|
| ||
| Views: 1,609,221 | Main | Rules/FAQ | Memberlist | Active users | Last posts | Calendar | Stats | Online users | Search | 11-21-24 11:20 AM |
| Guest: | ||
| 0 users reading I2C Device 4Ah (LED/Volume/Powerbutton/Reset controller) | 1 bot |
| Main - Reverse-engineering - I2C Device 4Ah (LED/Volume/Powerbutton/Reset controller) | Hide post layouts | New reply |
| nocash |
| ||
|
Normal user Level: 20 Posts: 6/77 EXP: 38995 Next: 3444 Since: 10-09-15 Last post: 2097 days ago Last view: 2013 days ago |
On the DSi, the BPTWL chip (I2C device 4Ah) is used for LED/Volume/Powerbutton/Reset control. On the 3DS the chip is called somewhat different, but it should have the device number and same functions (plus some extra functions).
Somebody told me that 3DS people have found a firmware for that chip, is that true? If yes, how does that firmware look like? What's it's filename, is it a separate file, or a datablock inside of a bigger file? Is there some file header, how does the instruction set look like, and is the instruction set already identified? And how is the firmware uploaded to the chip, is it stored permanently in FLASH, or only loaded temporarily to RAM? And is there anything similar on DSi? Etc... If it's patch-able and stored permanently in FLASH, then it might be useful for forcing the "warmboot" flag to be always set (which would theoretically allow to bypass the annoying health safety message). |
| plutoo |
| ||
|
Member Normal user Level: 11 Posts: 5/19 EXP: 4795 Next: 1190 Since: 09-17-15 Last post: 3272 days ago Last view: 3195 days ago |
The 3DS MCU process contains a binary blob of approximately 0x4000 bytes. It's uploaded over I2C like this (I think):
1. Read register 15. 2. Read register 16. 3. Write firmware blob to register 0x3B if reg15 == 0 or reg16 == 0, else to register 5. I think I read somewhere that it is supposedly an Renesas microcontroller. I was not able match up its instruction set with any public Renesas instruction set however. I can provide the firmware blob if you'd like to look at it. |
| nocash |
| ||
|
Normal user Level: 20 Posts: 20/77 EXP: 38995 Next: 3444 Since: 10-09-15 Last post: 2097 days ago Last view: 2013 days ago |
Yes, the two round dots on the package seem to be somewhat common for Renesas chips.
There're also two snippets from a decapped "BP_TWL-2" chip shown at https://chipworks.secure.force.com/catalog/ProductDetails?sku=NIN-BP_TWL-2 with text "NEC Electronics Corp. 2009, 33A" and "67". Whereas, NEC appears to have been sold to Renesas, so both manufacturer names are probably correct. Maybe the instruction set is described in some older NEC datasheets. The upload sequence looks odd. Especially reading register 15 and 16 - are that decimal numbers? Register 16 (=10 hex) would be the power button status, http://problemkaputt.de/gbatek.htm#dsii2cdevice4ahbptwlchip at least, it should be so in DSi mode; maybe the 3DS uses other register indices when running in 3DS mode...? |
| plutoo |
| ||
|
Member Normal user Level: 11 Posts: 6/19 EXP: 4795 Next: 1190 Since: 09-17-15 Last post: 3272 days ago Last view: 3195 days ago |
Yes, those are decimal numbers. Maybe it uploads firmware to register 0x3B on hard boot, and 5 on soft boot, or something like that?
On the 3DS there are two 0x4A devices on separate I2C busses. Presumably they kept the TWL I2C bus for compatibility, and added another one for 3DS. That could explain why the registers aren't matching up fully. I'll try to match the instruction set with NEC ones. |
| Main - Reverse-engineering - I2C Device 4Ah (LED/Volume/Powerbutton/Reset controller) | Hide post layouts | New reply |
|
Page rendered in 0.012 seconds. (2048KB of memory used) MySQL - queries: 26, rows: 69/69, time: 0.006 seconds. ![[powered by Acmlm]](img/poweredbyacmlm.png "powering nostalgia")
Acmlmboard 2.064 (2018-07-20)© 2005-2008 Acmlm, Xkeeper, blackhole89 et al. |