gbadev.org forum archive

This is a read-only mirror of the content originally found on forum.gbadev.org (now offline), salvaged from Wayback machine copies. A new forum can be found here.

DS development > Disassembling ARM questions (new to Nintendo/not new to ARM)

#41557 - DsPet - Fri Apr 29, 2005 5:17 pm

My Background:
I have disassembled and reverse engineered a lot of ARM code in the past -- most recently the ARM based Zipit with encrypted firmware uploads
However, I am a Nintendo "newbie". I bought my first Nintendo portable a few days ago, and finally enough hardware to run "FlashMe" only yesterday. After trying all the obvious things [running GBA variant linux, building NDS demo programs, grabbing ARM9 BIOS and disassembling it, grabbing encrypted firmware etc] I'm looking for some new challenges.

I've checked all the public BBSs and there is a lot of progress being made. Congratulations to all involved. There are a few remaining questions below. I'm asking here because this BBS looks to be the most technical I've found.

NOTE: I'd be happy with an answer along the lines "we don't know" or in some cases "we know but we don't want to talk about it in public".

FWIW: Ultimately my goal is to provide an AIBO remote control using an unmodified NDS (AIBO uses WiFi, but it has lower level 802.11 radio access with some limitations)

====================
The Questions:

The ARM9 BIOS is very easy to grab and disassemble. The ARM7 BIOS is intentionally copy protected.
Question #1: Has someone figured out an easy way to grab the ARM7 BIOS ROM?

------
The main 256KB firmware is possible to grab. It is encrypted specific to the device. I see that the "FlashMe" utility will install pre-encrypted firmware (the fast boot and the revert to original) -- encrypted to a specific hardware key. This leads me to believe the firmware encryption and decryption has already been figured out. I haven't found any open source code that does this.
Question #2: Is there any public discussion or source code of how to decrypt (and ideally re-encrypt) the firmware for applying your own patches or disassembling things like the Pictochat program ?
NOTE: All reverse engineering done under DMCA allowable "fair uses"

------
The "ndslib" is making good progress. I assume that people are reverse engineering it from existing firmware.
Question #3: What code / programs are people using to help their disassembly ? (game like the Metroid cart or from the 256K built-in firmware or something else?)
NOTE: my interest is mostly in the 802.11 WiFi-/NiFi functionality or areas others haven't already addressed [I don't want to reinvent the wheel]

------
Regarding PictoChat and the "NiFi" protocol
Question#4: Has anyone figured out the PictoChat protocol enough to emulate it on the PC or other WiFi-enabled device (like an AIBO) ?

------
Regarding re-signing/re-encrypting for downloaded multi-boot games.
I see some discussion on brute-force cracking techniques, however exact details of what needs to be "cracked" are not mentioned. I see Tim's WiFiMe uses existing encrypted/signed binaries.
Question#5: Has anyone figured out the decryption algorithm for this (not necessarily the keys) and what is missing.
NOTE: This is getting dangerously close the DMCA trouble (more so than the other topics)

------

Thanks in advance

--DsPet/AiboPet

#41607 - PhoenixSoft - Sat Apr 30, 2005 6:56 am

Please don't take anything I say as absolute fact, as I could be wrong. I just wanted to give you some answers because no-one else has attempted to answer any of your questions yet.

Quote:
Question #1: Has someone figured out an easy way to grab the ARM7 BIOS ROM?


I believe this is identical to the GBA bios except for a couple of bytes. If I am correct, you should be able to use existing methods used to access the GBA bios.

Quote:
Question#4: Has anyone figured out the PictoChat protocol enough to emulate it on the PC or other WiFi-enabled device (like an AIBO) ?


People have been able to capture packets sent from PictoChat and decode them into images. I am not sure about sending your own PictoChat packets, though.

#41615 - caitsith2 - Sat Apr 30, 2005 8:52 am

PhoenixSoft wrote:


Quote:
Question #1: Has someone figured out an easy way to grab the ARM7 BIOS ROM?


I believe this is identical to the GBA bios except for a couple of bytes. If I am correct, you should be able to use existing methods used to access the GBA bios.


I think what he is getting at, is trying to get the complete DS ARM7 bios. The secure area, (address < 0x1305) I have no idea how to read. I recently had someone test an Idea I had, involving the CRC16 function to read it out. No go. I have no idea what method is used to read out the secure area. However, the CRC16 idea I had, can read out the area above the secure area.

The basic idea, was to make a table you can compare against, for every byte value possible. (256 calls to build the table.)

Next was to call swiCRC([seed you used to build your table], [bios address], 1), and compare the result against your built table to find out the byte at that address. The idea unfortunately returned the CRC16 for 0xFF for all bytes in the secure area, yet the rest of the bios read out just fine.

#41619 - olimar - Sat Apr 30, 2005 9:32 am



Last edited by olimar on Wed Aug 20, 2008 9:40 pm; edited 1 time in total

#41792 - DsPet - Sun May 01, 2005 11:08 pm

Thanks for the info.
I suspected the initial ARM7 BIOS was going to be hard to break open. Yes my interest is in the DS mode version of the ARM7 (not the GBA mode).
Finding an unchecked range access in the ARM7 SWI traps is probably the only software exploit - but probably wishful thinking :-<

I guess the best option is to be hacking the Firmware (stored in I2C flash). If someone would provide some public information how to modify the firmware, that would be great.

#41804 - ector - Mon May 02, 2005 12:45 am

Just so you don't waste your time, I've heard whisperings that it has indeed been read out already...

#42357 - gbarm7 - Tue May 10, 2005 4:08 pm

wow
i know that's the subject here but:
if you knows such things you'llprobably know where to find some arm7 and arm9 documentation
i'd like to start learnong things about arm processor
so where sould i start???

#42358 - captainsoup - Tue May 10, 2005 4:45 pm

>wow
>i know that's the subject here but:
>if you knows such things you'llprobably know where to find some arm7 >and arm9 documentation
>i'd like to start learnong things about arm processor
>so where sould i start???

There should be tutorials out there on learning to program on the GBA in assembly, so I suggest you start there. Also, you should definately read the ARM7TDMI-S data sheet in it's entirety. You can find it on gbadev.org in Docs->ARM Documentation.
_________________
--Captain Soup