DSiBrew - User contributions [en]

File:Twl cpu pinout.pdf

2011-04-17T15:31:45Z

Neimod: uploaded a new version of "File:Twl cpu pinout.pdf"

Common key

2011-02-03T19:33:37Z

Neimod:

The DSi's common key is a known encryption key (using the AES-CBC-128 algorithm). It is used to decrypt the title key in a ticket.

Loopy had substantially claimed to have found the common key, somewhere around 2009, but he didn't share it. He did, however, provide a small amount of information on it. (There are no 00 bytes and the first bit is a 1.)

The common key can together with [http://wiibrew.org/wiki/NUS_Downloader NUSD] be used to decrypt system software only, '''not DSiWare''', because DSiWare tickets like WiiWare tickets aren't available on NUS.(The only DSiWare tickets available on NUS are the free DSiWare, opera and flipnote.)

The common key is *not* in the RAM while either of the currently exploited games are running. The common key is not the same as (and not to be confused with) the Wii's.

Apparently, someone registered the common key as a .com domain the 16 of september 2009 with the following text:

"GTFO NAO, U CANNOT HAZ SITEZ.

DSI COMMON KEY HAS WAN USE. SIGNIN HOMEBREW 2 RUN ON DSI IZ NOT WAN OV THEM. NINTENDO DOESNT EPIC FAIL LIEK SONY IN DIS REGARD.

BTW, OH HAI THAR NINTENDO"

The Common key can be extracted from this program (for legal reasons): '''CENSORED'''. This program is not legal because it contains a verbatim copy of the key.

Sources:
[http://www.elotrolado.net/hilo_dsi-common-key-revelada_1554262 Elotrolado.net, Spanish]
[http://www.ds-scene.net/?s=viewtopic&id=3366#9 Chat log]

User talk:Endres

2011-01-21T07:36:02Z

Neimod:

Moving pics from a PC to your DS can already be done, look under the camera section or anything to do with the pit.bin file for information on how to do this [[User:Steven|Steven]] 22:20, 16 February 2010 (UTC)
:They won't be viewable on a DSi. Jpeg photos created by DSi contain a special EXIF tag with an AES-CCM MAC of the entire jpeg file, which the DSi will verify first before viewing. Normal jpeg photos, not created by a DSi, do not contain this tag, and will be rejected by the DSi. The same applies for tampered DSi jpeg photos because the stored MAC will not match. Unfortunately, the method for computing this MAC is not publicly available. [[User:Neimod|Neimod]]
Have you successfully edited a PPM file on your computer and put it back on your DSi without it showing the data corrupted error and deleting it? --[[User:Matt|Matt]] 02:02, 20 May 2010 (UTC)

File:Twl cpu pinout.pdf

2011-01-21T01:32:44Z

Neimod: uploaded a new version of "File:Twl cpu pinout.pdf"

File:Twl cpu pinout.pdf

2011-01-21T01:30:27Z

Neimod: uploaded a new version of "File:Twl cpu pinout.pdf"

File:Twl cpu pinout.pdf

2011-01-21T01:28:58Z

Neimod: uploaded a new version of "File:Twl cpu pinout.pdf"

File:Twl cpu pinout.pdf

2011-01-21T01:26:49Z

Neimod: uploaded a new version of "File:Twl cpu pinout.pdf"

File:Twl cpu pinout.pdf

2011-01-21T00:57:06Z

Neimod: uploaded a new version of "File:Twl cpu pinout.pdf"

Hardware

2011-01-20T23:10:09Z

Neimod:

{{stub}}

== Specifications ==

*[[Cameras|Includes (2) 0.3 Megapixel VGA Cameras]]
*240MB(+16MB probably reserved for wear leveling purposes (e.g. replacing bad blocks)) Internal Flash Memory - Samsung kmapf0000m-S998 MOVI [[NAND]] - MMC Interface
*16MB RAM - NEC uPD 46128512AF1 - DDR SRAM or a Fujitsu 128-Mbit FCRAM 82DBS08164D-70L (datasheet: http://edevice.fujitsu.com/fj/DATASHEET/e-ds/e511454.pdf)
*(2) 256 x 192 3.25 Inch Displays, one of which has a resistive touch screen
*Backwards compatible with Nintendo DS games but not GBA games due to the lack of a gameboy cartridge port.
*Integrated ARM7/ARM9 cores clocked at 133mhz in real mode and downclocked to 66mhz for compatibility mode.
*PAIC3000D Sound Chip - possibly a TI codecs: AIC3 ????
*Mitsumi (MM3317A) or TI 72071B0 - Power supply and charger circuit ????
*SD/SDHC Card slot
*WiFi dongle with integrated 128KB SPI Flash for NVRAM, WiFi settings

== Images ==

=== Front ===

[[Image:Twl_front.jpg]]
[[Image:Twl_front_traces.jpg|600px]]

The socket to the left of the ARM processor is the wifi chip socket.

TWL CPU pinout map: [[File:Twl_cpu_pinout.pdf]] (WIP)

=== Back ===

[[Image:Twl_back.jpg]]

=== NAND pinout ===
[[Image:Dsi_nand.jpg|600px]]
[[Image:Dsi_nanddat.png|600px]]

=== PCB overlay ===
[[Image:Nintendo DSi PCB Layered.jpg|600px]]
=== CPU with new ram ===

[[Image:CPUv2.jpg]]

=== Glamor Shot ===

[[Image:Nintendo-dsi-Glamor-Shot.jpg]]

== References ==

# http://en.wikipedia.org/wiki/Nintendo_DSi
# http://insidetronics.blogspot.com/2008/11/new-nintendo-dsi-teardown.html
# http://techon.nikkeibp.co.jp/english/NEWS_EN/20081111/161077/
# http://games.gearlive.com/playfeed/article/q408-nintendo-dsi-announced-larger-screens-dual-cameras-dsi-shop-store/
# http://www.ifixit.com/Guide/First-Look/Nintendo-DSi/714/1

File:Twl cpu pinout.pdf

2011-01-20T23:08:25Z

Neimod:

Hardware

2011-01-20T21:25:03Z

Neimod:

{{stub}}

== Specifications ==

*[[Cameras|Includes (2) 0.3 Megapixel VGA Cameras]]
*240MB(+16MB probably reserved for wear leveling purposes (e.g. replacing bad blocks)) Internal Flash Memory - Samsung kmapf0000m-S998 MOVI [[NAND]] - MMC Interface
*16MB RAM - NEC uPD 46128512AF1 - DDR SRAM or a Fujitsu 128-Mbit FCRAM 82DBS08164D-70L (datasheet: http://edevice.fujitsu.com/fj/DATASHEET/e-ds/e511454.pdf)
*(2) 256 x 192 3.25 Inch Displays, one of which has a resistive touch screen
*Backwards compatible with Nintendo DS games but not GBA games due to the lack of a gameboy cartridge port.
*Integrated ARM7/ARM9 cores clocked at 133mhz in real mode and downclocked to 66mhz for compatibility mode.
*PAIC3000D Sound Chip - possibly a TI codecs: AIC3 ????
*Mitsumi (MM3317A) or TI 72071B0 - Power supply and charger circuit ????
*SD/SDHC Card slot
*WiFi dongle with integrated 128KB SPI Flash for NVRAM, WiFi settings

== Images ==

=== Front ===

[[Image:Twl_front.jpg]]
[[Image:Twl_front_traces.jpg|600px]]

The socket to the left of the ARM processor is the wifi chip socket.

=== Back ===

[[Image:Twl_back.jpg]]

=== NAND pinout ===
[[Image:Dsi_nand.jpg|600px]]
[[Image:Dsi_nanddat.png|600px]]

=== PCB overlay ===
[[Image:Nintendo DSi PCB Layered.jpg|600px]]
=== CPU with new ram ===

[[Image:CPUv2.jpg]]

=== Glamor Shot ===

[[Image:Nintendo-dsi-Glamor-Shot.jpg]]

== References ==

# http://en.wikipedia.org/wiki/Nintendo_DSi
# http://insidetronics.blogspot.com/2008/11/new-nintendo-dsi-teardown.html
# http://techon.nikkeibp.co.jp/english/NEWS_EN/20081111/161077/
# http://games.gearlive.com/playfeed/article/q408-nintendo-dsi-announced-larger-screens-dual-cameras-dsi-shop-store/
# http://www.ifixit.com/Guide/First-Look/Nintendo-DSi/714/1

File:Twl front traces.jpg

2011-01-20T21:23:54Z

Neimod:

DSiBrew:News

2011-01-16T02:31:25Z

Neimod: Created page with "<noinclude> ==Adding an item== * Log in to the wiki. Editing is disabled if you don't have an account. * Add the news event to the top of the list, using this format for the date..."

<noinclude>
==Adding an item==
* Log in to the wiki. Editing is disabled if you don't have an account.
* Add the news event to the top of the list, using this format for the date: <tt><nowiki>'''</nowiki>{{#time: d F y}}<nowiki>''' </nowiki></tt>. Please include the application's creator, version number, and a link to a page on DSiBrew about the application. No external links please.
* '''Move the last entry to the [[DSiBrew:News/Archive|news archive]]. There should be no more than 4 entrees in the list.'''

==Archives==
For older news, see the [[DSiBrew:News/Archive|news archive]].

=== News ===
</noinclude>
*'''14 January 11''' The DSi Common key has been disclosed to the public. Please do not post it here.
*'''07 September 10''' Nintendo released [[System Menu 1.4.1]] in all regions except China where [[System Menu 1.4.2]] was released instead. This update blocks some flashcards.
*'''25 August 10''' Dave J Murphy (WinterMute) released DSi Link, allowing running larger DSi mode homebrew binaries [http://davejmurphy.com/dsi-mode-homebrew-anyone/]
*'''9 February 10''' Nintendo has released an update for the DSi System. The DSi [[Nintendo Zone]] client was updated to version 3.0, but the system still runs on [[System Menu 1.4]]. No other changes have been identified.

DSiBrew talk:News

2010-12-27T08:30:54Z

Neimod:

== Forbidden News / Material? ==

I'm trying to be a general maintenance guy around here, editing links into things and organizing and whatnot, and I realized that some of the articles that are getting pulled from the front page didn't send up red flags to me. I mean, the DS download service one was pretty obviously against everything moral, but the carts didn't throw up a red flag because I personally *use* an R4 for homebrew, and the idea of using it for piracy doesn't immediately come to mind. (I don't, never have.)

So what exactly do we not allow here? Clearly anything that's blatantly for piracy is out. Since the DSi is likely going to get some kind of SD card loader, do we want to avoid flash cart in general here? What should definitely not be here? --[[User:Thegamefreak0134|Thegamefreak0134]] 18:28, 22 August 2009 (UTC)

I'm mulling over the update history, someone needs to ban that kid. ^_^ --[[User:Thegamefreak0134|Thegamefreak0134]] 12:47, 26 August 2009 (UTC)

: Do not post claims or announcements about DSi exploits or homebrew flashcards that at the time cannot be verified.[[User:Neimod|Neimod]] 10:30, 27 December 2010 (CET)

== Yellows8 ==
.:SOLUTION?:.
I think i know a solution for downloading Homebrew onto the NDS when it's made.
I've noticed that a group called Pokemon Fan Centre has made an edit to a wi-fi place in the pokemon games.they did it by doing this:

In your DS's wifi settings,
http://gts.determinismsucks.net/gtsinstruct2.png
assuming you've already got a connection to your local wireless network set up, click the settings for that connection.
http://gts.determinismsucks.net/gtsinstruct3.png
Scroll down a bit and, where it says something about the "DNS", change Autoconnect to "No",
http://gts.determinismsucks.net/gtsinstruct4a.png
and manually enter "X.X.X.X" as the primary DNS server.
http://gts.determinismsucks.net/gtsinstruct5.png
Save your settings.

So i think it would be a good idea to set up a DNS server and using it on the DSi Shop to dowload DSiBrew. 9:08, 8 April 2010.By FireGrey

DNS redirection can't be used with the shop to install a homebrew title. The shop uses only https, we can't send anything with https, as DS will reject our certificates. --[[User:Yellows8|Yellows8]] 20:57, 8 April 2010 (UTC)

I'm so happy they find an exploit but does it coming to be realased ? —Preceding unsigned comment added by [[User:Geniusdj|Geniusdj]] ([[User talk:Geniusdj|talk]] • [[Special:Contributions/Geniusdj|contribs]]) 15:07, 9 July 2009 (UTC)

DSiBrew talk:News

2010-12-27T08:30:10Z

Neimod: Do not post claims or announcements about DSi exploits or homebrew flashcards that at the time cannot be verified.

== Forbidden News / Material? ==

I'm trying to be a general maintenance guy around here, editing links into things and organizing and whatnot, and I realized that some of the articles that are getting pulled from the front page didn't send up red flags to me. I mean, the DS download service one was pretty obviously against everything moral, but the carts didn't throw up a red flag because I personally *use* an R4 for homebrew, and the idea of using it for piracy doesn't immediately come to mind. (I don't, never have.)

So what exactly do we not allow here? Clearly anything that's blatantly for piracy is out. Since the DSi is likely going to get some kind of SD card loader, do we want to avoid flash cart in general here? What should definitely not be here? --[[User:Thegamefreak0134|Thegamefreak0134]] 18:28, 22 August 2009 (UTC)

I'm mulling over the update history, someone needs to ban that kid. ^_^ --[[User:Thegamefreak0134|Thegamefreak0134]] 12:47, 26 August 2009 (UTC)

: Do not post claims or announcements about DSi exploits or homebrew flashcards that at the time cannot be verified.

== Yellows8 ==
.:SOLUTION?:.
I think i know a solution for downloading Homebrew onto the NDS when it's made.
I've noticed that a group called Pokemon Fan Centre has made an edit to a wi-fi place in the pokemon games.they did it by doing this:

In your DS's wifi settings,
http://gts.determinismsucks.net/gtsinstruct2.png
assuming you've already got a connection to your local wireless network set up, click the settings for that connection.
http://gts.determinismsucks.net/gtsinstruct3.png
Scroll down a bit and, where it says something about the "DNS", change Autoconnect to "No",
http://gts.determinismsucks.net/gtsinstruct4a.png
and manually enter "X.X.X.X" as the primary DNS server.
http://gts.determinismsucks.net/gtsinstruct5.png
Save your settings.

So i think it would be a good idea to set up a DNS server and using it on the DSi Shop to dowload DSiBrew. 9:08, 8 April 2010.By FireGrey

DNS redirection can't be used with the shop to install a homebrew title. The shop uses only https, we can't send anything with https, as DS will reject our certificates. --[[User:Yellows8|Yellows8]] 20:57, 8 April 2010 (UTC)

I'm so happy they find an exploit but does it coming to be realased ? —Preceding unsigned comment added by [[User:Geniusdj|Geniusdj]] ([[User talk:Geniusdj|talk]] • [[Special:Contributions/Geniusdj|contribs]]) 15:07, 9 July 2009 (UTC)

Talk:DSi exploits

2010-12-19T02:48:00Z

Neimod:

== Dub-T's Nintendo DSi Shop Hack ==

Erm, doesn't this just follow from what I wrote on Hackmii? http://hackmii.com/2009/01/dsibrew/ --[[User:Bushing|Bushing]] 11:41, 20 April 2009 (UTC)

== Kasu's Hack ==

Fake ? Everyone can do that using a DSi flashcard and remove it after ! 
If it isn't a fake show us how you load the code ! --[[User:Ludo6431|Ludo6431]] 16:39, 20 April 2009 (UTC)

== DSi-only Game Exploit ==

Well, there's the first DSi-only game out there ([http://www.amazon.fr/Mon-coach-personnel-recettes-plaisir/dp/B001VOV7XI french cooking crap]). Is that of any use? [[User:BlackNeedle|BlackNeedle]] 00:20, 12 July 2009 (UTC) 
Mh, actually it's a hybrid game with extra functionality (camera) on DSi. [[User:BlackNeedle|BlackNeedle]] 00:22, 12 July 2009 (UTC)
There is 2 others game like this :
- My Cooking Coach : Prepare Healthy Recipes [EUR]
- Classic Word Games [EUR]

But I don't know if DSiDev Team (include loopy, darkfader and the others on IRC) are working on it ! —Preceding unsigned comment added by [[User:Geniusdj|Geniusdj]] ([[User talk:Geniusdj|talk]] • [[Special:Contributions/Geniusdj|contribs]]) 10:29, 9 July 2009 (UTC)
Oh ! Team Twiizers have find an exploit (semi hardware and software, I guess) !
But you're right that was one of those game who served for the exploit (Classic Word Game). —Preceding unsigned comment added by [[User:Geniusdj|Geniusdj]] ([[User talk:Geniusdj|talk]] • [[Special:Contributions/Geniusdj|contribs]]) 15:08, 9 July 2009 (UTC)

:ahhh, happy day. I'll be watching this closely.--[[User:Funkamatic|FUNKAMATIC]][[User talk:Funkamatic| ~talk]] 17:28, 9 July 2009 (UTC)

We could try modifying the files it copies onto the SD card from the DSi Applications. I've been trying to do this but with no success. If anyone wants to help me out email me at: the2banned2one@gmail.com . Any help would be much appreciated. If I can get anything from this I will post it and the files here. --[[User:The2Banned2One|The2Banned2One]][[User talk:The2Banned2One| ~talk]] <s>17:21, 5 August 2009 (EST)</s> —Preceding undated comment added 21:24, 5 August 2009 (UTC).

== BannerBomb Like Exploit ==

Could we program something that can make the DSi Crash and load homebrew like the Wii's Bannerbomb?
--[[User:TWLREECE|TWLREECE]] 18:35, 17 August 2009 (UTC)

== Action Replay DSi ==

The Action Replay DSi runs in DSi Mode, has a Micro SD Card slot, and can run homebrew applications in a .nds format, could an installer program be written to install a homebrew channel on the DSi?--DSiDude
:I'd like to know this also, but how do you know it runs in DSi mode?--[[User:Funkamatic|FUNKAMATIC]][[User talk:Funkamatic| ~talk]] 22:38, 21 January 2010 (UTC)

According to [[http://www.youtube.com/watch?v=y4etylDSHrw this video]] the Action Replay DSi shows up as a Game and Watch collection NDS game.
This automatically means it cannot support DSi mode, and is running in normal DS mode. -- neimod

That IS the DSi Mode, because if you use it on a DS, it just automatically boots up the Action Replay, without going to the DS menu. I have tried this. I don't know much about the DSi's workings but I'm pretty sure of this. --DSiDude

:No, it means the DSi System Menu will see it as a NDS game, not as a DSi game. As such it will disable all DSi features and revert to DS compatibility mode. Just try to load a DSi game, and it should fail to load (DSi only), or have all DSi features disabled (DSi enhanced). -- neimod

::Action Replay on a DS always just boots up, that doesn't have anything to do with DSi mode --[[User:Bg4545|bg4545]] 03:19, 24 January 2010 (UTC)

== Flip Note studio bug ==

i dunno if this is of ANY use to anyone, but i found a glitch in Flipnote studio. As you may know, it accesses the SD card to see if there are any animations. I noticed it also tries to access the SD card when youre in a flipnote. I was making an animation, and i go to the story board mode to delete some frames. It then gave me a pop-up saying The object in the SD card slot could not be read (or something like that). It gives me that particular message because i have an SD adapter thats supposed to hold a micro sd. Anyways, just trying to be helpful.

That's only useless MMC hw fail. That isn't exploitable at all. --[[User:Yellows8|Yellows8]] 02:44, 26 November 2010 (CET)

No, not that, just the odd timing of it trying to access the SD card was weird to me.

== Team Cyclops flashcard ==

It's called the CycloDsi, and i guess it can access DSi features. Should that go on this exploits page?
[http://www.cyclopsds.com/cgi-bin/cyclods/engine.pl here's] their site.

: The exploits page is only for homebrew exploits, _no_ flash cards. And if you look at recent changes a news entry for that flash card was removed. --[[User:Yellows8|Yellows8]] 00:00, 19 December 2010 (CET)

: Only technical information regarding the internal workings of the card exploit is welcome. Just pointing to a site that claims to have built a flashcard that has access to DSi features is NOT useful. --[[User:Neimod|Neimod]] 04:48, 19 December 2010 (CET)

Talk:DSi exploits

2010-12-19T02:46:45Z

Neimod: CORRELATION IS NOT CAUSATION

Talk:SD title export

2010-12-06T11:13:31Z

Neimod: Created page with "If we were able to get this information that requires the shared key, then why isn't the shared key posted here. It must be known for the person who wrote this to have decrypted ..."

If we were able to get this information that requires the shared key, then why isn't the shared key posted here. It must be known for the person who wrote this to have decrypted the header and footer. [[User:The2Banned2One|The2Banned2One]] 02:54, 6 December 2010 (CET)
: The key is unknown but magic happens. [[User:Neimod|Neimod]] 13:13, 6 December 2010 (CET)

Interrupts

2010-12-04T20:35:25Z

Neimod:

ARM7 has some new interrupts.

=== ARM7 IO REGISTERS ===
{| class="wikitable" border="1"
|-
! ADDRESS
! WIDTH (bytes)
! NAME
|-
| 0x04000218
| 4
| REG_IE2
|-
| 0x0400021C
| 4
| REG_IF2
|}

{| class="wikitable" border="1"
|+ '''REG_IE2 / REG_IF2'''
|-
! BIT
! DESCRIPTION
|-
| 0
| GPIO18[0]
|-
| 1
| GPIO18[1]
|-
| 2
| GPIO18[2]
|-
| 4
| GPIO33[0]
|-
| 5
| GPIO33[1]
|-
| 6
| Powerbutton interrupt (GPIO33[2])
|-
| 7
| GPIO33[3]
|-
| 8
| SD card 1
|-
| 9
| SDIO card 1 async
|-
| 10
| SD card 2
|-
| 11
| SDIO card 2 async
|-
| 12
| AES interrupt
|-
| 13
| I2C interrupt
|-
| 14
| Microphone Extended interrupt
|}

{| class="wikitable" border="1"
|+ '''REG_IE / REG_IF'''
|-
! BIT
! DESCRIPTION
|-
| 0-27
| same as DS
|-
| 28
| NDMA0 interrupt
|-
| 29
| NDMA1 interrupt
|-
| 30
| NDMA2 interrupt
|-
| 31
| NDMA3 interrupt
|}

NDMA

2010-11-26T06:44:19Z

Neimod:

== Registers ==
There's 4 NDMA channels. Arm7/Arm9 have separate NDMA.

{| class="wikitable" border="1"
! NAME
! ADDRESS
! WIDTH
|-
| REG_NDMAGCNT
| 0x04004100
| 4
|-
| REG_NDMASAD(n)
| 0x04004104 + (n*0x1c)
| 4
|-
| REG_NDMADAD(n)
| 0x04004108 + (n*0x1c)
| 4
|-
| REG_NDMATCNT(n)
| 0x0400410c + (n*0x1c)
| 4
|-
| REG_NDMAWCNT(n)
| 0x04004110 + (n*0x1c)
| 4
|-
| REG_NDMABCNT(n)
| 0x04004114 + (n*0x1c)
| 4
|-
| REG_NDMAFDATA(n)
| 0x04004118 + (n*0x1c)
| 4
|-
| REG_NDMACNT(n)
| 0x0400411c + (n*0x1c)
| 4
|}

== REG_NDMAGCNT ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 19-16
| Cycle selection.
|-
| 31
| DMA arbitration method. 0=Fixed method, 1=Round robin
|}

== REG_NDMASAD ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 31-0
| Source data address. Must be multiple of 4.
|}
Like old DMA, REG_NDMASAD is copied to internal registers when written to.

== REG_NDMADAD ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 31-0
| Destination data address. Must be multiple of 4.
|}
Like old DMA, REG_NDMADAD is copied to internal registers when written to.

== REG_NDMATCNT ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 27-0
| Total number of words transferred.
|}

== REG_NDMAWCNT ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 23-0
| Number of words to transfer.
|}

== REG_NDMABCNT ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 15-0
| Interval timer.
|-
| 17-16
| Prescaler. 0=System freq, 1=1/4th freq, 2=1/16th freq, 3=1/64th freq.
|}

== REG_NDMAFDATA ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 31-0
| Fill data.
|}

== REG_NDMACNT ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 11-10
| Destination address update method. 0=Increment, 1=Decrement, 2=Fixed.
|-
| 12
| Destination address reload flag.
|-
| 14-13
| Source address update method. 0=Increment, 1=Decrement, 2=Fixed, 3=No address (for filling)
|-
| 15
| Source address reload flag.
|-
| 19-16
| Block transfer word count = (1<<x) words.
|-
| 27-24
| Startup mode.
|-
| 28
| Immediate mode.
|-
| 29
| Repeating mode.
|-
| 30
| IRQ enable
|-
| 31
| Enable/busy flag.
|}

== Startup modes (27-24) for ARM9 ==
{| class="wikitable" border="1"
! VALUE
! DESCRIPTION
|-
| 0
| Timer 0
|-
| 1
| Timer 1
|-
| 2
| Timer 2
|-
| 3
| Timer 3
|-
| 4
| Game Card
|-
| 6
| V-Blank
|-
| 7
| H-Blank
|-
| 8
| Display
|-
| 9
| Work RAM
|-
| 10
| Geometry FIFO
|-
| 11
| Camera
|}

== Startup modes (27-24) for ARM7 ==
{| class="wikitable" border="1"
! VALUE
! DESCRIPTION
|-
| 0
| Timer 0
|-
| 1
| Timer 1
|-
| 2
| Timer 2
|-
| 3
| Timer 3
|-
| 4
| Game Card
|-
| 6
| V-Blank
|-
| 7
| Wireless
|-
| 8
| SD I/F 1
|-
| 9
| SD I/F 2
|-
| 10
| AES in
|-
| 11
| AES out / MIC(?)
|-
| 12
| MIC(?)
|}

== Block transfers ==
First, a word is always 32 bits. Second, the block transfer specified in REG_NDMACNT is the smallest atom of data that will be transferred in a burst. The bus is monopolized until this block is transferred, without splitting up.

The next block transfer will happen after the specified time in the REG_NDMABCNT interval timer, until done.

== Immediate mode ==
Transfers the words specified in REG_NDMAWCNT immediately following block transfer rules. REG_NDMATCNT and repeating mode are ignored.

== Repeating mode ==
Transfers the words specified in REG_NDMAWCNT following the startup mode event. REG_DMATCNT is ignored.

== No immediate and no repeating mode ==
Transfers the words specified in REG_NDMAWCNT for each startup event, and gets disabled when the total number of words in REG_NDMATCNT are transferred.

NDMA

2010-11-26T06:43:52Z

Neimod:

== Registers ==
There's 4 NDMA channels. Arm7/Arm9 have separate NDMA.

{| class="wikitable" border="1"
! NAME
! ADDRESS
! WIDTH
|-
| REG_NDMAGCNT
| 0x04004100
| 4
|-
| REG_NDMASAD(n)
| 0x04004104 + (n*0x1c)
| 4
|-
| REG_NDMADAD(n)
| 0x04004108 + (n*0x1c)
| 4
|-
| REG_NDMATCNT(n)
| 0x0400410c + (n*0x1c)
| 4
|-
| REG_NDMAWCNT(n)
| 0x04004110 + (n*0x1c)
| 4
|-
| REG_NDMABCNT(n)
| 0x04004114 + (n*0x1c)
| 4
|-
| REG_NDMAFDATA(n)
| 0x04004118 + (n*0x1c)
| 4
|-
| REG_NDMACNT(n)
| 0x0400411c + (n*0x1c)
| 4
|}

== REG_NDMAGCNT ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 19-16
| Cycle selection.
|-
| 31
| DMA arbitration method. 0=Fixed method, 1=Round robin
|}

== REG_NDMASAD ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 31-0
| Source data address. Must be multiple of 4.
|}
Like old DMA, REG_NDMASAD is copied to internal registers when written to.

== REG_NDMADAD ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 31-0
| Destination data address. Must be multiple of 4.
|}
Like old DMA, REG_NDMADAD is copied to internal registers when written to.

== REG_NDMATCNT ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 27-0
| Total number of words transferred.
|}

== REG_NDMAWCNT ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 23-0
| Number of words to transfer.
|}

== REG_NDMABCNT ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 15-0
| Interval timer.
|-
| 17-16
| Prescaler. 0=System freq, 1=1/4th freq, 2=1/16th freq, 3=1/64th freq.
|}

== REG_NDMAFDATA ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 31-0
| Fill data.
|}

== REG_NDMACNT ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 11-10
| Destination address update method. 0=Increment, 1=Decrement, 2=Fixed.
|-
| 12
| Destination address reload flag.
|-
| 14-13
| Source address update method. 0=Increment, 1=Decrement, 2=Fixed, 3=No address (for filling)
|-
| 15
| Source address reload flag.
|-
| 19-16
| Block transfer word count = (1<<x) words.
|-
| 27-24
| Startup mode.
|-
| 28
| Immediate mode.
|-
| 29
| Repeating mode.
|-
| 30
| IRQ enable
|-
| 31
| Enable/busy flag.
|}

== Startup modes (27-24) for ARM9 ==
{| class="wikitable" border="1"
! VALUE
! DESCRIPTION
|-
| 0
| Timer 0
|-
| 1
| Timer 1
|-
| 2
| Timer 2
|-
| 3
| Timer 3
|-
| 4
| Game Card
|-
| 6
| V-Blank
|-
| 7
| H-Blank
|-
| 8
| Display
|-
| 9
| Work RAM
|-
| 10
| Geometry FIFO
|-
| 11
| Camera
|}

== Startup modes (27-24) for ARM7 ==
{| class="wikitable" border="1"
! VALUE
! DESCRIPTION
|-
| 0
| Timer 0
|-
| 1
| Timer 1
|-
| 2
| Timer 2
|-
| 3
| Timer 3
|-
| 4
| Game Card
|-
| 6
| V-Blank
|-
| 7
| Wireless
|-
| 8
| SD I/F 1
|-
| 9
| SD I/F 2
|-
| 10
| AES in
|-
| 11
| AES out / MIC(?)
|-
| 12
| MIC(?)
|}

== Block transfers ==
First, a word is always 32 bits. Second, the block transfer specified in REG_NDMACNT is the smallest atom of data that will be transferred in a burst. The bus is monopolized until this block is transferred, without splitting up.

The next block transfer will happen after the specified time in the REG_NDMABCNT interval timer, until done.

== Immediate mode ==
Transfers the words specified in REG_NDMAWCNT immediately following block transfer rules. REG_NDMATCNT and repeating mode are ignored.

== Repeating mode ==
Transfers the words specified in REG_NDMAWCNT following the startup mode event. REG_DMATCNT is ignored.

== No immediate and no repeating mode ==
Transfers the words specified in REG_NDMAWCNT for each startup event, and gets disabled until the total number of words in REG_NDMATCNT are transferred.

NDMA

2010-11-25T05:24:42Z

Neimod:

== Registers ==
There's 4 NDMA channels. Arm7/Arm9 have separate NDMA.

{| class="wikitable" border="1"
! NAME
! ADDRESS
! WIDTH
|-
| REG_NDMAGCNT
| 0x04004100
| 4
|-
| REG_NDMASAD(n)
| 0x04004104 + (n*0x1c)
| 4
|-
| REG_NDMADAD(n)
| 0x04004108 + (n*0x1c)
| 4
|-
| REG_NDMATCNT(n)
| 0x0400410c + (n*0x1c)
| 4
|-
| REG_NDMAWCNT(n)
| 0x04004110 + (n*0x1c)
| 4
|-
| REG_NDMABCNT(n)
| 0x04004114 + (n*0x1c)
| 4
|-
| REG_NDMAFDATA(n)
| 0x04004118 + (n*0x1c)
| 4
|-
| REG_NDMACNT(n)
| 0x0400411c + (n*0x1c)
| 4
|}

== REG_NDMAGCNT ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 19-16
| Cycle selection.
|-
| 31
| DMA arbitration method. 0=Fixed method, 1=Round robin
|}

== REG_NDMASAD ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 31-0
| Source data address. Must be multiple of 4.
|}
Like old DMA, REG_NDMASAD is copied to internal registers when written to.

== REG_NDMADAD ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 31-0
| Destination data address. Must be multiple of 4.
|}
Like old DMA, REG_NDMADAD is copied to internal registers when written to.

== REG_NDMATCNT ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 27-0
| Total number of words transferred.
|}

== REG_NDMAWCNT ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 23-0
| Number of words to transfer.
|}

== REG_NDMABCNT ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 15-0
| Interval timer.
|-
| 17-16
| Prescaler. 0=System freq, 1=1/4th freq, 2=1/16th freq, 3=1/64th freq.
|}

== REG_NDMAFDATA ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 31-0
| Fill data.
|}

== REG_NDMACNT ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 11-10
| Destination address update method. 0=Increment, 1=Decrement, 2=Fixed.
|-
| 12
| Destination address reload flag.
|-
| 14-13
| Source address update method. 0=Increment, 1=Decrement, 2=Fixed, 3=No address (for filling)
|-
| 15
| Source address reload flag.
|-
| 19-16
| Block transfer word count = (1<<x) words.
|-
| 27-24
| Startup mode.
|-
| 28
| Immediate mode.
|-
| 29
| Repeating mode.
|-
| 30
| IRQ enable
|-
| 31
| Enable/busy flag.
|}

== Startup modes (27-24) for ARM9 ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 0
| Timer 0
|-
| 1
| Timer 1
|-
| 2
| Timer 2
|-
| 3
| Timer 3
|-
| 4
| Game Card
|-
| 6
| V-Blank
|-
| 7
| H-Blank
|-
| 8
| Display
|-
| 9
| Work RAM
|-
| 10
| Geometry FIFO
|-
| 11
| Camera
|}

== Startup modes (27-24) for ARM7 ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 0
| Timer 0
|-
| 1
| Timer 1
|-
| 2
| Timer 2
|-
| 3
| Timer 3
|-
| 4
| Game Card
|-
| 6
| V-Blank
|-
| 7
| Wireless
|-
| 8
| SD I/F 1
|-
| 9
| SD I/F 2
|-
| 10
| AES in
|-
| 11
| AES out / MIC(?)
|-
| 12
| MIC(?)
|}

== Block transfers ==
First, a word is always 32 bits. Second, the block transfer specified in REG_NDMACNT is the smallest atom of data that will be transferred in a burst. The bus is monopolized until this block is transferred, without splitting up.

The next block transfer will happen after the specified time in the REG_NDMABCNT interval timer, until done.

== Immediate mode ==
Transfers the words specified in REG_NDMAWCNT immediately following block transfer rules. REG_NDMATCNT and repeating mode are ignored.

== Repeating mode ==
Transfers the words specified in REG_NDMACNT following the startup mode event. REG_DMATCNT is ignored.

== No immediate and no repeating mode ==
Transfers the total number of words in REG_NDMATCNT.

NDMA

2010-11-25T03:56:52Z

Neimod:

== Registers ==
There's 4 NDMA channels. Arm7/Arm9 have separate NDMA.

{| class="wikitable" border="1"
! NAME
! ADDRESS
! WIDTH
|-
| REG_NDMAGCNT
| 0x04004100
| 4
|-
| REG_NDMASAD(n)
| 0x04004104 + (n*0x1c)
| 4
|-
| REG_NDMADAD(n)
| 0x04004108 + (n*0x1c)
| 4
|-
| REG_NDMATCNT(n)
| 0x0400410c + (n*0x1c)
| 4
|-
| REG_NDMAWCNT(n)
| 0x04004110 + (n*0x1c)
| 4
|-
| REG_NDMABCNT(n)
| 0x04004114 + (n*0x1c)
| 4
|-
| REG_NDMAFDATA(n)
| 0x04004118 + (n*0x1c)
| 4
|-
| REG_NDMACNT(n)
| 0x0400411c + (n*0x1c)
| 4
|}

== REG_NDMAGCNT ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 19-16
| Cycle selection.
|-
| 31
| DMA arbitration method. 0=Fixed method, 1=Round robin
|}

== REG_NDMASAD ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 31-0
| Source data address. Must be multiple of 4.
|}
Like old DMA, REG_NDMASAD is copied to internal registers when written to.

== REG_NDMADAD ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 31-0
| Destination data address. Must be multiple of 4.
|}
Like old DMA, REG_NDMADAD is copied to internal registers when written to.

== REG_NDMATCNT ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 27-0
| Total number of words transferred.
|}

== REG_NDMAWCNT ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 23-0
| Number of words to transfer.
|}

== REG_NDMABCNT ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 15-0
| Interval timer.
|-
| 17-16
| Prescaler. 0=System freq, 1=1/4th freq, 2=1/16th freq, 3=1/64th freq.
|}

== REG_NDMAFDATA ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 31-0
| Fill data.
|}

== REG_NDMACNT ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 11-10
| Destination address update method. 0=Increment, 1=Decrement, 2=Fixed.
|-
| 12
| Destination address reload flag.
|-
| 14-13
| Source address update method. 0=Increment, 1=Decrement, 2=Fixed, 3=No address (for filling)
|-
| 15
| Source address reload flag.
|-
| 19-16
| Block transfer word count = (1<<x) words.
|-
| 27-24
| Startup mode.
|-
| 28
| Immediate mode.
|-
| 29
| Repeating mode.
|-
| 30
| IRQ enable
|-
| 31
| Enable/busy flag.
|}

== Startup modes (27-24) for ARM9 ==
{| class="wikitable" border="1"
! BIT
! DESCRIPTION
|-
| 0
| Timer 0
|-
| 1
| Timer 1
|-
| 2
| Timer 2
|-
| 3
| Timer 3
|-
| 4
| Game Card
|-
| 6
| V-Blank
|-
| 7
| H-Blank
|-
| 8
| Display
|-
| 9
| Work RAM
|-
| 10
| Geometry FIFO
|-
| 11
| Camera
|}

== Block transfers ==
First, a word is always 32 bits. Second, the block transfer specified in REG_NDMACNT is the smallest atom of data that will be transferred in a burst. The bus is monopolized until this block is transferred, without splitting up.

The next block transfer will happen after the specified time in the REG_NDMABCNT interval timer, until done.

== Immediate mode ==
Transfers the words specified in REG_NDMAWCNT immediately following block transfer rules. REG_NDMATCNT and repeating mode are ignored.

== Repeating mode ==
Transfers the words specified in REG_NDMACNT following the startup mode event. REG_DMATCNT is ignored.

== No immediate and no repeating mode ==
Transfers the total number of words in REG_NDMATCNT.

NDMA

2010-11-25T03:36:42Z

Neimod:

NDMA

2010-11-25T03:31:37Z

Neimod:

NDMA

2010-11-25T03:26:58Z

Neimod:

NDMA

2010-11-25T03:23:46Z

Neimod:

NDMA

2010-11-25T03:17:53Z

Neimod:

ES block encryption

2010-10-20T00:21:10Z

Neimod:

ES block encryption, for lack of a better name, is a commonly used data encryption method on DSi by Nintendo.

It uses AES CCM to encrypt a maximum of 0x20000 bytes of data per time, and extends it with a 32 byte metablock at the end. Data blocks bigger than 0x20000 bytes are segmented into multiple ES blocks.

A part of the last 16 bytes of metablock itself is encrypted with AES CTR, and contains the nonce for decryption and size of the ES block:
0000000: qq qq qq qq qq qq qq qq qq qq qq qq qq qq qq qq
0000010: xx nn nn nn nn nn nn nn nn nn nn nn nn yy yy yy

The counter used for decrypting the last 16 bytes of the metablock is the last 16 bytes of the metablock itself, with the first, 14th, 15th and 16th byte set to 0:
00 nn nn nn nn nn nn nn nn nn nn nn nn 00 00 00

After decrypting the metablock, xx is always 0x3A, and yy is the size of the ES block (excluding the metablock). The nonce after decryption is not used. The 16-byte block qq is a MAC (Message Authentication Code) calculated via AES CBC-MAC, used to verify the contents of the ES block after decryption.

The same 12-byte nonce from the metablock is again used to decrypt the whole ES block itself.

Data larger than 0x20000 bytes is split into multiple ES blocks, each with their own metablock.

A couple of tools to work with DSi AES CTR/CCM binaries can be found [http://github.com/neimod/dsi here].

SD title export

2010-10-20T00:20:04Z

Neimod:

The System Settings application delivered with each DSi can be used to export applications from NAND to SD. The bin files created on SD are using the Tad file structure. Tad files are encrypted with AES CCM (CTR with CBC-MAC), using a combination of a shared key and a console specific key.

The application itself (APP), and the title metadata (TMD) is encrypted with a console specific key. This means that Nintendo intended that these files can only be imported back into the same DSi.

While the banner, the public savegame, and several other metablocks are encrypted with a shared key, which means any DSi can inspect these parts of the file.

[[ES block encryption]] is used to encrypt the header block, footer block, and the 11 content parts. Each are their own seperate ES blocks.

= Tad file structure overview =

{| class="wikitable"
|-
! Offset
! Size
! Description
|-
| 0x0
| 0x4020 ?
| Banner/Icon
|-
| 0x4020
| 0xB4
| Header
|-
| 0x40F4
| 0x460
| Footer (certificates/hashes)
|-
| 0x4554
| -
| Content parts in sequence (TMD, SRL, savegame, custom banner).
|}

The banner, header, footer and savegame are encrypted with a shared key between each DSi. The other content parts are encrypted with a console specific key.

= Header block @ 0x4020 (size 0xB4) =
0000000: 34 41 4e 54 31 30 00 01 74 e9 2c 1e 24 00 00 00 4ANT10..t.,.$...
0000010: d6 e0 39 c3 98 3f 06 b6 9a b2 9d 14 e7 06 e9 00 ..9..?..........
0000020: 45 4d 44 4b 04 00 03 00 28 02 00 00 20 d2 e0 00 EMDK....(... ...
0000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000040: 00 00 00 00 00 00 00 00 00 00 00 00 80 80 06 00 ................
0000050: 00 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 ................
0000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000070: 00 00 00 00 00 80 06 00 00 00 00 00 00 00 00 00 ................
0000080: 00 00 00 00 00 86 00 00 00 00 00 00 00 00 00 00 ................
0000090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000b0: 00 00 00 00 ....

{| class="wikitable"
|-
! Offset
! Size
! Description
|-
| 0x00
| 4
| Always 0x544E4134 ('TNA4', endian-swapped)
|-
| 0x04
| 2
| group_id/publisher code
|-
| 0x06
| 2
| Title version
|-
| 0x08
| 6
| DSi MAC address
|-
| 0x0E
| 2
| zero
|-
| 0x10
| 16
| Extracted from HWINFO_N.dat
|-
| 0x20
| 4
| Lower TitleID of exported app
|-
| 0x24
| 4
| Upper TitleID of exported app
|-
| 0x28
| 11 * 4
| Contains the total lengths for each of the 11 parts.
|-
| 0x54
| 8 * 4
| List of content ids in same order as tmd
|-
| 0x74
| 0x3e
| reserved section per [http://www.wiibrew.org/wiki/TMD tmds]
|}

= footer block @ 0x40F4 (size 0x460) =

0000000: d6 f3 24 7c a1 0f 4a dc cd 07 34 d6 ce 62 32 93 ..$|..J...4..b2.
0000010: 11 54 54 a5 28 38 13 5a 0c 87 8e dc 63 0a ab 2e .TT.(8.Z....c...
0000020: 4a 0f 12 5c d7 31 ee 29 72 53 39 1d ff 70 c1 8a J..\.1.)rS9..p..
0000030: 45 18 c1 88 85 1f f5 55 c6 5f 48 37 27 f3 0a 02 E......U._H7'...
0000040: e7 77 18 8b 84 ee cc e5 e4 40 e5 cb 64 bb 0a f3 .w.......@..d...
0000050: 20 00 53 00 74 00 75 00 64 00 69 00 6f 00 0a 00 .S.t.u.d.i.o...
0000060: 4e 00 69 00 6e 00 74 00 65 00 6e 00 64 00 6f 00 N.i.n.t.e.n.d.o.
0000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000d0: 00 00 00 00 00 00 00 00 00 00 00 00 c5 16 e5 12 ................
00000e0: 4c 70 9a fd 7a 03 87 d0 13 94 da 86 46 11 ff 31 Lp..z.......F..1
00000f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000100: 00 00 00 00 00 b5 62 b1 02 c9 4e f3 14 2c 85 3d ......b...N..,.=
0000110: a2 c6 be c9 d8 01 db 46 03 12 44 6e 89 87 c4 e5 .......F..Dn....
0000120: 83 1e 00 03 8f f8 cd 35 e3 e4 b8 8e be 6e 65 36 .......5.....ne6
0000130: f2 6d c6 dc 2c 4b d6 38 2b 2d 7f e5 22 b0 44 3b .m..,K.8+-..".D;
0000140: 00 01 00 02 00 78 58 de a6 c4 70 9c 89 26 22 f2 .....xX...p..&".
0000150: 60 38 cb c5 d7 54 cd a3 d5 b9 d9 b3 84 63 6f be `8...T.......co.
0000160: 36 ef 00 68 f0 9a 6b 35 91 1a 67 6f 73 dc 54 61 6..h..k5..gos.Ta
0000170: c1 c7 6c 6f d4 43 58 e6 e2 62 52 11 65 77 9a ce ..lo.CX..bR.ew..
0000180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001c0: 52 6f 6f 74 2d 43 41 30 30 30 30 30 30 30 31 2d Root-CA00000001-
00001d0: 4d 53 30 30 30 30 30 30 30 38 2d 54 57 63 37 39 MS00000008-TWc79
00001e0: 64 63 65 63 39 2d 30 38 61 32 30 32 38 37 30 31 dcec9-08a2028701
00001f0: 30 38 34 31 31 38 00 00 00 00 00 00 00 00 00 00 084118..........
0000200: 00 00 00 02 41 50 30 30 30 33 30 30 31 35 34 38 ....AP0003001548
0000210: 34 65 34 32 34 35 00 00 00 00 00 00 00 00 00 00 4e4245..........
0000220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000240: 00 00 00 00 00 00 00 00 00 d7 c1 33 4e 24 8c 13 ...........3N$..
0000250: 0f b3 f4 c4 bb 2a 4a 79 81 51 39 6f 00 ee a2 00 .....*Jy.Q9o....
0000260: 20 a6 f5 cc d8 72 01 74 60 57 4f a4 92 52 9b 5a ....r.t`WO..R.Z
0000270: 56 75 a9 62 4f 67 25 e3 7b 05 21 e4 4f 1f c3 21 Vu.bOg%.{.!.O..!
0000280: 2b d8 ec e7 00 00 00 00 00 00 00 00 00 00 00 00 +...............
0000290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002c0: 00 01 00 02 00 db da 21 3b e1 f1 bf bb 4d dc 1d .......!;....M..
00002d0: 60 29 da 19 42 1e 66 4f a8 e5 27 a1 d4 ea 46 7d `)..B.fO..'...F}
00002e0: 9b b4 00 95 c5 0d e8 fa ef a7 8d e9 bc 54 da c1 .............T..
00002f0: 24 94 0b 7c ad a8 61 d5 05 97 c2 64 38 ad 18 f9 $..|..a....d8...
0000300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000340: 52 6f 6f 74 2d 43 41 30 30 30 30 30 30 30 31 2d Root-CA00000001-
0000350: 4d 53 30 30 30 30 30 30 30 38 00 00 00 00 00 00 MS00000008......
0000360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000380: 00 00 00 02 54 57 63 37 39 64 63 65 63 39 2d 30 ....TWc79dcec9-0
0000390: 38 61 32 30 32 38 37 30 31 30 38 34 31 31 38 00 8a2028701084118.
00003a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00003b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00003c0: 00 00 00 00 6f dd de 42 01 e0 34 a3 19 bc a9 af ....o..B..4.....
00003d0: 50 fe 8a ac 75 08 07 a9 3a 2c 21 51 93 ae 4a 90 P...u...:,!Q..J.
00003e0: 6e 62 41 f1 a2 fe 00 00 3d 0a 13 97 da 53 17 98 nbA.....=....S..
00003f0: 69 38 65 67 ca f4 9c 87 ec 44 b7 eb d0 ec b8 3d i8eg.....D.....=
0000400: 23 cf 7a 35 00 00 00 00 00 00 00 00 00 00 00 00 #.z5............
0000410: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000420: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000430: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

{| class="wikitable"
|-
! Offset
! Size
! Description
|-
| 0x00
| 20
| SHA1 of banner
|-
| 0x14
| 20
| SHA1 of tna4
|-
| 0x28
| 20
| SHA1 of tmd
|-
| 0x3c
| 20*8
| SHA1 of up to 8 contents [if unused, can be whatever happened to be in memory before]
|-
| 0xdc
| 20
| SHA1 of save data
|-
| 0xf0
| 20
| SHA1 of ?
|-
| 0x104
| 0x3c
| ECC signature of previous 0x104 bytes with AP cert
|-
| 0x140
| 0x180
| AP cert, signed by TW cert
|-
| 0x2c0
| 0x180
| TW cert, specific to a console (see dev.kp)
|}

It is assumed that this block contains an ECC signature, aswell as the console id and serial of the DSi that exported the file, as part of a Nintendo cert. Much like the Wii, the DSi carries with it a private ECC key that it can use to sign things, and a certificate signed by Nintendo that attests to the fact that the public ECC key belongs to a genuine DSi.

SD title export

2010-10-19T21:16:35Z

Neimod:

The System Settings application delivered with each DSi can be used to export applications from NAND to SD. The bin files created on SD are using the Tad file structure. Tad files are encrypted with AES CCM (CTR with CBC-MAC), using a combination of a shared key and a console specific key.

The application itself (APP), and the title metadata (TMD) is encrypted with a console specific key. This means that Nintendo intended that these files can only be imported back into the same DSi.

While the banner, the public savegame, and several other metablocks are encrypted with a shared key, which means any DSi can inspect these parts of the file.

[[ES block encryption]] is used to encrypt the header block, footer block, and the 11 parts. Each are their own seperate ES blocks.

= header block @ 0x4020 (size 0xB4) =
0000000: 34 41 4e 54 31 30 00 01 74 e9 2c 1e 24 00 00 00 4ANT10..t.,.$...
0000010: d6 e0 39 c3 98 3f 06 b6 9a b2 9d 14 e7 06 e9 00 ..9..?..........
0000020: 45 4d 44 4b 04 00 03 00 28 02 00 00 20 d2 e0 00 EMDK....(... ...
0000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000040: 00 00 00 00 00 00 00 00 00 00 00 00 80 80 06 00 ................
0000050: 00 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 ................
0000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000070: 00 00 00 00 00 80 06 00 00 00 00 00 00 00 00 00 ................
0000080: 00 00 00 00 00 86 00 00 00 00 00 00 00 00 00 00 ................
0000090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000b0: 00 00 00 00 ....

{| class="wikitable"
|-
! Offset
! Size
! Description
|-
| 0x00
| 4
| Always 0x544E4134 ('TNA4', endian-swapped)
|-
| 0x04
| 2
| group_id/publisher code
|-
| 0x06
| 2
| Title version
|-
| 0x08
| 6
| DSi MAC address
|-
| 0x0E
| 2
| zero
|-
| 0x10
| 16
| Extracted from HWINFO_N.dat
|-
| 0x20
| 4
| Lower TitleID of exported app
|-
| 0x24
| 4
| Upper TitleID of exported app
|-
| 0x28
| 11 * 4
| Contains the total lengths for each of the 11 parts.
|-
| 0x54
| 8 * 4
| List of content ids in same order as tmd
|-
| 0x74
| 0x3e
| reserved section per [http://www.wiibrew.org/wiki/TMD tmds]
|}

= footer block @ 0x40F4 (size 0x460) =

0000000: d6 f3 24 7c a1 0f 4a dc cd 07 34 d6 ce 62 32 93 ..$|..J...4..b2.
0000010: 11 54 54 a5 28 38 13 5a 0c 87 8e dc 63 0a ab 2e .TT.(8.Z....c...
0000020: 4a 0f 12 5c d7 31 ee 29 72 53 39 1d ff 70 c1 8a J..\.1.)rS9..p..
0000030: 45 18 c1 88 85 1f f5 55 c6 5f 48 37 27 f3 0a 02 E......U._H7'...
0000040: e7 77 18 8b 84 ee cc e5 e4 40 e5 cb 64 bb 0a f3 .w.......@..d...
0000050: 20 00 53 00 74 00 75 00 64 00 69 00 6f 00 0a 00 .S.t.u.d.i.o...
0000060: 4e 00 69 00 6e 00 74 00 65 00 6e 00 64 00 6f 00 N.i.n.t.e.n.d.o.
0000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000d0: 00 00 00 00 00 00 00 00 00 00 00 00 c5 16 e5 12 ................
00000e0: 4c 70 9a fd 7a 03 87 d0 13 94 da 86 46 11 ff 31 Lp..z.......F..1
00000f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000100: 00 00 00 00 00 b5 62 b1 02 c9 4e f3 14 2c 85 3d ......b...N..,.=
0000110: a2 c6 be c9 d8 01 db 46 03 12 44 6e 89 87 c4 e5 .......F..Dn....
0000120: 83 1e 00 03 8f f8 cd 35 e3 e4 b8 8e be 6e 65 36 .......5.....ne6
0000130: f2 6d c6 dc 2c 4b d6 38 2b 2d 7f e5 22 b0 44 3b .m..,K.8+-..".D;
0000140: 00 01 00 02 00 78 58 de a6 c4 70 9c 89 26 22 f2 .....xX...p..&".
0000150: 60 38 cb c5 d7 54 cd a3 d5 b9 d9 b3 84 63 6f be `8...T.......co.
0000160: 36 ef 00 68 f0 9a 6b 35 91 1a 67 6f 73 dc 54 61 6..h..k5..gos.Ta
0000170: c1 c7 6c 6f d4 43 58 e6 e2 62 52 11 65 77 9a ce ..lo.CX..bR.ew..
0000180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001c0: 52 6f 6f 74 2d 43 41 30 30 30 30 30 30 30 31 2d Root-CA00000001-
00001d0: 4d 53 30 30 30 30 30 30 30 38 2d 54 57 63 37 39 MS00000008-TWc79
00001e0: 64 63 65 63 39 2d 30 38 61 32 30 32 38 37 30 31 dcec9-08a2028701
00001f0: 30 38 34 31 31 38 00 00 00 00 00 00 00 00 00 00 084118..........
0000200: 00 00 00 02 41 50 30 30 30 33 30 30 31 35 34 38 ....AP0003001548
0000210: 34 65 34 32 34 35 00 00 00 00 00 00 00 00 00 00 4e4245..........
0000220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000240: 00 00 00 00 00 00 00 00 00 d7 c1 33 4e 24 8c 13 ...........3N$..
0000250: 0f b3 f4 c4 bb 2a 4a 79 81 51 39 6f 00 ee a2 00 .....*Jy.Q9o....
0000260: 20 a6 f5 cc d8 72 01 74 60 57 4f a4 92 52 9b 5a ....r.t`WO..R.Z
0000270: 56 75 a9 62 4f 67 25 e3 7b 05 21 e4 4f 1f c3 21 Vu.bOg%.{.!.O..!
0000280: 2b d8 ec e7 00 00 00 00 00 00 00 00 00 00 00 00 +...............
0000290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002c0: 00 01 00 02 00 db da 21 3b e1 f1 bf bb 4d dc 1d .......!;....M..
00002d0: 60 29 da 19 42 1e 66 4f a8 e5 27 a1 d4 ea 46 7d `)..B.fO..'...F}
00002e0: 9b b4 00 95 c5 0d e8 fa ef a7 8d e9 bc 54 da c1 .............T..
00002f0: 24 94 0b 7c ad a8 61 d5 05 97 c2 64 38 ad 18 f9 $..|..a....d8...
0000300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000340: 52 6f 6f 74 2d 43 41 30 30 30 30 30 30 30 31 2d Root-CA00000001-
0000350: 4d 53 30 30 30 30 30 30 30 38 00 00 00 00 00 00 MS00000008......
0000360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000380: 00 00 00 02 54 57 63 37 39 64 63 65 63 39 2d 30 ....TWc79dcec9-0
0000390: 38 61 32 30 32 38 37 30 31 30 38 34 31 31 38 00 8a2028701084118.
00003a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00003b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00003c0: 00 00 00 00 6f dd de 42 01 e0 34 a3 19 bc a9 af ....o..B..4.....
00003d0: 50 fe 8a ac 75 08 07 a9 3a 2c 21 51 93 ae 4a 90 P...u...:,!Q..J.
00003e0: 6e 62 41 f1 a2 fe 00 00 3d 0a 13 97 da 53 17 98 nbA.....=....S..
00003f0: 69 38 65 67 ca f4 9c 87 ec 44 b7 eb d0 ec b8 3d i8eg.....D.....=
0000400: 23 cf 7a 35 00 00 00 00 00 00 00 00 00 00 00 00 #.z5............
0000410: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000420: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000430: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

{| class="wikitable"
|-
! Offset
! Size
! Description
|-
| 0x00
| 20
| SHA1 of banner
|-
| 0x14
| 20
| SHA1 of tna4
|-
| 0x28
| 20
| SHA1 of tmd
|-
| 0x3c
| 20*8
| SHA1 of up to 8 contents [if unused, can be whatever happened to be in memory before]
|-
| 0xdc
| 20
| SHA1 of save data
|-
| 0xf0
| 20
| SHA1 of ?
|-
| 0x104
| 0x3c
| ECC signature of previous 0x104 bytes with AP cert
|-
| 0x140
| 0x180
| AP cert, signed by TW cert
|-
| 0x2c0
| 0x180
| TW cert, specific to a console (see dev.kp)
|}

It is assumed that this block contains an ECC signature, aswell as the console id and serial of the DSi that exported the file, as part of a Nintendo cert. Much like the Wii, the DSi carries with it a private ECC key that it can use to sign things, and a certificate signed by Nintendo that attests to the fact that the public ECC key belongs to a genuine DSi.

Exporting Apps

2010-10-19T21:15:54Z

Neimod: moved Exporting Apps to Tad: I DO NOT NEED A REASON

#REDIRECT [[Tad]]

SD title export

2010-10-19T21:15:54Z

Neimod: moved Exporting Apps to Tad: I DO NOT NEED A REASON

The System Settings application delivered with each DSi can be used to export applications from NAND to SD. The files created on SD are encrypted with AES CCM (CTR with CBC-MAC), using a combination of a shared key and a console specific key.

The application itself (APP), and the title metadata (TMD) is encrypted with a console specific key. This means that Nintendo intended that these files can only be imported back into the same DSi.

While the banner, the public savegame, and several other metablocks are encrypted with a shared key, which means any DSi can inspect these parts of the file.

[[ES block encryption]] is used to encrypt the header block, footer block, and the 11 parts. Each are their own seperate ES blocks.

= header block @ 0x4020 (size 0xB4) =
0000000: 34 41 4e 54 31 30 00 01 74 e9 2c 1e 24 00 00 00 4ANT10..t.,.$...
0000010: d6 e0 39 c3 98 3f 06 b6 9a b2 9d 14 e7 06 e9 00 ..9..?..........
0000020: 45 4d 44 4b 04 00 03 00 28 02 00 00 20 d2 e0 00 EMDK....(... ...
0000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000040: 00 00 00 00 00 00 00 00 00 00 00 00 80 80 06 00 ................
0000050: 00 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 ................
0000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000070: 00 00 00 00 00 80 06 00 00 00 00 00 00 00 00 00 ................
0000080: 00 00 00 00 00 86 00 00 00 00 00 00 00 00 00 00 ................
0000090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000b0: 00 00 00 00 ....

{| class="wikitable"
|-
! Offset
! Size
! Description
|-
| 0x00
| 4
| Always 0x544E4134 ('TNA4', endian-swapped)
|-
| 0x04
| 2
| group_id/publisher code
|-
| 0x06
| 2
| Title version
|-
| 0x08
| 6
| DSi MAC address
|-
| 0x0E
| 2
| zero
|-
| 0x10
| 16
| Extracted from HWINFO_N.dat
|-
| 0x20
| 4
| Lower TitleID of exported app
|-
| 0x24
| 4
| Upper TitleID of exported app
|-
| 0x28
| 11 * 4
| Contains the total lengths for each of the 11 parts.
|-
| 0x54
| 8 * 4
| List of content ids in same order as tmd
|-
| 0x74
| 0x3e
| reserved section per [http://www.wiibrew.org/wiki/TMD tmds]
|}

= footer block @ 0x40F4 (size 0x460) =

0000000: d6 f3 24 7c a1 0f 4a dc cd 07 34 d6 ce 62 32 93 ..$|..J...4..b2.
0000010: 11 54 54 a5 28 38 13 5a 0c 87 8e dc 63 0a ab 2e .TT.(8.Z....c...
0000020: 4a 0f 12 5c d7 31 ee 29 72 53 39 1d ff 70 c1 8a J..\.1.)rS9..p..
0000030: 45 18 c1 88 85 1f f5 55 c6 5f 48 37 27 f3 0a 02 E......U._H7'...
0000040: e7 77 18 8b 84 ee cc e5 e4 40 e5 cb 64 bb 0a f3 .w.......@..d...
0000050: 20 00 53 00 74 00 75 00 64 00 69 00 6f 00 0a 00 .S.t.u.d.i.o...
0000060: 4e 00 69 00 6e 00 74 00 65 00 6e 00 64 00 6f 00 N.i.n.t.e.n.d.o.
0000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000d0: 00 00 00 00 00 00 00 00 00 00 00 00 c5 16 e5 12 ................
00000e0: 4c 70 9a fd 7a 03 87 d0 13 94 da 86 46 11 ff 31 Lp..z.......F..1
00000f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000100: 00 00 00 00 00 b5 62 b1 02 c9 4e f3 14 2c 85 3d ......b...N..,.=
0000110: a2 c6 be c9 d8 01 db 46 03 12 44 6e 89 87 c4 e5 .......F..Dn....
0000120: 83 1e 00 03 8f f8 cd 35 e3 e4 b8 8e be 6e 65 36 .......5.....ne6
0000130: f2 6d c6 dc 2c 4b d6 38 2b 2d 7f e5 22 b0 44 3b .m..,K.8+-..".D;
0000140: 00 01 00 02 00 78 58 de a6 c4 70 9c 89 26 22 f2 .....xX...p..&".
0000150: 60 38 cb c5 d7 54 cd a3 d5 b9 d9 b3 84 63 6f be `8...T.......co.
0000160: 36 ef 00 68 f0 9a 6b 35 91 1a 67 6f 73 dc 54 61 6..h..k5..gos.Ta
0000170: c1 c7 6c 6f d4 43 58 e6 e2 62 52 11 65 77 9a ce ..lo.CX..bR.ew..
0000180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00001c0: 52 6f 6f 74 2d 43 41 30 30 30 30 30 30 30 31 2d Root-CA00000001-
00001d0: 4d 53 30 30 30 30 30 30 30 38 2d 54 57 63 37 39 MS00000008-TWc79
00001e0: 64 63 65 63 39 2d 30 38 61 32 30 32 38 37 30 31 dcec9-08a2028701
00001f0: 30 38 34 31 31 38 00 00 00 00 00 00 00 00 00 00 084118..........
0000200: 00 00 00 02 41 50 30 30 30 33 30 30 31 35 34 38 ....AP0003001548
0000210: 34 65 34 32 34 35 00 00 00 00 00 00 00 00 00 00 4e4245..........
0000220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000240: 00 00 00 00 00 00 00 00 00 d7 c1 33 4e 24 8c 13 ...........3N$..
0000250: 0f b3 f4 c4 bb 2a 4a 79 81 51 39 6f 00 ee a2 00 .....*Jy.Q9o....
0000260: 20 a6 f5 cc d8 72 01 74 60 57 4f a4 92 52 9b 5a ....r.t`WO..R.Z
0000270: 56 75 a9 62 4f 67 25 e3 7b 05 21 e4 4f 1f c3 21 Vu.bOg%.{.!.O..!
0000280: 2b d8 ec e7 00 00 00 00 00 00 00 00 00 00 00 00 +...............
0000290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00002c0: 00 01 00 02 00 db da 21 3b e1 f1 bf bb 4d dc 1d .......!;....M..
00002d0: 60 29 da 19 42 1e 66 4f a8 e5 27 a1 d4 ea 46 7d `)..B.fO..'...F}
00002e0: 9b b4 00 95 c5 0d e8 fa ef a7 8d e9 bc 54 da c1 .............T..
00002f0: 24 94 0b 7c ad a8 61 d5 05 97 c2 64 38 ad 18 f9 $..|..a....d8...
0000300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000340: 52 6f 6f 74 2d 43 41 30 30 30 30 30 30 30 31 2d Root-CA00000001-
0000350: 4d 53 30 30 30 30 30 30 30 38 00 00 00 00 00 00 MS00000008......
0000360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000380: 00 00 00 02 54 57 63 37 39 64 63 65 63 39 2d 30 ....TWc79dcec9-0
0000390: 38 61 32 30 32 38 37 30 31 30 38 34 31 31 38 00 8a2028701084118.
00003a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00003b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00003c0: 00 00 00 00 6f dd de 42 01 e0 34 a3 19 bc a9 af ....o..B..4.....
00003d0: 50 fe 8a ac 75 08 07 a9 3a 2c 21 51 93 ae 4a 90 P...u...:,!Q..J.
00003e0: 6e 62 41 f1 a2 fe 00 00 3d 0a 13 97 da 53 17 98 nbA.....=....S..
00003f0: 69 38 65 67 ca f4 9c 87 ec 44 b7 eb d0 ec b8 3d i8eg.....D.....=
0000400: 23 cf 7a 35 00 00 00 00 00 00 00 00 00 00 00 00 #.z5............
0000410: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000420: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000430: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

{| class="wikitable"
|-
! Offset
! Size
! Description
|-
| 0x00
| 20
| SHA1 of banner
|-
| 0x14
| 20
| SHA1 of tna4
|-
| 0x28
| 20
| SHA1 of tmd
|-
| 0x3c
| 20*8
| SHA1 of up to 8 contents [if unused, can be whatever happened to be in memory before]
|-
| 0xdc
| 20
| SHA1 of save data
|-
| 0xf0
| 20
| SHA1 of ?
|-
| 0x104
| 0x3c
| ECC signature of previous 0x104 bytes with AP cert
|-
| 0x140
| 0x180
| AP cert, signed by TW cert
|-
| 0x2c0
| 0x180
| TW cert, specific to a console (see dev.kp)
|}

It is assumed that this block contains an ECC signature, aswell as the console id and serial of the DSi that exported the file, as part of a Nintendo cert. Much like the Wii, the DSi carries with it a private ECC key that it can use to sign things, and a certificate signed by Nintendo that attests to the fact that the public ECC key belongs to a genuine DSi.

ES block encryption

2010-09-29T16:03:25Z

Neimod:

ES block encryption, for lack of a better name, is a commonly used data encryption method on DSi by Nintendo.

It uses AES CCM to encrypt a maximum of 0x20000 bytes of data per time, and extends it with a 32 byte metablock at the end.

A part of the last 16 bytes of metablock itself is encrypted with AES CTR, and contains the nonce for decryption and size of the ES block:
0000000: qq qq qq qq qq qq qq qq qq qq qq qq qq qq qq qq
0000010: xx nn nn nn nn nn nn nn nn nn nn nn nn yy yy yy

The counter used for decrypting the last 16 bytes of the metablock is the last 16 bytes of the metablock itself, with the first, 14th, 15th and 16th byte set to 0:
00 nn nn nn nn nn nn nn nn nn nn nn nn 00 00 00

After decrypting the metablock, xx is always 0x3A, and yy is the size of the ES block (excluding the metablock). The nonce after decryption is not used. The 16-byte block qq is a MAC (Message Authentication Code) calculated via AES CBC-MAC, used to verify the contents of the ES block after decryption.

The same 12-byte nonce from the metablock is again used to decrypt the whole ES block itself.

Data larger than 0x20000 bytes is split into multiple ES blocks, each with their own metablock.

A couple of tools to work with DSi AES CTR/CCM binaries can be found [http://github.com/neimod/dsi here].

Talk:DSi exploits

2010-07-12T04:24:09Z

Neimod: Reverted edits by Supersonic56 (Talk) to last revision by Bg4545

SD title export

2010-07-11T18:38:13Z

Neimod:

IO Map

2010-07-10T17:44:03Z

Neimod:

== New ARM7 IO registers ==
{| class="wikitable" border="1"
! NAME
! ADDRESS
! WIDTH
|-
| REG_IE2
| 0x04000218
| 4
|-
| REG_IF2
| 0x0400021C
| 4
|-
| REG_AESCNT
| 0x04004400
| 4
|-
| REG_AESBLKCNT
| 0x04004404
| 4
|-
| REG_AESWRFIFO
| 0x04004408
| 4
|-
| REG_AESRDFIFO
| 0x0400440C
| 4
|-
| REG_AESCTR
| 0x04004420
| 16
|-
| REG_AESMAC
| 0x04004430
| 16
|-
| REG_AESKEY0
| 0x04004440
| 48
|-
| REG_AESKEY1
| 0x04004470
| 48
|-
| REG_AESKEY2
| 0x040044A0
| 48
|-
| REG_AESKEY3
| 0x040044D0
| 48
|-
| REG_I2CDATA
| 0x04004500
| 1
|-
| REG_I2CCNT
| 0x04004501
| 1
|-
| REG_SNDEXCNT
| 0x04004700
| 2
|}

IO Map

2010-07-10T17:42:32Z

Neimod:

IO Map

2010-07-10T17:42:21Z

Neimod:

== New ARM7 IO registers ==
{| class="wikitable" border="1"
! NAME
! ADDRESS
! WIDTH
|-
| REG_IE2
| 0x04000218
| 4
|-
| REG_IF2
| 0x0400021C
| 4
|-
| REG_AESCNT
| 0x04004400
| 4
|-
| REG_AESBLKCNT
| 0x04004404
| 4
|-
| REG_AESWRFIFO
| 0x04004408
| 4
|-
| REG_AESRDFIFO
| 0x0400440C
| 4
|-
| REG_AESCTR
| 0x04004420
| 16
|-
| REG_AESMAC
| 0x04004430
| 16
|-
| REG_AESKEY0
| 0x04004440
| 48
|-
| REG_AESKEY1
| 0x04004470
| 48
|-
| REG_AESKEY2
| 0x040044A0
| 48
|-
| REG_AESKEY3
| 0x040044D0
| 48
| REG_I2CDATA
| 0x04004500
| 1
|-
| REG_I2CCNT
| 0x04004501
| 1
|}

IO Map

2010-07-10T17:41:33Z

Neimod:

IO Map

2010-07-10T17:41:00Z

Neimod:

== New ARM7 IO registers ==
{| class="wikitable" border="1"
! NAME
! ADDRESS
! WIDTH
|-
| 0x04000218
| 4
| REG_IE2
|-
| 0x0400021C
| 4
| REG_IF2
|-
| REG_AESCNT
| 0x04004400
| 4
|-
| REG_AESBLKCNT
| 0x04004404
| 4
|-
| REG_AESWRFIFO
| 0x04004408
| 4
|-
| REG_AESRDFIFO
| 0x0400440C
| 4
|-
| REG_AESCTR
| 0x04004420
| 16
|-
| REG_AESMAC
| 0x04004430
| 16
|-
| REG_AESKEY0
| 0x04004440
| 48
|-
| REG_AESKEY1
| 0x04004470
| 48
|-
| REG_AESKEY2
| 0x040044A0
| 48
|-
| REG_AESKEY3
| 0x040044D0
| 48
|}

IO Map

2010-07-10T17:39:55Z

Neimod: Created page with '== Registers == {| class="wikitable" border="1" ! NAME ! ADDRESS ! WIDTH |- | REG_AESCNT | 0x04004400 | 4 |- | REG_AESBLKCNT | 0x04004404 | 4 |- | REG_AESWRFIFO | 0x040…'

== Registers ==
{| class="wikitable" border="1"
! NAME
! ADDRESS
! WIDTH
|-
| REG_AESCNT
| 0x04004400
| 4
|-
| REG_AESBLKCNT
| 0x04004404
| 4
|-
| REG_AESWRFIFO
| 0x04004408
| 4
|-
| REG_AESRDFIFO
| 0x0400440C
| 4
|-
| REG_AESCTR
| 0x04004420
| 16
|-
| REG_AESMAC
| 0x04004430
| 16
|-
| REG_AESKEY0
| 0x04004440
| 48
|-
| REG_AESKEY1
| 0x04004470
| 48
|-
| REG_AESKEY2
| 0x040044A0
| 48
|-
| REG_AESKEY3
| 0x040044D0
| 48
|}

Hardware

2010-07-09T04:02:43Z

Neimod:

{{stub}}

== Specifications ==

*[[Cameras|Includes (2) 0.3 Megapixel VGA Cameras]]
*240MB(+16MB probably reserved for wear leveling purposes (e.g. replacing bad blocks)) Internal Flash Memory - Samsung kmapf0000m-S998 MOVI [[NAND]] - MMC Interface
*16MB RAM - NEC uPD 46128512AF1 - DDR SRAM or a Fujitsu 128-Mbit FCRAM 82DBS08164D-70L (datasheet: http://edevice.fujitsu.com/fj/DATASHEET/e-ds/e511454.pdf)
*(2) 256 x 192 3.25 Inch Displays, one of which has a resistive touch screen
*Backwards compatible with Nintendo DS games but not GBA games due to the lack of a gameboy cartridge port.
*Integrated ARM7/ARM9 cores clocked at 133mhz in real mode and downclocked to 66mhz for compatibility mode.
*PAIC3000D Sound Chip - possibly a TI codecs: AIC3 ????
*Mitsumi (MM3317A) or TI 72071B0 - Power supply and charger circuit ????
*SD/SDHC Card slot
*WiFi dongle with integrated 128KB SPI Flash for NVRAM, WiFi settings

== Images ==

=== Front ===

[[Image:Twl_front.jpg]]

The socket to the left of the ARM processor is the wifi chip socket.

=== Back ===

[[Image:Twl_back.jpg]]

=== NAND pinout ===
[[Image:Dsi_nand.jpg|600px]]
[[Image:Dsi_nanddat.png|600px]]

=== PCB overlay ===
[[Image:Nintendo DSi PCB Layered.jpg|600px]]
=== CPU with new ram ===

[[Image:CPUv2.jpg]]

=== Glamor Shot ===

[[Image:Nintendo-dsi-Glamor-Shot.jpg]]

== References ==

# http://en.wikipedia.org/wiki/Nintendo_DSi
# http://insidetronics.blogspot.com/2008/11/new-nintendo-dsi-teardown.html
# http://techon.nikkeibp.co.jp/english/NEWS_EN/20081111/161077/
# http://games.gearlive.com/playfeed/article/q408-nintendo-dsi-announced-larger-screens-dual-cameras-dsi-shop-store/
# http://www.ifixit.com/Guide/First-Look/Nintendo-DSi/714/1

File:Dsi nanddat.png

2010-07-09T04:01:35Z

Neimod:

PXI

2010-07-04T21:24:21Z

Neimod:

PXI is the inter-processor communication interface between the ARM7 and ARM9. Most user code runs on the ARM9 and makes requests to the ARM7 to access various hardware (SD, NAND, AES, etc). Each module is identified by a tag.

* PXI 0xB: CARD
* PXI 0x13: AES
** subcommand 1,0
** subcommand 7,6
** subcommand 0xA, 0
** subcommand 0xA, 1
** subcommand 0xA, 2
** subcommand 0xA, 3
** subcommand 0xA, 4
* PXI 0x14: FATFS
** subcommand 0x0: read
** subcommand 0x1: write
** subcommand 0x8: close
** subcommand 0xD: open
** subcommand 0xE: seek
** subcommand 0x15: deletefile
** subcommand 0x16: renamefile?
** subcommand 0x17: getpathinfo
** subcommand 0x19: createdir
** subcommand 0x1f: truncate

** subcommand 0x20: createfile
* PXI 0x13: SEA
** subcommand 1,0

PXI

2010-07-04T21:23:35Z

Neimod:

PXI is the inter-processor communication interface between the ARM7 and ARM9. Most user code runs on the ARM9 and makes requests to the ARM7 to access various hardware (SD, NAND, AES, etc). Each module is identified by a tag.

* PXI 0xB: CARD NITROFS
* PXI 0x13: AES
** subcommand 1,0
** subcommand 7,6
** subcommand 0xA, 0
** subcommand 0xA, 1
** subcommand 0xA, 2
** subcommand 0xA, 3
** subcommand 0xA, 4
* PXI 0x14: FATFS
** subcommand 0x0: read
** subcommand 0x1: write
** subcommand 0x8: close
** subcommand 0xD: open
** subcommand 0xE: seek
** subcommand 0x15: deletefile
** subcommand 0x16: renamefile?
** subcommand 0x17: getpathinfo
** subcommand 0x19: createdir
** subcommand 0x1f: truncate

** subcommand 0x20: createfile
* PXI 0x13: SEA
** subcommand 1,0

DSi cartridge header

2010-06-25T10:09:56Z

Neimod: Updated hash description at 0x3A0 - thanks mxs

The following tries to document the structure of the NDS ROM format and its DSi extended version.

{| class="wikitable" border="1"
|-
! OFFSET
! SIZE
! DESCRIPTION
|-
| 0x000
| 12
| Game Title
|-
| 0x00C
| 4
| Gamecode
|-
| 0x010
| 2
| Makercode
|-
| 0x012
| 1
| Unitcode
|-
| 0x013
| 1
| Encryption seed select
|-
| 0x014
| 1
| Devicecapacity
|-
| 0x015
| 9
| Reserved
|-
| 0x01E
| 1
| ROM Version
|-
| 0x01F
| 1
| Internal flags, (Bit2: Autostart)
|-
| 0x020
| 4
| ARM9 rom offset
|-
| 0x024
| 4
| ARM9 entry address
|-
| 0x028
| 4
| ARM9 load address
|-
| 0x02C
| 4
| ARM9 size
|-
| 0x030
| 4
| ARM7 rom offset
|-
| 0x034
| 4
| ARM7 entry address
|-
| 0x038
| 4
| ARM7 load address
|-
| 0x03C
| 4
| ARM7 size
|-
| 0x040
| 4
| File Name Table (FNT) offset
|-
| 0x044
| 4
| File Name Table (FNT) length
|-
| 0x048
| 4
| File Allocation Table (FAT) offset
|-
| 0x04C
| 4
| File Allocation Table (FAT) length
|-
| 0x050
| 4
| ARM9 overlay offset
|-
| 0x054
| 4
| ARM9 overlay length
|-
| 0x058
| 4
| ARM7 overlay offset
|-
| 0x05C
| 4
| ARM7 overlay length
|-
| 0x060
| 4
| Normal card control register settings
|-
| 0x064
| 4
| Secure card control register settings
|-
| 0x068
| 4
| Icon Banner offset
|-
| 0x06C
| 2
| Secure area (2K) CRC
|-
| 0x06E
| 2
| Secure transfer timeout
|-
| 0x070
| 4
| ARM9 autoload
|-
| 0x074
| 4
| ARM7 autoload
|-
| 0x078
| 8
| Secure disable
|-
| 0x080
| 4
| NTR region ROM size
|-
| 0x084
| 4
| Header size
|-
| 0x088
| 56
| Reserved
|-
| 0x0C0
| 156
| Nintendo Logo
|-
| 0x15C
| 2
| Nintendo Logo CRC
|-
| 0x15E
| 2
| Header CRC
|-
| 0x160
| 32
| Debugger reserved
|-
| 0x180
| 52
| Config settings
|-
| 0x1B4
| 4
| Access control
|-
| 0x1B8
| 4
| ARM7 SCFG EXT mask (controls which devices to enable)
|-
| 0x1BC
| 4
| Reserved
|-
| 0x1C0
| 4
| ARM9i rom offset
|-
| 0x1C4
| 4
| Reserved
|-
| 0x1C8
| 4
| ARM9i load address
|-
| 0x1CC
| 4
| ARM9i size
|-
| 0x1D0
| 4
| ARM7i rom offset
|-
| 0x1D4
| 4
| Reserved
|-
| 0x1D8
| 4
| ARM7i load address
|-
| 0x1DC
| 4
| ARM7i size
|-
| 0x1E0
| 4
| Digest NTR region offset
|-
| 0x1E4
| 4
| Digest NTR region length
|-
| 0x1E8
| 4
| Digest TWL region offset
|-
| 0x1EC
| 4
| Digest TWL region length
|-
| 0x1F0
| 4
| Digest Sector Hashtable offset
|-
| 0x1F4
| 4
| Digest Sector Hashtable length
|-
| 0x1F8
| 4
| Digest Block Hashtable offset
|-
| 0x1FC
| 4
| Digest Block Hashtable length
|-
| 0x200
| 4
| Digest Sector size
|-
| 0x204
| 4
| Digest Block sectorcount
|-
| 0x208
| 24
| Reserved
|-
| 0x220
| 4
| Modcrypt area 1 offset
|-
| 0x224
| 4
| Modcrypt area 1 size
|-
| 0x228
| 4
| Modcrypt area 2 offset
|-
| 0x22C
| 4
| Modcrypt area 2 size
|-
| 0x230
| 8
| Title ID
|-
| 0x238
| 200
| Reserved
|-
| 0x300
| 20
| ARM9 (with encrypted secure area) SHA1 HMAC hash
|-
| 0x314
| 20
| ARM7 SHA1 HMAC hash
|-
| 0x328
| 20
| Digest master SHA1 HMAC hash
|-
| 0x33C
| 20
| Banner SHA1 HMAC hash
|-
| 0x350
| 20
| ARM9i (decrypted) SHA1 HMAC hash
|-
| 0x364
| 20
| ARM7i (decrypted) SHA1 HMAC hash
|-
| 0x378
| 40
| Reserved
|-
| 0x3A0
| 20
| ARM9 (without secure area) SHA1 HMAC hash
|-
| 0x3B4
| 2636
| Reserved
|-
| 0xE00
| 0x180
| Reserved and unchecked region, always zero. Used for passing arguments in debug environment.
|-
| 0xF80
| 0x80
| RSA signature
|}

The first 0xE00 bytes of the NDS header is signed with an 1024-bit RSA signature.

= Modcrypt =
Modcrypt is a new additional way of encrypting parts of the NDS ROM executable binary modules using AES CTR. It is mostly being used to encrypt the ARM9i and ARM7i binaries. For example, DSi hybrid card based games have only the ARM9i binary encrypted, while NAND based applications have both the ARM9i and ARM7i binaries encrypted. The modcrypt areas can span over any of the ARM9/ARM7/ARM9i/ARM7i areas.

The AES counter used for modcrypt area 1 is the first 16 bytes of the ARM9 SHA1 HMAC hash (0x300), and for area 2 the first 16 bytes of the ARM7 SHA1 HMAC hash (0x314). The AES key used is a little more complicated. The header can specify to use a secure or insecure key:

if ( (header[0x1C] & 4) || (header[0x1BF] & 0x80) )
keytype = INSECURE;
else
keytype = SECURE;

The insecure key is simply the first 16 bytes of the header. The secure key is constructed from a scrambled key pair, where one part is based on an 8-byte shared secret between all DSi's and an 8-byte expanded gamecode, and the other part is based on the first 16 bytes of the ARM9i SHA1 HMAC hash (0x350). The key pair is scrambled in an unknown way to form the final secure key.

It is likely that the insecure key is only used for a debug version of an application, since most card based and NAND based applications are using the secure key.

= Digests =
The NDS format has been extended with a hash tree to verify the entire contents of an NDS ROM. The NDS ROM is divided into sectors, and each sector will be hashed and have its hash stored in the digest sector hashtable. The size of a sector is defined in the header aswell. Furthermore, the sector hashtable is partitioned and hashed again to form block hashes. This block hashtable is hashed again into a single hash called the digest master hash. These hashtables can be used to verify that the sectors of a NDS ROM have not been tampered with, since the integrity of a sector hash can be verified by a block hash, which in turn can be verified by the master hash. And this hash is part of the header, which is signed with RSA.

The sector hashtable reaches over the NTR and TWL regions, respectively.

SNDEX

2010-04-03T05:39:22Z

Neimod:

The DSi has extended the sound memory mapped I/O interface.

=== ARM7 IO REGISTERS ===
{| class="wikitable" border="1"
|-
! ADDRESS
! WIDTH (bytes)
! NAME
|-
| 0x04004700
| 2
| REG_SNDEXCNT
|}

{| class="wikitable" border="1"
|+ '''REG_SNDEXCNT'''
|-
! BIT
! DESCRIPTION
|-
| 3-0
| NITRO/DSP ratio, valid range is 0 to 8.
|-
| 13
| I2S frequency, 0=32.73 kHz, 1=47.61 kHz
|-
| 14
| Mute status
|}

=== NITRO/DSP ratio ===
The DSP can generate sound output aswell, alongside the old NITRO sound mixer. The following settings configure the ratio between DSP and NITRO mixer output:

{| class="wikitable" border="1"
|-
! Setting
! Description
|-
| 0
| DSP sound 8/8, NITRO sound 0/8 (=DSP sound only)
|-
| 1
| DSP sound 7/8, NITRO sound 1/8
|-
| 2
| DSP sound 6/8, NITRO sound 2/8
|-
| 3
| DSP sound 5/8, NITRO sound 3/8
|-
| 4
| DSP sound 4/8, NITRO sound 4/8
|-
| 5
| DSP sound 3/8, NITRO sound 5/8
|-
| 6
| DSP sound 2/8, NITRO sound 6/8
|-
| 7
| DSP sound 1/8, NITRO sound 7/8
|-
| 8
| DSP sound 0/8, NITRO sound 8/8 (=NITRO sound only)
|}

SNDEX

2010-04-02T01:28:51Z

Neimod: NITRO/DSP rations were in wrong order. Fixed

The DSi has extended the sound memory mapped I/O interface.

=== ARM7 IO REGISTERS ===
{| class="wikitable" border="1"
|-
! ADDRESS
! WIDTH (bytes)
! NAME
|-
| 0x04004700
| 2
| REG_SNDEXCNT
|}

{| class="wikitable" border="1"
|+ '''REG_SNDEXCNT'''
|-
! BIT
! DESCRIPTION
|-
| 3-0
| NITRO/DSP ratio, valid range is 0 to 8.
|-
| 13
| I2S frequency
|-
| 14
| Mute status
|}

=== NITRO/DSP ratio ===
The DSP can generate sound output aswell, alongside the old NITRO sound mixer. The following settings configure the ratio between DSP and NITRO mixer output:

{| class="wikitable" border="1"
|-
! Setting
! Description
|-
| 0
| DSP sound 8/8, NITRO sound 0/8 (=DSP sound only)
|-
| 1
| DSP sound 7/8, NITRO sound 1/8
|-
| 2
| DSP sound 6/8, NITRO sound 2/8
|-
| 3
| DSP sound 5/8, NITRO sound 3/8
|-
| 4
| DSP sound 4/8, NITRO sound 4/8
|-
| 5
| DSP sound 3/8, NITRO sound 5/8
|-
| 6
| DSP sound 2/8, NITRO sound 6/8
|-
| 7
| DSP sound 1/8, NITRO sound 7/8
|-
| 8
| DSP sound 0/8, NITRO sound 8/8 (=NITRO sound only)
|}

SNDEX

2010-03-28T17:46:25Z

Neimod: New page: The DSi has extended the sound memory mapped I/O interface. === ARM7 IO REGISTERS === {| class="wikitable" border="1" |- ! ADDRESS ! WIDTH (bytes) ! NAME |- | 0x04004700 | 2 | REG_...

The DSi has extended the sound memory mapped I/O interface.

=== ARM7 IO REGISTERS ===
{| class="wikitable" border="1"
|-
! ADDRESS
! WIDTH (bytes)
! NAME
|-
| 0x04004700
| 2
| REG_SNDEXCNT
|}

{| class="wikitable" border="1"
|+ '''REG_SNDEXCNT'''
|-
! BIT
! DESCRIPTION
|-
| 3-0
| NITRO/DSP ratio, valid range is 0 to 8.
|-
| 13
| I2S frequency
|-
| 14
| Mute status
|}

=== NITRO/DSP ratio ===
The DSP can generate sound output aswell, alongside the old NITRO sound mixer. The following settings configure the ratio between DSP and NITRO mixer output:

{| class="wikitable" border="1"
|-
! Setting
! Description
|-
| 0
| NITRO sound 8/8, DSP 0/8 (=NITRO sound only)
|-
| 1
| NITRO sound 7/8, DSP 1/8
|-
| 2
| NITRO sound 6/8, DSP 2/8
|-
| 3
| NITRO sound 5/8, DSP 3/8
|-
| 4
| NITRO sound 4/8, DSP 4/8
|-
| 5
| NITRO sound 3/8, DSP 5/8
|-
| 6
| NITRO sound 2/8, DSP 6/8
|-
| 7
| NITRO sound 1/8, DSP 7/8
|-
| 8
| NITRO sound 0/8, DSP 8/8 (=DSP sound only)
|}