's just that I don't understand what "microprobes, xray, die dissection, timing attacks etc." are. I don't speak geek, so whatever.

And what's the point in signing it 'R....' it's not like we can't read his name above his avatar.
 

Grimalkin

Waaaaaaaah!
Member
Joined
Jun 9, 2006
Messages
1,173
Trophies
0
Website
Visit site
XP
141
Country
Canada
I didn't mean it in a nasty way. It's just that I don't understand what "microprobes, xray, die dissection, timing attacks etc." are. I don't speak geek, so whatever.

And what's the point in signing it 'R....' it's not like we can't read his name above his avatar.

Eh, I see... Although, most of this information can be found via google.
tongue.gif


Also, I agree. The R... is getting annoying to look at.
 

reveng

Well-Known Member
OP
Member
Joined
Dec 16, 2007
Messages
127
Trophies
0
XP
4
Country
United States
What does that mean? And speak English please I have no idea what you and cory are talking about 
huh.gif

R4DSSide1_s.jpg
R4DSSide1Epoxy.jpg


Sorry you could not understand Ackers, let me try and explain some stuff.

There are two versions of the R4DS circuitboard one with a ceramic chip and the other with the chip just glued on the cicuit board with a blob of Epoxy resin see above.

Myself and Cory where just engaged in a debate over what the ATF01 chip is on the circuit board and the techniques you could employ to find out. "microprobes, xray, die dissection, timing attacks etc." are those techniques...

Unfortunately humans being humans we use a lot of abbreviations, "how many of your friends do you address with their full names?". Software Engineering has so many abbreviations "acronyms" it makes things difficult to follow, even for an engineer
wacko.gif


Here's some of the Acronyms, just click on the links.
CPU's
FPGA's
ASIC's
JTAG
DarkFader
Natrium
24C3
E3
GDC
AGC

The rest I will leave up to you and your web browser to seek out all that is unknown
smile.gif


If you find out anything about the ATF01 in your research be sure to post it here.
 

reveng

Well-Known Member
OP
Member
Joined
Dec 16, 2007
Messages
127
Trophies
0
XP
4
Country
United States
reveng: I might have a spare R4DS laying around. I'll try to find it, it was my old spring version of the R4DS if that matters to you.

Hi Grimalkin,

If its the circuit board with the chip glued thats the one im interested in.
Hopefully I might be able to dissolve the epoxy with the chip in situ.
That would then give us the info on what connections are going to the Die.

If the springs broken the cart still usually works, mines been broken from almost day one...

thanks again for the offer, much appreciated, but dont send it if its still fuctional keep it as a backup.
 

Grimalkin

Waaaaaaaah!
Member
Joined
Jun 9, 2006
Messages
1,173
Trophies
0
Website
Visit site
XP
141
Country
Canada
reveng: I might have a spare R4DS laying around. I'll try to find it, it was my old spring version of the R4DS if that matters to you.


Hi Grimalkin,

If its the circuit board with the chip glued thats the one im interested in.
Hopefully I might be able to dissolve the epoxy with the chip in situ.
That would then give us the info on what connections are going to the Die.

If the springs broken the cart still usually works, mines been broken from almost day one...

thanks again for the offer, much appreciated, but dont send it if its still fuctional keep it as a backup.

Seeing as I have like.. 5 flash carts. Functional or not, it doesn't matter to me. (And yes, it still works. Including the spring)

I'm still looking for it, but I had to go to work. So I'll reply later on tonight.

EDIT Off-Topic: Woo, 800 posts.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
  • ZeroT21 @ ZeroT21:
    it wasn't a question, it was fact
  • BigOnYa @ BigOnYa:
    He said he had 3 different doctors apt this week, so he prob there. Something about gerbal extraction, I don't know.
    +1
  • ZeroT21 @ ZeroT21:
    bored, guess i'll spread more democracy
  • LeoTCK @ LeoTCK:
    @K3Nv2 one more time you say such bs to @BakerMan and I'll smack you across the whole planet
  • K3Nv2 @ K3Nv2:
    Make sure you smack my booty daddy
    +1
  • LeoTCK @ LeoTCK:
    telling him that my partner is luke...does he look like someone with such big ne
    eds?
  • LeoTCK @ LeoTCK:
    do you really think I could stand living with someone like luke?
  • LeoTCK @ LeoTCK:
    I suppose luke has "special needs" but he's not my partner, did you just say that to piss me off again?
  • LeoTCK @ LeoTCK:
    besides I had bigger worries today
  • LeoTCK @ LeoTCK:
    but what do you know about that, you won't believe me anyways
  • K3Nv2 @ K3Nv2:
    @BigOnYa can answer that
  • BigOnYa @ BigOnYa:
    BigOnYa already left the chat
  • K3Nv2 @ K3Nv2:
    Biginya
  • BigOnYa @ BigOnYa:
    Auto correct got me, I'm on my tablet, i need to turn that shit off
  • K3Nv2 @ K3Nv2:
    With other tabs open you perv
  • BigOnYa @ BigOnYa:
    I'm actually in my shed, bout to cut 2-3 acres of grass, my back yard.
  • K3Nv2 @ K3Nv2:
    I use to have a guy for that thanks richard
  • BigOnYa @ BigOnYa:
    I use my tablet to stream to a bluetooth speaker when in shed. iHeartRadio, FlyNation
  • K3Nv2 @ K3Nv2:
    While the victims are being buried
  • K3Nv2 @ K3Nv2:
    Grave shovel
  • BigOnYa @ BigOnYa:
    Nuh those goto the edge of the property (maybe just on the other side of)
  • K3Nv2 @ K3Nv2:
    On the neighbors side
    +1
  • BigOnYa @ BigOnYa:
    Yup, by the weird smelly green bushy looking plants.
    K3Nv2 @ K3Nv2: https://www.the-sun.com/news/10907833/self-checkout-complaints-new-target-dollar-general-policies...