gbadev.org forum archive

This is a read-only mirror of the content originally found on forum.gbadev.org (now offline), salvaged from Wayback machine copies. A new forum can be found here.

DS development > Using G6/M3 as a 32MB RAM expansion

#54725 - pepsiman - Wed Sep 21, 2005 11:00 pm

The 32MB of RAM in the G6 can be made writable by writing 0xaa55 to 0x09fffffe.

As with VRAM, 8bit writes do not work correctly.

The RAM in the M3 can probably be made writable in the same way, but this has not been tested.

#54727 - El Hobito - Wed Sep 21, 2005 11:30 pm

sounds good, i have an m3 if needs any help with testing it.

off topic, how goes linux cf reading if you dont mind me asking?

#54753 - pepsiman - Thu Sep 22, 2005 8:58 am

El Hobito wrote:
sounds good, i have an m3 if needs any help with testing it.

My Test App: http://pepsiman.pwp.blueyonder.co.uk/memtest.gba

El Hobito wrote:
off topic, how goes linux cf reading if you dont mind me asking?

Linux doesn't yet manage to probe the CF, let alone read it. :(

#54759 - El Hobito - Thu Sep 22, 2005 11:36 am

it doesnt work im afraid (as far as i can tell)

08000000 = -369098706
writing 10 to 08000000
08000000 = -369098706
writing aa55 to 09fffffe
08000000 = -369098706

#54762 - pepsiman - Thu Sep 22, 2005 12:15 pm

El Hobito wrote:
it doesnt work im afraid

Thanks.

I've had a look at the m3 software, it writes 0xaa55 to 0x09ffeffe.

So here's a new test app:

http://pepsiman.pwp.blueyonder.co.uk/m3memtest.gba

#54763 - El Hobito - Thu Sep 22, 2005 12:44 pm

yup thats got it
08000000 is successfully written to

#54767 - chishm - Thu Sep 22, 2005 1:13 pm

pepsiman wrote:
I've had a look at the m3 software, it writes 0xaa55 to 0x09ffeffe

Could I please get the M3 software for disassembally purposes. I just want to figure out how to run the CF on the M3.

#54770 - pepsiman - Thu Sep 22, 2005 1:46 pm

chishm wrote:

Could I please get the M3 software for disassembally purposes. I just want to figure out how to run the CF on the M3.

I was just looking at the realtime save patch code. I don't have the M3 firmware.
I used http://www.m3adapter.com/download/M3%20game%20manager%201.3.rar to patch a GBA ROM, then disassembled the result.
The CF writing code is probably in the patch too.

There's a version of moonshell on M3's website that can read the CF.
http://www.m3adapter.com/download/MoonShell%20for%20M3_en.rar
Have you tried disassembling that?

#54772 - El Hobito - Thu Sep 22, 2005 2:42 pm

know a good disassembler pepsiman? i tried disassembling moonshell but it doesnt like it at all and gets stuck in an infinite loop

================ Header info ================
Game Title : .
Game Code : =??

Maker Code : ??
Unit Code : 09
Device Code : ad
Card Size : 11 = 131072MBit
Card Info : $????!?R?
Flags : 19
ARM9_source : 20ce0993
ARM9_execute address : 4a4a4610
ARM9_copy to address : ec3127f8
ARM9_binary size : 33e8c758
ARM7_source : bfcee382
ARM7_execute address : 94dff485
ARM7_copy to address : c1094bce
ARM7_binary size : c08a5694
Filename table offset : fca77213
Filename table size : 734d849f
FAT offset : 619acaa3
FAT size : 27a39758
ARM9 overlay src : 769803fc
ARM9 overlay size : 61c71d23
ARM7 overlay src : 56ae0403
ARM7 overlay size : 008438bf
Unknown2a : fd0ea740
Unknown2a : 03fe52ff
Icon+Titles : f130956f
SecureCRC16[4000-7FFF] : fb97
ROM timeout : 85c0
ARM9 unk addr : 2580d660
ARM7 unk addr : 03be63a9
Unknown3c : N8???4??>Dx
ROM size : 44033ebb
header size : cb900078
Logo CRC16[0C0-15B] : 203c
Header CRC16[000-15D] : e59b

================ File Allocation Table info ================
ADDRESS SIZE(HEX/DEC) PATH

================ ARM9(Main CPU) code ================
:EC3127F8 0013FF00 andeqs r15,r3,r0,lsl#0 ; r15=0(0x0)
:EC3127FC 0013FF00 andeqs r15,r3,r0,lsl#0 ; r15=0(0x0)
:EC312800 0013FF00 andeqs r15,r3,r0,lsl#0 ; r15=0(0x0)
:EC312804 0013FF00 andeqs r15,r3,r0,lsl#0 ; r15=0(0x0)
:EC312808 0013FF00 andeqs r15,r3,r0,lsl#0 ; r15=0(0x0)
:EC31280C 0013FF00 andeqs r15,r3,r0,lsl#0 ; r15=0(0x0)

#54775 - pepsiman - Thu Sep 22, 2005 2:59 pm

El Hobito wrote:
know a good disassembler pepsiman? i tried disassembling moonshell but it doesnt like it at all and gets stuck in an infinite loop.

I use arm-elf-objdump.
The MoonShell_EN.NDS file is actually a .ds.gba, so you'll need to remove the loader first.