search

ntrteam / flashcart_core

A hopefully reusable component for dealing with flashcart specific behavior.
GNU General Public License v3.0
129 stars 32 forks source link

Ace3DS X firm size limit for ntrboot part #139

Open danny8376 opened 1 year ago

danny8376 commented 1 year ago

Not sure if real/original Ace3DS X do have this issue.

I just get this Ace3DS X from here, https://www.aliexpress.com/item/1005005333119692.html After some tinkering, find out that this card have normal 16mbit flash for ds mode, but only 8mbit flash for ntrboot mode. (I do take it apart and read/write the 8mbit flash with flasher, so I'm sure it's really 8mbit one.) However, if i dump flash with ntrboot_flasher, they both appear to be 16mbit. The ntrboot one is looped twice with that 8mbit flash's content. After tested, if the injected firm is bigger than 0x100000 - 0xAE00 bytes, it'll start overwriting from the begin of the 8mbit flash and corrupt the real firmware section and brick it.

I'm not sure if there's a good way to check this apart from crudely comparing hig-8mbit and low-8mbit of the flash (maybe just partially?)

Here's the ntrboot.log:

[ERROR]: Ace3DSPlus: tryBlowfishKey: init key1 (key = 0) failed: 11
[INFO]: Ace3DSPlus version: 22330000
[INFO]: Ace3DSPlus: spiRdid: FFFFFF
[INFO]: Ace3DSPlus: cartSdInit: success
[INFO]: Ace3DSPlus: spiRdid: 138020
[INFO]: Ace3DSPlus: spiRdid: 1440C8
[INFO]: Ace3DSPlus RDID: 1440C8

and the dumped flash: Ace3DSPlus-X-ntrboot.zip

reminon commented 3 months ago

Support for the second flash size would need to be added. The mirrored dumping is due to it trying to dump 16Mbit from the 8Mbit flash. Currently it has no way of knowing the second flash is 8Mbit