Hacking WTH: SLC NAND, NAND Saving, AP?

[3DSGuy]

With Gateway3DS, new 3DS Cards, NAND saving and Anti Piracy all up in the air, it's causing some confusion. So it's time remove the confusion.

New 3DS Cards:
Developers have the option of choosing between two 3DS Game Cards when creating Game Card titles:

1. CARD1 - Which either uses no savedata, or an external EEPROM to store savedata. EEPROM sizes come in 128KB and 512KB. CCI data is written to a RO chip.
2. CARD2 - (support introduced in SDK 3.1.0) Which uses no external memory to store savedata. Instead savedata is stored on the chip with the CCI data. This is possible because CARD2 chips are a hybrid chip with both RO and RW sections. The CCI data is written to the RO section and the save is written to the RW section. There is an offset specified in the CCI header which tells the 3DS where the writable region begins. The minimum savedata size is 1MB, and can be as large as the RW region. A cart dump of a such CARD2 gamecard would include the writable region, and hence any save data if it was made.

The first game to actually use a CARD2 game card, was "Animal Crossing: New Leaf" (AC:NL). Nintendo stated:

Stock of the packaged version of "Animal Crossing: New Leaf" ran short as we could not increase production due to its customized ROM card using SLC-NAND memory last year.

Source

SLC memory has the advantage of faster write speeds, lower power consumption and higher cell endurance... it [however] costs more per megabyte of storage to manufacture

Source

Does that mean CARD2 cards use SLC-NAND? No, Animal Crossing is a game where SLC-NAND was required to enable fast read/write access for loading the user generated content in the savedata. The only other game to use a CARD2 game card, is "Pokémon X/Y" (X/Y), uses a normal CARD2 chip.

Here are some images of CARD1/2 PCBs:

An image of a Standard CARD1 PCB without an EEPROM:

Spoiler

An image of a Standard CARD1 PCB with an EEPROM:

Spoiler

An image of a Standard CARD2 PCB:

Spoiler

NAND Saving:
Since the release of AC:NL , the term "NAND Saving" has been thrown around causing much misconception.

There are really only two valid uses of the term "NAND Saving":

1. In reference to Anti-Savegame Restore: In a nutshell, a random value is stored in the SDMC savedata, which is also stored in the 3DS' internal NAND, and the game checks to see if they match while the game is loading, thus preventing older saves from being used. You can read about it at 3DBrew.org. So far this is only used with downloadable versions of AC:NL and X/Y.
2. In reference to custom CARD2 gamecards which use an SLC-NAND (And hence the savedata is saved to the game's NAND chip). The only known game to use this is AC:NL. Do not confuse NAND saving with CARD2 gamecards in general.

NAND saving is NOT:

• Saving the game to the 3DS' internal NAND.
• Using a CARD1 gamecard with a special SLC-NAND savedata chip in place of an regular EEPROM chip for saving.

Anti-Piracy in 3DS Games:
It has been speculated that various 3DS games have Anti-Piracy (AP), as a growing number of 3DS ROMS do not work with Gateway-3DS(GW) flash card. There is actually no AP currently in 3DS games, and I'll explain each case:

1. AC:NL can't be played on GW. AC:NL crashes shortly after it attempts to load savedata. Gateway3DS apparently fails at emulating the RW region of CARD2 chips. I didn't create GW so don't ask me why.

2. X/Y(which is also a CARD2 gamecard BTW in case you forgot), Batman Arkham Origins Blackgate and Hometown Story 3DS, fail to even start. Well this is a firmware related issue, revolving around the location of the application's logo (This is not speculation). By logo I mean everything you see in this screenshot (Open Spoiler):

Spoiler

Applications built with SDKs prior to SDK 5.0.0 have the logo inside the ExeFS region of the application. With SDK 5.0.0 Nintendo decided to logo move it outside of the ExeFS region, un-encrypted (This was done prior to the announcement of GW). This of course meant the 3DS required a system update to know where to find the new location of the logo, this update was 5.0.0-11. GW runs on Firmwares 4.1.0-X to 4.5.0-X, which is why GW users were met with an error screen while attempting to launch these games.

Side Note: Not all games bundled with a 5.X.X update were built with SDK 5.0.0+. Which is why Mario & Luigi Dream Team Bros works fine.

3. Monster Hunter 4 (MH4) definitely seems like it has AP, but there are some things we need to consider.(Yes, this bit contains some speculation)

• MH4 was built with SDK 4.2.5 and was packaged with the 5.1.0-X update. And it was released on September 14, 2013, which makes the date of CAPCOM's Master ROM submission to Nintendo mid August at the latest. With Gateway's files being released on August 7, 2013, that gives CAPCOM very little time to implement AP.
• CAPCOM is a 3rd-Party developer, they do not have the resources to reverse engineer the effects the GW launcher has on the 3DS' firmware, especially in the short amount of time they had. Only Nintendo is really in a position to develop AP.
• Nintendo forbids developers from checking the speed of reading ROM/savedata as a way of detecting devices like GW. So knowing about GW wouldn't have helped CAPCOM.
• The Gateway team managed to fix the problem preventing MH4 from working much faster than sorting out the problems emulating CARD2 devices, which they will have "working for the 2.0 release, we will not stop until we have this working!". Sounds like the GW mode accidentally broke a function MH4 used.

All these problems are a result of GW's design, rather than a deliberate attempt to stop them from working on GW. In saying all this, don't be surprised if come FW 7.0.0-13 Pokemon and AC:NL need an update for online play. If any update is going to attempt to prevent emuNAND or redNAND piracy, it'll be FW 7.0.0-13.


EDIT: Wording, I often edit my posts to change wording/formatting. And sometimes spelling. I don't see why clarifying a sentence should require an "EDIT" remark, I haven't added anything new, or redacted anything.

EDIT2: Added a picture of a Pokémon X PCB

EDIT3: For those die hard fans of the dummy.txt MH4 AP theory, I made you the CIA file which would solve the problem(if it was real) DOWNLOAD. If/when a game actually checks that file, installing the linked CIA file will solve the problem.

EDIT4: Changed the wording for CARD2 so it was more accurate.

EDIT5: Re-wrote section about AC:NL save fail on GW, apparently I wasn't explicit enough.

EDIT6: Added links.

EDIT7: Quick re-wording.

 

[cearp]

so what was all that with that txt file that MH4 was looking for, or something like that? that wasn't AP? and, that isn't the reason why the rom didn't work on gateway?

 

[3DSGuy]

so what was all that with that txt file that MH4 was looking for, or something like that? that wasn't AP? and, that isn't the reason why the rom didn't work on gateway?

That wasn't AP, because it didn't happen. The minimum FW for MH4 is 5.1.0-X. That text file people were blaming for MH4 not working, was introduced in FW 6.3.0-12. There is no way MH4 could check for that file.

 

[hashcheck1]

love the research 3dsguy thanks for sharing

 

[Aurora Wright]

1. CARD2 - Which uses no external memory to store savedata. Instead savedata is stored on the ROM chip with the ROM data. There is simply an offset specified in the ROM header which tells the 3DS where it's safe to write savedata without overwriting the ROM data. The savedata size start with 1MB, and is limited by the size of the ROM chip. A ROM dump of such a chip would include savedata if savedata was created.

So if I'm not mis interpreting, this means the ROM chip isn't ROM at all, it's just a (rewritable) NAND... so with a dongle of sorts made for this purpose it would be possible to overwrite the game itself? (not taking into account the problems with a missing eeprom for games that need it for saving).

 

[b17bomber]

So it sounds like Gateway only has a fix for MH4, while all other stuff is WIP. Well waht if they never fix it, does that mean they just won't bother releasing 2.0, since they won't be able to sell any more cards?

 

[3DSGuy]

1. CARD2 - Which uses no external memory to store savedata. Instead savedata is stored on the ROM chip with the ROM data. There is simply an offset specified in the ROM header which tells the 3DS where it's safe to write savedata without overwriting the ROM data. The savedata size start with 1MB, and is limited by the size of the ROM chip. A ROM dump of such a chip would include savedata if savedata was created.

So if I'm not mis interpreting, this means the ROM chip isn't ROM at all, it's just a (rewritable) NAND... so with a dongle of sorts made for this purpose it would be possible to overwrite the game itself? (not taking into account the problems with a missing eeprom for games that need it for saving).

They don't use NAND memory (except for AC:NL), there are just RO/RW sections.

 

[robo989]

I call BS on basically everything in the OP as simply half layman's interpretation and half guess work.

Nicely written though

5/10

 

[robo989]

1. CARD2 - Which uses no external memory to store savedata. Instead savedata is stored on the ROM chip with the ROM data. There is simply an offset specified in the ROM header which tells the 3DS where it's safe to write savedata without overwriting the ROM data. The savedata size start with 1MB, and is limited by the size of the ROM chip. A ROM dump of such a chip would include savedata if savedata was created.

So if I'm not mis interpreting, this means the ROM chip isn't ROM at all, it's just a (rewritable) NAND... so with a dongle of sorts made for this purpose it would be possible to overwrite the game itself? (not taking into account the problems with a missing eeprom for games that need it for saving).

He's talking rubbish and just guessing.

NONE of the storage on the card apart from a SEPARATE chip is writable.

Trying to control my laughter here at the mere thought that someone thinks that game cartridges are re-writable but have a "hard coded" something or other stopping the game data being written to.

 

[MTSoph14]

Thanks for clearing everything up! This must have taken quite a bit of research

 

[3DSGuy]

He's talking rubbish and just guessing.

NONE of the storage on the card apart from a SEPARATE chip is writable.

Trying to control my laughter here at the mere thought that someone thinks that game cartridges are re-writable but have a "hard coded" something or other stopping the game data being written to.

Do you know what a micro controller is?

EDIT:

NONE of the storage on the card apart from a SEPARATE chip is writable.

And yet Pokemon X/Y magically save without a separate chip, must be Nintendo Magic.

 

[Pedeadstrian]

Do you know what a micro controller is?

I sure as hell don't, but that's why I'm not posting about this stuff. T'was an interesting read. In the end though, it pretty much all comes down to semantics. Knowing whether it's A or B doesn't really matter, since that won't make any vulnerabilities suddenly show up. Oh well. Hurray for information!

 

[porkiewpyne]

I call BS on basically everything in the OP as simply half layman's interpretation and half guess work.

Nicely written though

5/10

I call BS on basically everything this guy said.

Points were deducted for not knowing how to use the "Edit" function.

3/10

 

[hashcheck1]

He's talking rubbish and just guessing.

NONE of the storage on the card apart from a SEPARATE chip is writable.

Trying to control my laughter here at the mere thought that someone thinks that game cartridges are re-writable but have a "hard coded" something or other stopping the game data being written to.

mate checkout 3dsbrew site this guy knows what he is talking about

 

[Coto]

I call BS on basically everything in the OP as simply half layman's interpretation and half guess work.

Nicely written though

5/10

Hi, I want to caught up everyone's attention.
-

Thanks 3DSGuy.

 

[Duo8]

He's talking rubbish and just guessing.

NONE of the storage on the card apart from a SEPARATE chip is writable.
Read that CARD2 again

Trying to control my laughter here at the mere thought that someone thinks that game cartridges are re-writable but have a "hard coded" something or other stopping the game data being written to.
I don't see how that's funny.

You know nothing.

Really nice article btw.

 

[calvinalx]

I feel bad with this OP who have wrote everything.

Everyone who doesn't even know what he's saying here just makes stupid comments and assumptions.
Please grow up.

 

[Duo8]

I feel bad with this OP who have wrote everything.

Everyone who doesn't even know what he's saying here just makes stupid comments and assumptions.
Please grow up.

There's only one, and that's robo989.

 

[Vengenceonu]

This should be stickied (or at the very least Linked to Pong's "incompatible games on gateway 3DS" thread) so people can see it clearing up the misconception.

 

[IronClouds]

Very nicely done, OP. Glad this is here, as it'll provide people with more knowledge a thread to link less informed people to in order to educate themselves.

robo989: