|
| ||
| Views: 1,610,085 | Main | Rules/FAQ | Memberlist | Active users | Last posts | Calendar | Stats | Online users | Search | 11-23-24 10:09 AM |
| Guest: | ||
| Main - Posts by TuxSH |
| TuxSH |
| ||
|
Newcomer Normal user Level: 6 Posts: 1/6 EXP: 838 Next: 69 Since: 12-27-15 Last post: 3205 days ago Last view: 2991 days ago |
I'm currently developping an homebrew for dumping/writing back save files from/to NDS cartridges (which needs to be in the CIA format, as it requires some additionnal permissions).
What I've been able to do: - Dump a save file of a "normal" NDS cartridge (Pokémon Platinum, 512KB) successfully The issues I'm encountering: - Get the save file size in a reliable way. According to FSFILE_GetSize, cardspi:/ is ~256 MB iirc) - Write a modified save file back - Read the save file from a cartridge with an infrared chip (e.g Pokémon HG) Does anybody know how to solve these issues? |
| TuxSH |
| ||
|
Newcomer Normal user Level: 6 Posts: 2/6 EXP: 838 Next: 69 Since: 12-27-15 Last post: 3205 days ago Last view: 2991 days ago |
PokéTransporter uses pxi:dev 0x000D0688 to read/write to NDS save files.
However this function have no less than 33 args, and I can't find its backend implementation (which should be more or less documented by savegame-manager). I know I can just RE PokéTransporter, but I'd prefer to know how this function exactly works. Any help or advice would be greatly appreciated  . |
| TuxSH |
| ||
|
Newcomer Normal user Level: 6 Posts: 3/6 EXP: 838 Next: 69 Since: 12-27-15 Last post: 3205 days ago Last view: 2991 days ago |
Wow, this is just amazing  .
This will definitely help when I'm on my computer this evening. Edit: Started looking at the function. One argument seems to be missing. |
| TuxSH |
| ||
|
Newcomer Normal user Level: 6 Posts: 4/6 EXP: 838 Next: 69 Since: 12-27-15 Last post: 3205 days ago Last view: 2991 days ago |
Yeah, sorry, it just seems that the function sending the sync. request has unused parameters.
EDIT: no, it's just ida having problems with the calling conventions, since I've labeled each of its stack variables/params. |
| TuxSH |
| ||
|
Newcomer Normal user Level: 6 Posts: 5/6 EXP: 838 Next: 69 Since: 12-27-15 Last post: 3205 days ago Last view: 2991 days ago |
I've managed to get things working (https://github.com/TuxSH/TWLSaveTool/blob/master/source/SPI.cpp) , except for a few things:
* Chips whose JEDEC ID is 0x204013 seem to reject every single PW or SE command, even though WEL=1. This chip is sometimes used for example for Zelda:PH, Pokémon Black2 (maybe the chip used is not the same for everyone, but I doubt it). In fact, even after WEL to 1, it reverts back to 0. * 512-byte EEPROM chips seem to get stuck in an endless loop waiting for WEL to be 1. Any idea why? |
| TuxSH |
| ||
|
Newcomer Normal user Level: 6 Posts: 6/6 EXP: 838 Next: 69 Since: 12-27-15 Last post: 3205 days ago Last view: 2991 days ago |
Done some RE of the SPI, I know what each function does, but I don't know which devices are controlled through that service. Probably the microphone, wifi firmware, and the NVRAM (DS profile settings), most likely.
Game card SPI = pxi:dev SPIMultiWriteRead (see TWLSaveTool's source code) with "Use card SPI" arm9 flag. |
| Main - Posts by TuxSH |
|
Page rendered in 0.012 seconds. (2048KB of memory used) MySQL - queries: 22, rows: 71/71, time: 0.005 seconds. ![[powered by Acmlm]](img/poweredbyacmlm.png "powering nostalgia")
Acmlmboard 2.064 (2018-07-20)© 2005-2008 Acmlm, Xkeeper, blackhole89 et al. |