https://dsibrew.org/w/api.php?action=feedcontributions&user=Khmann&feedformat=atomDSiBrew - User contributions [en]2024-03-28T10:25:04ZUser contributionsMediaWiki 1.35.8https://dsibrew.org/w/index.php?title=WiFi_Module&diff=4305WiFi Module2012-10-09T19:45:05Z<p>Khmann: added dwm-w024 image</p>
<hr />
<div>There appear to be 3 WiFi modules at use in the DSi.<br />
<br />
The original DSi DWM-W015 module features two wireless chips; a Mitsumi MM3218 for DS compatibility and a more modern Atheros AR6002G BGA which share the antenna through an RF switch. The DS WiFi is configured through profiles 1-3 and is limited to 802.11b 1-2Mbps and WEP encryption while the Atheros supports 802.11g rates and WPA encryption, configured through profiles 4-6.<br />
<br />
http://www.flickr.com/photos/micahdowty/3846960965/sizes/o/in/photostream/<br />
Rev0 of this module includes a 1Mbit SPI flash ST M45PE10 [[Media:STM45PE10.pdf]] for NVRAM<br />
<br />
[[Image:DWM-W015a.jpg]]<br />
<br />
Updated (RevA) modules use a very tiny custom chip labeled 5A32 for NVRAM storage.<br />
Note the circle in this image shows a 10k resistor from pin 5 WP to GND, which the ST M45PE10 datasheet indicates will write-protect the first 64K. To disable this protection according to the SPI datasheet, remove the resistor and solder pin 5 to pin 6 VCC.<br />
<br />
The DSi only uses a tiny portion of the 128KB available for startup data, calibration, and user settings. Modules with SPI flash can be written to in DS mode, which enables the installation of WiFi loader "dslink" which can then be launched in DSi mode via save-game hacks in DSi hybrid games. Newer modules with the 5A32 chip are incompatible with this, most likely because the custom chip has significantly less storage. khmann had success backing up the data in a 5A32 using an SPI connection to a DS cartridge, removing the 5A32 and installing a pre-programmed ST M45PE20 2Mbit SPI flash chip which enabled use of the this exploit on a newer console.<br />
<br />
Nintendo's reasons for changing the NVRAM chip are unclear, but it seems all DWM-W015 and DWM-W024 modules have connections for both types of chips, and the change to the limited chip occurred prior to the release of the dslink exploit.<br />
<br />
The Mitsumi WiFi is controlled through data in the NVRAM (eg: calibration data, allowed channels) http://www.daftcode.net/gbatek/ds#dsfirmwarewificalibrationdata while the Atheros configuration is likely stored in the other tiny IC on the board, an i2c eeprom.<br />
<br />
<br />
[[Image:Dwm-w024.jpg]]<br />
<br />
The DSiXL or DSi/LL module is labeled DWM-W024, and includes only an Atheros AR6013G-AL1C, a 5A32 variant, empty SPI flash pads, and another small chip likely to be the Atheros-native i2c configuration.<br />
For reference, the 3DS DWM-W028 module is reported to use an Atheros AR6014G-AL1C.<br />
<br />
<br />
If this module is disconnected the DSi turns on to a black screen, because it can't read the NVRAM. If the DSi doesn't like the data contained on the module it will give either error 0000FEFE or 0000FE00 at poweron.</div>Khmannhttps://dsibrew.org/w/index.php?title=File:Dwm-w024.jpg&diff=4304File:Dwm-w024.jpg2012-10-09T19:43:39Z<p>Khmann: DWM-W024</p>
<hr />
<div>DWM-W024</div>Khmannhttps://dsibrew.org/w/index.php?title=WiFi_Module&diff=4261WiFi Module2012-09-24T19:40:47Z<p>Khmann: </p>
<hr />
<div>There appear to be 3 WiFi modules at use in the DSi.<br />
<br />
The original DSi DWM-W015 module features two wireless chips; a Mitsumi MM3218 for DS compatibility and a more modern Atheros AR6002G BGA which share the antenna through an RF switch. The DS WiFi is configured through profiles 1-3 and is limited to 802.11b 1-2Mbps and WEP encryption while the Atheros supports 802.11g rates and WPA encryption, configured through profiles 4-6.<br />
<br />
http://www.flickr.com/photos/micahdowty/3846960965/sizes/o/in/photostream/<br />
Rev0 of this module includes a 1Mbit SPI flash ST M45PE10 [[Media:STM45PE10.pdf]] for NVRAM<br />
<br />
[[Image:DWM-W015a.jpg]]<br />
<br />
Updated (RevA) modules use a very tiny custom chip labeled 5A32 for NVRAM storage.<br />
Note the circle in this image shows a 10k resistor from pin 5 WP to GND, which the ST M45PE10 datasheet indicates will write-protect the first 64K. To disable this protection according to the SPI datasheet, remove the resistor and solder pin 5 to pin 6 VCC.<br />
<br />
The DSi only uses a tiny portion of the 128KB available for startup data, calibration, and user settings. Modules with SPI flash can be written to in DS mode, which enables the installation of WiFi loader "dslink" which can then be launched in DSi mode via save-game hacks in DSi hybrid games. Newer modules with the 5A32 chip are incompatible with this, most likely because the custom chip has significantly less storage. khmann had success backing up the data in a 5A32 using an SPI connection to a DS cartridge, removing the 5A32 and installing a pre-programmed ST M45PE20 2Mbit SPI flash chip which enabled use of the this exploit on a newer console.<br />
<br />
Nintendo's reasons for changing the NVRAM chip are unclear, but it seems all DWM-W015 and DWM-W024 modules have connections for both types of chips, and the change to the limited chip occurred prior to the release of the dslink exploit.<br />
<br />
The Mitsumi WiFi is controlled through data in the NVRAM (eg: calibration data, allowed channels) http://www.daftcode.net/gbatek/ds#dsfirmwarewificalibrationdata while the Atheros configuration is likely stored in the other tiny IC on the board, an i2c eeprom.<br />
<br />
<br />
The DSiXL or DSi/LL module is labeled DWM-W024, and includes only an Atheros AR6013G-AL1C, a 5A32 variant, empty SPI flash pads, and another small chip likely to be the Atheros-native i2c configuration.<br />
For reference, the 3DS DWM-W028 module is reported to use an Atheros AR6014G-AL1C.<br />
<br />
<br />
If this module is disconnected the DSi turns on to a black screen, because it can't read the NVRAM. If the DSi doesn't like the data contained on the module it will give either error 0000FEFE or 0000FE00 at poweron.</div>Khmannhttps://dsibrew.org/w/index.php?title=WiFi_Module&diff=4260WiFi Module2012-09-24T19:39:52Z<p>Khmann: </p>
<hr />
<div>There appear to be 3 WiFi modules at use in the DSi.<br />
<br />
The original DSi DWM-W015 module features two wireless chips; a Mitsumi MM3218 for DS compatibility and a more modern Atheros AR6002G BGA which share the antenna through an RF switch. The DS WiFi is configured through profiles 1-3 and is limited to 802.11b 1-2Mbps and WEP encryption while the Atheros supports 802.11g rates and WPA encryption, configured through profiles 4-6.<br />
<br />
http://www.flickr.com/photos/micahdowty/3846960965/sizes/o/in/photostream/<br />
Rev0 of this module includes a 1Mbit SPI flash ST M45PE10 [[Media:STM45PE10.pdf]] for NVRAM<br />
<br />
[[Image:DWM-W015a.jpg]]<br />
<br />
Updated (RevA) modules use a very tiny custom chip labeled 5A32 for NVRAM storage.<br />
Note the circle in this image shows a 10k resistor from pin 5 WP to GND, which the ST M45PE10 datasheet indicates will write-protect the first 64K. To disable this protection according to the SPI datasheet, remove the resistor and solder pin 5 to pin 6 VCC.<br />
<br />
The DSi only uses a tiny portion of the 128KB available for startup data, calibration, and user settings. Modules with SPI flash can be written to in DS mode, which enables the installation of WiFi loader "dslink" which can then be launched in DSi mode via save-game hacks in DSi hybrid games. Newer modules with the 5A32 chip are incompatible with this, most likely because the custom chip has significantly less storage. khmann had success backing up the data in a 5A32 using an SPI connection to a DS cartridge, removing the 5A32 and installing a pre-programmed ST M45PE20 2Mbit SPI flash chip which enabled use of the this exploit on a newer console.<br />
<br />
Nintendo's reasons for changing the NVRAM chip are unclear, but it seems all DWM-W015 and DWM-W028 modules have connections for both types of chips, and the change to the limited chip occurred prior to the release of the dslink exploit.<br />
<br />
The Mitsumi WiFi is controlled through data in the NVRAM (eg: calibration data, allowed channels) http://www.daftcode.net/gbatek/ds#dsfirmwarewificalibrationdata while the Atheros configuration is likely stored in the other tiny IC on the board, an i2c eeprom.<br />
<br />
<br />
The DSiXL or DSi/LL module is labeled DWM-W024, and includes only an Atheros AR6013G-AL1C, a 5A32 variant, empty SPI flash pads, and another small chip likely to be the Atheros-native i2c configuration.<br />
For reference, the 3DS is reported to use an Atheros AR6014G-AL1C.<br />
<br />
<br />
If this module is disconnected the DSi turns on to a black screen, because it can't read the NVRAM. If the DSi doesn't like the data contained on the module it will give either error 0000FEFE or 0000FE00 at poweron.</div>Khmannhttps://dsibrew.org/w/index.php?title=WiFi_Module&diff=4259WiFi Module2012-09-24T19:38:19Z<p>Khmann: </p>
<hr />
<div>There appear to be 3 WiFi modules at use in the DSi.<br />
<br />
The original DSi DWM-W015 module features two wireless chips; a Mitsumi MM3218 for DS compatibility and a more modern Atheros AR6002G BGA which share the antenna through an RF switch. The DS WiFi is configured through profiles 1-3 and is limited to 802.11b 1-2Mbps and WEP encryption while the Atheros supports 802.11g rates and WPA encryption, configured through profiles 4-6.<br />
<br />
http://www.flickr.com/photos/micahdowty/3846960965/sizes/o/in/photostream/<br />
Rev0 of this module includes a 1Mbit SPI flash ST M45PE10 [[Media:STM45PE10.pdf]] for NVRAM<br />
<br />
[[Image:DWM-W015a.jpg]]<br />
<br />
Updated (RevA) modules use a very tiny custom chip labeled 5A32 for NVRAM storage.<br />
Note the circle in this image shows a 10k resistor from pin 5 WP to GND, which the ST M45PE10 datasheet indicates will write-protect the first 64K. To disable this protection according to the SPI datasheet, remove the resistor and solder pin 5 to pin 6 VCC.<br />
<br />
The DSi only uses a tiny portion of the 128KB available for startup data, calibration, and user settings. Modules with SPI flash can be written to in DS mode, which enables the installation of WiFi loader "dslink" which can then be launched in DSi mode via save-game hacks in DSi hybrid games. Newer modules with the 5A32 chip are incompatible with this, most likely because the custom chip has significantly less storage. khmann had success backing up the data in a 5A32 using an SPI connection to a DS cartridge, removing the 5A32 and installing a pre-programmed ST M45PE20 2Mbit SPI flash chip which enabled use of the this exploit on a newer console.<br />
<br />
Nintendo's reasons for changing the NVRAM chip are unclear, but it seems all DWM-W015 have connections for both types of chips and the change to the limited chip occurred prior to the release of the dslink exploit.<br />
<br />
The Mitsumi WiFi is controlled through data in the NVRAM (eg: calibration data, allowed channels) http://www.daftcode.net/gbatek/ds#dsfirmwarewificalibrationdata while the Atheros configuration is likely stored in the other tiny IC on the board, an i2c eeprom.<br />
<br />
<br />
The DSiXL or DSi/LL module is labeled DWM-W024, and includes only an Atheros AR6013G-AL1C, a 5A32 variant, empty SPI flash pads, and another small chip likely to be the Atheros-native i2c configuration.<br />
<br />
<br />
If this module is disconnected the DSi turns on to a black screen, because it can't read the NVRAM. If the DSi doesn't like the data contained on the module it will give either error 0000FEFE or 0000FE00 at poweron.</div>Khmannhttps://dsibrew.org/w/index.php?title=NVRAM&diff=4258NVRAM2012-09-24T14:23:15Z<p>Khmann: identify some bits.</p>
<hr />
<div>The DSi contains a 128KB block (organized into 256-byte pages) of memory referred to as "NVRAM"; it is stored in a SPI flash chip onboard the WiFi dongle. On the DS, this was the system's firmware, plus it included writeable areas for user preferences and wifi connection settings. On the DSi, this chip is maintained for backward compatibility, but it is mostly empty.<br />
<br />
(khmann: data actually seems to follow the format of http://www.daftcode.net/gbatek/ds#dsfirmwareheader quite closely to my eyes)<br />
<br />
There is some new unknown data near the beginning of NVRAM which is involved in the boot process. The NVRAM is read very early in boot, before the [[NAND]] flash is initialized. An unreadable NVRAM chip will hang the boot process in an infinite retry loop, and errors in this portion of NVRAM will cause a stage1 [[Bootloader]] error.<br />
<br />
Most of the address space is blank, with the exception of the following data:<br />
<br />
Pages 0-2: Old partial NDS firmware header (for compatibility)<br />
00000: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
00010: 0000 0000 0000 0000 0000 0000 0057 ffff .............W..<br />
00020: c03f 0000 0000 0000 ffff e861 3801 000f .?.........a8...<br />
00030: ffff ffff ff00 0022 4cd8 968a fe3f ffff ......."L....?..<br />
00040: 0394 2902 0200 1700 2600 1818 4800 4048 ..).....&...H.@H<br />
00050: 5800 4200 4601 6480 e6e6 4324 0e00 0100 X.B.F.d...C$....<br />
00060: 0100 0204 0316 4000 1b6c 4880 3800 3507 ......@..lH.8.5.<br />
00070: 0000 0000 0000 0000 b000 0000 0000 00c7 ................<br />
00080: bb01 247f 5a01 3f01 3f36 1d00 7835 5512 ..$.Z.?.?6..x5U.<br />
00090: 341c 0001 0e38 0370 c52a 0a08 0401 0000 4....8.p.*......<br />
000a0: 00ff fffe fefe fefc fcfa fafa fafa f8f8 ................<br />
000b0: f600 1214 1241 2303 0470 350e 2c2c 0000 .....A#..p5.,,..<br />
000c0: 0000 0000 0000 000e 0000 1228 1c00 314c ...........(..1L<br />
000d0: 4f21 0010 b008 fa15 26e7 fe3e 0e51 0500 O!......&..>.Q..<br />
000e0: 6d12 0300 01ff 0e00 0200 0000 0205 0500 m...............<br />
000f0: 0000 1800 0200 0002 1e12 1212 1414 1414 ................<br />
<br />
00100: 1414 1414 1616 1626 2223 2324 2424 2526 .......&"##$$$%&<br />
00110: 2626 2728 2818 014b 4b4b 4b4c 4c4c 4c4c &&'((..KKKKLLLLL<br />
00120: 4c4c 4d4d 4d02 6c71 765b 4045 4a2f 3439 LLMMM.lqv[@EJ/49<br />
00130: 3e03 0814 ffff ffff ffff ffff ffff ffff >...............<br />
00140: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00150: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00160: ffff 1cff ffff ffff ffff ffff ffff ffff ................<br />
00170: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00180: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00190: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001a0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001b0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001c0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001d0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001e0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001f0: ffff ffff ffff ffff ffff ffff ff01 20ff .............. .<br />
<br />
any changes between 0x00 and 0x27, yields bootloader error 0000FEFE<br />
<br />
NVRAM u8 0x1FD is used by launcher to determine which binary to load from the wififw title content, that id *must* match one of the entries in that title content otherwise launcher will display a black error screen while booting. Apparently there are two options for DSi 1.4.4: 01 and 02. Perhaps this is used to identify DWM-W015 vs DWM-W024<br />
<br />
<br />
00200: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
002e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
002f0: 0000 0000 0000 0000 0000 0000 0000 0080 ................<br />
<br />
If bit 7 of 0x2FF = 0, bootloader error 0000FE00, this particular error makes it sound like the DSi is being told to boot from some other area, or with a different encryption.<br />
<br />
<br />
<br />
<br />
There are 10 pages starting at 0x1f400 (page 0xFA) that describe the WiFi settings (2 pages per slot?)<br />
<br />
1f400: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
1f440: 3c65 7373 6964 3e0a 0000 0000 0000 0000 <essid>.......<br />
1f450: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
1f4d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1f4e0: 0000 0000 0000 0000 0900 7805 0000 0001 ..........x.....<br />
1f4f0: 0000 0000 0000 0000 0000 0000 0000 f80f ................<br />
1f500: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
1f5f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
<br />
The last 2 pages store 2 identical copies of user settings.<br />
1fe00: 0500 0b01 0100 6200 7500 7300 6800 6900 ......b.u.s.h.i.<br />
1fe10: 6e00 6700 0000 0000 0000 0700 0000 0000 n.g.............<br />
1fe20: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe30: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe40: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe50: 0000 0000 0000 0000 8102 1603 2020 a30d ............ ..<br />
1fe60: 970c e0a0 00fc 0900 4010 db10 0000 0000 ........@.......<br />
1fe70: 0900 84dd 0100 0300 0000 0000 0000 0000 ................<br />
1fe80: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe90: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fea0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1feb0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fec0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fed0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fee0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fef0: 0000 0000 0000 0000 0000 0000 0000 1fcf ................<br />
<br />
1ff00: 0500 0b01 0100 6200 7500 7300 6800 6900 ......b.u.s.h.i.<br />
1ff10: 6e00 6700 0000 0000 0000 0700 0000 0000 n.g.............<br />
1ff20: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff30: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff40: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff50: 0000 0000 0000 0000 8102 1603 2020 a30d ............ ..<br />
1ff60: 970c e0a0 00fc 0000 0000 0000 0000 0000 ................<br />
1ff70: 0a00 922b 0100 0300 0000 0000 0000 0000 ...+............<br />
1ff80: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff90: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffa0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffb0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffc0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffd0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffe0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fff0: 0000 0000 0000 0000 0000 0000 0000 1fcf ................</div>Khmannhttps://dsibrew.org/w/index.php?title=WiFi_Module&diff=4257WiFi Module2012-09-24T14:00:38Z<p>Khmann: adding DSiXL data, cleaning up, not done yet...</p>
<hr />
<div>There appear to be 3 WiFi modules at use in the DSi.<br />
<br />
The original DSi DWM-W015 module features two wireless chips; a Mitsumi MM3218 for DS compatibility and a more modern Atheros AR6002G BGA which share the antenna through an RF switch. The DS WiFi is configured through profiles 1-3 and is limited to 802.11b 1-2Mbps and WEP encryption while the Atheros supports 802.11g rates and WPA encryption, configured through profiles 4-6.<br />
<br />
http://www.flickr.com/photos/micahdowty/3846960965/sizes/o/in/photostream/<br />
Rev0 of this module includes a 1Mbit SPI flash ST M45PE10 [[Media:STM45PE10.pdf]] for NVRAM<br />
<br />
[[Image:DWM-W015a.jpg]]<br />
Updated (RevA) modules use a very tiny custom chip labeled 5A32 for NVRAM storage.<br />
Note the circle in this image shows a 10k resistor from pin 5 WP to GND, which the ST M45PE10 datasheet indicates will write-protect the first 64K. To disable this protection according to the SPI datasheet, remove the resistor and solder pin 5 to pin 6 VCC.<br />
<br />
The DSi only uses a tiny portion of the 128KB available for startup data, calibration, and user settings. Modules with SPI flash can be written to in DS mode, which enables the installation of WiFi loader "dslink" which can then be launched in DSi mode via save-game hacks in DSi hybrid games. Newer modules with the 5A32 chip are incompatible with this, most likely because the custom chip has significantly less storage. khmann had success backing up the data in a 5A32 using an SPI connection to a DS cartridge, removing the 5A32 and installing a pre-programmed ST M45PE20 2Mbit SPI flash chip which enabled use of the this exploit on a newer console.<br />
<br />
Nintendo's reasons for changing the NVRAM chip are unclear, but it seems all DWM-W015 have connections for both types of chips and the change to the limited chip occurred prior to the release of the dslink exploit.<br />
<br />
The Mitsumi WiFi is controlled through data in the NVRAM (eg: calibration data, allowed channels) http://www.daftcode.net/gbatek/ds#dsfirmwarewificalibrationdata while the Atheros configuration is likely stored in the other tiny IC on the board, an i2c eeprom.<br />
<br />
<br />
The DSiXL or DSi/LL module is labeled DWM-W024, and includes only an Atheros AR6013G-AL1C, a 5A32 variant, empty SPI flash pads, and another small chip likely to be the Atheros-native i2c configuration.<br />
<br />
<br />
If this module is disconnected the DSi turns on to a black screen, because it can't read the NVRAM. If the DSi doesn't like the data contained on the module it will give either error 0000FEFE or 0000FE00 at poweron.</div>Khmannhttps://dsibrew.org/w/index.php?title=Hardware&diff=4242Hardware2012-08-24T17:09:50Z<p>Khmann: </p>
<hr />
<div>{{stub}}<br />
<br />
== Specifications ==<br />
<br />
*[[Cameras|Includes (2) 0.3 Megapixel VGA Cameras]]<br />
*240MB(+16MB probably reserved for wear leveling purposes (e.g. replacing bad blocks)) Internal Flash Memory - Samsung kmapf0000m-S998 MOVI [[NAND]] - MMC Interface<br />
*16MB RAM - NEC uPD 46128512AF1 - DDR SRAM or a Fujitsu 128-Mbit FCRAM 82DBS08164D-70L (datasheet: http://edevice.fujitsu.com/fj/DATASHEET/e-ds/e511454.pdf mirror:[[Media:E511454.pdf]]<br />
*(2) 256 x 192 3.25 Inch Displays, one of which has a resistive touch screen<br />
*Backwards compatible with Nintendo DS games but not GBA games due to the lack of a gameboy cartridge port.<br />
*Integrated ARM7/ARM9 cores clocked at 133mhz in real mode and downclocked to 66mhz for compatibility mode.<br />
*PAIC3000D Sound Chip - possibly a TI codecs: AIC3 ????<br />
*Mitsumi (MM3317A) or TI 72071B0 - Power supply and charger circuit ????<br />
*SD/SDHC Card slot<br />
*[[WiFi_Module]] with integrated 128KB SPI Flash for [[NVRAM]], WiFi settings<br />
<br />
== Hardware Revisions ==<br />
* DSi<br />
** board C/TWL-CPU-01 (Original rev, all pictures below)<br />
** CPU: TWL. The latest date code picture I could find online was "0836 1m" as shown below, however other pictures with CPU covered show the NAND codes as late as 916, so...<br />
** Suspect this is the only board where WiFi chip is available in Hybrid games like CookingCoach<br />
** Wireless card DWM-W015<br />
<br />
* DSi RevA<br />
** board C/TWL-CPU-10 (Newer model, can someone provide a date or serial # range?)<br />
** CPU: TWL A. Mine is "0940 2m". My US Serial # is ~ TW71848???[5]. If yours is earlier, please update this.<br />
[[Image:TWL-CPU-10.png]]<br />
<br />
<br />
* DSi XL<br />
** board C/UTL-CPU-01<br />
** CPU is TWL A<br />
** Wireless card DWM-W024<br />
<br />
== Images ==<br />
<br />
=== Front ===<br />
<br />
[[Image:Twl_front.jpg]]<br />
[[Image:Twl_front_traces.jpg|600px]]<br />
<br />
The socket to the left of the ARM processor is the wifi chip socket.<br />
<br />
TWL CPU pinout map: [[File:Twl_cpu_pinout.pdf]] (WIP)<br />
<br />
=== Back ===<br />
<br />
[[Image:Twl_back.jpg]]<br />
<br />
=== NAND pinout ===<br />
[[Image:Dsi_nand.jpg|600px]]<br />
[[Image:Dsi_nanddat.png|600px]]<br />
<br />
=== PCB overlay ===<br />
[[Image:Nintendo DSi PCB Layered.jpg|600px]]<br />
=== CPU with new ram ===<br />
<br />
[[Image:CPUv2.jpg]]<br />
<br />
=== Glamor Shot ===<br />
<br />
[[Image:Nintendo-dsi-Glamor-Shot.jpg]]<br />
<br />
== References ==<br />
<br />
# http://en.wikipedia.org/wiki/Nintendo_DSi<br />
# http://insidetronics.blogspot.com/2008/11/new-nintendo-dsi-teardown.html<br />
# http://techon.nikkeibp.co.jp/english/NEWS_EN/20081111/161077/<br />
# http://games.gearlive.com/playfeed/article/q408-nintendo-dsi-announced-larger-screens-dual-cameras-dsi-shop-store/<br />
# http://www.ifixit.com/Guide/First-Look/Nintendo-DSi/714/1</div>Khmannhttps://dsibrew.org/w/index.php?title=Hardware&diff=4241Hardware2012-08-24T17:09:03Z<p>Khmann: </p>
<hr />
<div>{{stub}}<br />
<br />
== Specifications ==<br />
<br />
*[[Cameras|Includes (2) 0.3 Megapixel VGA Cameras]]<br />
*240MB(+16MB probably reserved for wear leveling purposes (e.g. replacing bad blocks)) Internal Flash Memory - Samsung kmapf0000m-S998 MOVI [[NAND]] - MMC Interface<br />
*16MB RAM - NEC uPD 46128512AF1 - DDR SRAM or a Fujitsu 128-Mbit FCRAM 82DBS08164D-70L (datasheet: http://edevice.fujitsu.com/fj/DATASHEET/e-ds/e511454.pdf mirror:[[Media:E511454.pdf]]<br />
*(2) 256 x 192 3.25 Inch Displays, one of which has a resistive touch screen<br />
*Backwards compatible with Nintendo DS games but not GBA games due to the lack of a gameboy cartridge port.<br />
*Integrated ARM7/ARM9 cores clocked at 133mhz in real mode and downclocked to 66mhz for compatibility mode.<br />
*PAIC3000D Sound Chip - possibly a TI codecs: AIC3 ????<br />
*Mitsumi (MM3317A) or TI 72071B0 - Power supply and charger circuit ????<br />
*SD/SDHC Card slot<br />
*[[WiFi_module]] with integrated 128KB SPI Flash for [[NVRAM]], WiFi settings<br />
<br />
== Hardware Revisions ==<br />
* DSi<br />
** board C/TWL-CPU-01 (Original rev, all pictures below)<br />
** CPU: TWL. The latest date code picture I could find online was "0836 1m" as shown below, however other pictures with CPU covered show the NAND codes as late as 916, so...<br />
** Suspect this is the only board where WiFi chip is available in Hybrid games like CookingCoach<br />
** Wireless card DWM-W015<br />
<br />
* DSi RevA<br />
** board C/TWL-CPU-10 (Newer model, can someone provide a date or serial # range?)<br />
** CPU: TWL A. Mine is "0940 2m". My US Serial # is ~ TW71848???[5]. If yours is earlier, please update this.<br />
[[Image:TWL-CPU-10.png]]<br />
<br />
<br />
* DSi XL<br />
** board C/UTL-CPU-01<br />
** CPU is TWL A<br />
** Wireless card DWM-W024<br />
<br />
== Images ==<br />
<br />
=== Front ===<br />
<br />
[[Image:Twl_front.jpg]]<br />
[[Image:Twl_front_traces.jpg|600px]]<br />
<br />
The socket to the left of the ARM processor is the wifi chip socket.<br />
<br />
TWL CPU pinout map: [[File:Twl_cpu_pinout.pdf]] (WIP)<br />
<br />
=== Back ===<br />
<br />
[[Image:Twl_back.jpg]]<br />
<br />
=== NAND pinout ===<br />
[[Image:Dsi_nand.jpg|600px]]<br />
[[Image:Dsi_nanddat.png|600px]]<br />
<br />
=== PCB overlay ===<br />
[[Image:Nintendo DSi PCB Layered.jpg|600px]]<br />
=== CPU with new ram ===<br />
<br />
[[Image:CPUv2.jpg]]<br />
<br />
=== Glamor Shot ===<br />
<br />
[[Image:Nintendo-dsi-Glamor-Shot.jpg]]<br />
<br />
== References ==<br />
<br />
# http://en.wikipedia.org/wiki/Nintendo_DSi<br />
# http://insidetronics.blogspot.com/2008/11/new-nintendo-dsi-teardown.html<br />
# http://techon.nikkeibp.co.jp/english/NEWS_EN/20081111/161077/<br />
# http://games.gearlive.com/playfeed/article/q408-nintendo-dsi-announced-larger-screens-dual-cameras-dsi-shop-store/<br />
# http://www.ifixit.com/Guide/First-Look/Nintendo-DSi/714/1</div>Khmannhttps://dsibrew.org/w/index.php?title=NVRAM&diff=4240NVRAM2012-08-24T16:28:26Z<p>Khmann: data looks fairly "standard" to me...</p>
<hr />
<div>The DSi contains a 128KB block (organized into 256-byte pages) of memory referred to as "NVRAM"; it is stored in a SPI flash chip onboard the WiFi dongle. On the DS, this was the system's firmware, plus it included writeable areas for user preferences and wifi connection settings. On the DSi, this chip is maintained for backward compatibility, but it is mostly empty.<br />
<br />
(khmann: data actually seems to follow the format of http://www.daftcode.net/gbatek/ds#dsfirmwareheader quite closely to my eyes)<br />
<br />
There is some new unknown data near the beginning of NVRAM which is involved in the boot process. The NVRAM is read very early in boot, before the [[NAND]] flash is initialized. An unreadable NVRAM chip will hang the boot process in an infinite retry loop, and errors in this portion of NVRAM will cause a stage1 [[Bootloader]] error.<br />
<br />
Most of the address space is blank, with the exception of the following data:<br />
<br />
Pages 0-2: Old partial NDS firmware header (for compatibility)<br />
00000: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
00010: 0000 0000 0000 0000 0000 0000 0057 ffff .............W..<br />
00020: c03f 0000 0000 0000 ffff e861 3801 000f .?.........a8...<br />
00030: ffff ffff ff00 0022 4cd8 968a fe3f ffff ......."L....?..<br />
00040: 0394 2902 0200 1700 2600 1818 4800 4048 ..).....&...H.@H<br />
00050: 5800 4200 4601 6480 e6e6 4324 0e00 0100 X.B.F.d...C$....<br />
00060: 0100 0204 0316 4000 1b6c 4880 3800 3507 ......@..lH.8.5.<br />
00070: 0000 0000 0000 0000 b000 0000 0000 00c7 ................<br />
00080: bb01 247f 5a01 3f01 3f36 1d00 7835 5512 ..$.Z.?.?6..x5U.<br />
00090: 341c 0001 0e38 0370 c52a 0a08 0401 0000 4....8.p.*......<br />
000a0: 00ff fffe fefe fefc fcfa fafa fafa f8f8 ................<br />
000b0: f600 1214 1241 2303 0470 350e 2c2c 0000 .....A#..p5.,,..<br />
000c0: 0000 0000 0000 000e 0000 1228 1c00 314c ...........(..1L<br />
000d0: 4f21 0010 b008 fa15 26e7 fe3e 0e51 0500 O!......&..>.Q..<br />
000e0: 6d12 0300 01ff 0e00 0200 0000 0205 0500 m...............<br />
000f0: 0000 1800 0200 0002 1e12 1212 1414 1414 ................<br />
<br />
00100: 1414 1414 1616 1626 2223 2324 2424 2526 .......&"##$$$%&<br />
00110: 2626 2728 2818 014b 4b4b 4b4c 4c4c 4c4c &&'((..KKKKLLLLL<br />
00120: 4c4c 4d4d 4d02 6c71 765b 4045 4a2f 3439 LLMMM.lqv[@EJ/49<br />
00130: 3e03 0814 ffff ffff ffff ffff ffff ffff >...............<br />
00140: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00150: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00160: ffff 1cff ffff ffff ffff ffff ffff ffff ................<br />
00170: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00180: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00190: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001a0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001b0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001c0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001d0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001e0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001f0: ffff ffff ffff ffff ffff ffff ff01 20ff .............. .<br />
<br />
00200: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
002e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
002f0: 0000 0000 0000 0000 0000 0000 0000 0080 ................<br />
<br />
There are 10 pages starting at 0x1f400 (page 0xFA) that describe the WiFi settings (2 pages per slot?)<br />
<br />
1f400: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
1f440: 3c65 7373 6964 3e0a 0000 0000 0000 0000 <essid>.......<br />
1f450: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
1f4d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1f4e0: 0000 0000 0000 0000 0900 7805 0000 0001 ..........x.....<br />
1f4f0: 0000 0000 0000 0000 0000 0000 0000 f80f ................<br />
1f500: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
1f5f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
<br />
The last 2 pages store 2 identical copies of user settings.<br />
1fe00: 0500 0b01 0100 6200 7500 7300 6800 6900 ......b.u.s.h.i.<br />
1fe10: 6e00 6700 0000 0000 0000 0700 0000 0000 n.g.............<br />
1fe20: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe30: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe40: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe50: 0000 0000 0000 0000 8102 1603 2020 a30d ............ ..<br />
1fe60: 970c e0a0 00fc 0900 4010 db10 0000 0000 ........@.......<br />
1fe70: 0900 84dd 0100 0300 0000 0000 0000 0000 ................<br />
1fe80: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe90: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fea0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1feb0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fec0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fed0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fee0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fef0: 0000 0000 0000 0000 0000 0000 0000 1fcf ................<br />
<br />
1ff00: 0500 0b01 0100 6200 7500 7300 6800 6900 ......b.u.s.h.i.<br />
1ff10: 6e00 6700 0000 0000 0000 0700 0000 0000 n.g.............<br />
1ff20: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff30: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff40: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff50: 0000 0000 0000 0000 8102 1603 2020 a30d ............ ..<br />
1ff60: 970c e0a0 00fc 0000 0000 0000 0000 0000 ................<br />
1ff70: 0a00 922b 0100 0300 0000 0000 0000 0000 ...+............<br />
1ff80: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff90: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffa0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffb0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffc0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffd0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffe0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fff0: 0000 0000 0000 0000 0000 0000 0000 1fcf ................</div>Khmannhttps://dsibrew.org/w/index.php?title=Hardware&diff=4239Hardware2012-08-24T14:24:01Z<p>Khmann: link wifi module</p>
<hr />
<div>{{stub}}<br />
<br />
== Specifications ==<br />
<br />
*[[Cameras|Includes (2) 0.3 Megapixel VGA Cameras]]<br />
*240MB(+16MB probably reserved for wear leveling purposes (e.g. replacing bad blocks)) Internal Flash Memory - Samsung kmapf0000m-S998 MOVI [[NAND]] - MMC Interface<br />
*16MB RAM - NEC uPD 46128512AF1 - DDR SRAM or a Fujitsu 128-Mbit FCRAM 82DBS08164D-70L (datasheet: http://edevice.fujitsu.com/fj/DATASHEET/e-ds/e511454.pdf mirror:[[Media:E511454.pdf]]<br />
*(2) 256 x 192 3.25 Inch Displays, one of which has a resistive touch screen<br />
*Backwards compatible with Nintendo DS games but not GBA games due to the lack of a gameboy cartridge port.<br />
*Integrated ARM7/ARM9 cores clocked at 133mhz in real mode and downclocked to 66mhz for compatibility mode.<br />
*PAIC3000D Sound Chip - possibly a TI codecs: AIC3 ????<br />
*Mitsumi (MM3317A) or TI 72071B0 - Power supply and charger circuit ????<br />
*SD/SDHC Card slot<br />
*[[WiFi module]] with integrated 128KB SPI Flash for NVRAM, WiFi settings<br />
<br />
== Hardware Revisions ==<br />
* DSi<br />
** board C/TWL-CPU-01 (Original rev, all pictures below)<br />
** CPU: TWL. The latest date code picture I could find online was "0836 1m" as shown below, however other pictures with CPU covered show the NAND codes as late as 916, so...<br />
** Suspect this is the only board where WiFi chip is available in Hybrid games like CookingCoach<br />
** Wireless card DWM-W015<br />
<br />
* DSi RevA<br />
** board C/TWL-CPU-10 (Newer model, can someone provide a date or serial # range?)<br />
** CPU: TWL A. Mine is "0940 2m". My US Serial # is ~ TW71848???[5]. If yours is earlier, please update this.<br />
[[Image:TWL-CPU-10.png]]<br />
<br />
<br />
* DSi XL<br />
** board C/UTL-CPU-01<br />
** CPU is TWL A<br />
** Wireless card DWM-W024<br />
<br />
== Images ==<br />
<br />
=== Front ===<br />
<br />
[[Image:Twl_front.jpg]]<br />
[[Image:Twl_front_traces.jpg|600px]]<br />
<br />
The socket to the left of the ARM processor is the wifi chip socket.<br />
<br />
TWL CPU pinout map: [[File:Twl_cpu_pinout.pdf]] (WIP)<br />
<br />
=== Back ===<br />
<br />
[[Image:Twl_back.jpg]]<br />
<br />
=== NAND pinout ===<br />
[[Image:Dsi_nand.jpg|600px]]<br />
[[Image:Dsi_nanddat.png|600px]]<br />
<br />
=== PCB overlay ===<br />
[[Image:Nintendo DSi PCB Layered.jpg|600px]]<br />
=== CPU with new ram ===<br />
<br />
[[Image:CPUv2.jpg]]<br />
<br />
=== Glamor Shot ===<br />
<br />
[[Image:Nintendo-dsi-Glamor-Shot.jpg]]<br />
<br />
== References ==<br />
<br />
# http://en.wikipedia.org/wiki/Nintendo_DSi<br />
# http://insidetronics.blogspot.com/2008/11/new-nintendo-dsi-teardown.html<br />
# http://techon.nikkeibp.co.jp/english/NEWS_EN/20081111/161077/<br />
# http://games.gearlive.com/playfeed/article/q408-nintendo-dsi-announced-larger-screens-dual-cameras-dsi-shop-store/<br />
# http://www.ifixit.com/Guide/First-Look/Nintendo-DSi/714/1</div>Khmannhttps://dsibrew.org/w/index.php?title=WiFi_Module&diff=4238WiFi Module2012-08-24T14:22:22Z<p>Khmann: format</p>
<hr />
<div>DSi DWM-W015<br />
<br />
The DSi WiFi module actually contains two wireless chips, a Mitsumi MM3218 for DS compatibility and a more modern Atheros AR6002G, which share the antenna through an RF switch. The DS WiFi is configured through profiles 1-3 and is limited to 802.11b 1-2Mbps and WEP encryption while the Atheros supports 802.11g rates and WPA encryption, configured through profiles 4-6.<br />
<br />
The Mitsumi WiFi is controlled through data in the NVRAM (eg: Region code) http://www.daftcode.net/gbatek/ds#dsfirmwarewificalibrationdata while the Atheros appears to have it's configuration stored elsewhere.<br />
<br />
If this module is disconnected the DSi turns on to a black screen, presumably because it can't read the NVRAM. If the DSi doesn't like the data contained on the module it will give either error 0000FEFE or 0000FE00 at poweron.<br />
<br />
picture of a rev0 WiFi module<br />
http://www.flickr.com/photos/micahdowty/3846960965/sizes/o/in/photostream/<br />
<br />
There are at least two hardware versions of the module, the original using a 1Mbit SPI flash ST M45PE10 [[Media:STM45PE10.pdf]] and a newer version which I had using a very tiny chip labeled "5A32" and I think "8936" but it might be "B936". Note the circle in this image shows a 10k resistor from pin 5 WP to GND, which the ST M45PE10 datasheet indicates will write-protect the first 64K. If you would like to disable this protection, remove the resistor and solder pin 5 to pin 6 VCC.<br />
<br />
[[Image:DWM-W015a.jpg]]<br />
<br />
khmann had success backing up the 5A32 using the above pictured connection to a DS cartridge, removing the 5A32 and installing a ST M45PE20 2Mbit SPI flash salvaged from said NDS game with said data. not sure what this "gets you" yet... but theorized that this change might have something to do with newer DSi units unable to use the CookingCoach dslink exploit</div>Khmannhttps://dsibrew.org/w/index.php?title=WiFi_Module&diff=4237WiFi Module2012-08-24T14:21:48Z<p>Khmann: There's a lot going on with this little module</p>
<hr />
<div>DSi DWM-W015<br />
<br />
The DSi WiFi module actually contains two wireless chips, a Mitsumi MM3218 for DS compatibility and a more modern Atheros AR6002G, which share the antenna through an RF switch. The DS WiFi is configured through profiles 1-3 and is limited to 802.11b 1-2Mbps and WEP encryption while the Atheros supports 802.11g rates and WPA encryption, configured through profiles 4-6.<br />
<br />
The Mitsumi WiFi is controlled through data in the NVRAM (eg: Region code) http://www.daftcode.net/gbatek/ds#dsfirmwarewificalibrationdata while the Atheros appears to have it's configuration stored elsewhere.<br />
<br />
If this module is disconnected the DSi turns on to a black screen, presumably because it can't read the NVRAM. If the DSi doesn't like the data contained on the module it will give either error 0000FEFE or 0000FE00 at poweron.<br />
<br />
picture of a rev0 WiFi module<br />
http://www.flickr.com/photos/micahdowty/3846960965/sizes/o/in/photostream/<br />
<br />
There are at least two hardware versions of the module, the original using a 1Mbit SPI flash ST M45PE10 [[Media:STM45PE10.pdf]] and a newer version which I had using a very tiny chip labeled "5A32" and I think "8936" but it might be "B936". Note the circle in this image shows a 10k resistor from pin 5 WP to GND, which the ST M45PE10 datasheet indicates will write-protect the first 64K. If you would like to disable this protection, remove the resistor and solder pin 5 to pin 6 VCC.<br />
[[Image:DWM-W015a.jpg]]<br />
<br />
khmann had success backing up the 5A32 using the above pictured connection to a DS cartridge, removing the 5A32 and installing a ST M45PE20 2Mbit SPI flash salvaged from said NDS game with said data. not sure what this "gets you" yet... but theorized that this change might have something to do with newer DSi units unable to use the CookingCoach dslink exploit</div>Khmannhttps://dsibrew.org/w/index.php?title=File:DWM-W015a.jpg&diff=4236File:DWM-W015a.jpg2012-08-24T14:09:36Z<p>Khmann: A closeup of the replacement NVRAM chip on a rev.A DWM-W015.</p>
<hr />
<div>A closeup of the replacement NVRAM chip on a rev.A DWM-W015.</div>Khmannhttps://dsibrew.org/w/index.php?title=WiFi_Module&diff=4235WiFi Module2012-08-22T04:10:09Z<p>Khmann: The WiFi module might deserve it's own documentation</p>
<hr />
<div>I'm going to clean this up, promise.<br />
<br />
If this module is disconnected, the DSi turns on to a black screen.<br />
<br />
picture of a rev0 WiFi module<br />
http://www.flickr.com/photos/micahdowty/3846960965/sizes/o/in/photostream/<br />
<br />
picture of a module from a later revA DSi<br />
<br />
note the flash chip is different and very tiny<br />
<br />
pdf: datasheet for rev0 SPI flash<br />
<br />
On my board, pin 5 is connected to ground through a 10k resistor. This would seem to write-protect the first 64k</div>Khmannhttps://dsibrew.org/w/index.php?title=File:STM45PE10.pdf&diff=4234File:STM45PE10.pdf2012-08-22T04:01:40Z<p>Khmann: SPI Flash chip on WiFi board
"The M45PE10 is a 1Mbit (128K x 8 bit) Serial Paged Flash Memory accessed by a high speed SPI-compatible bus."</p>
<hr />
<div>SPI Flash chip on WiFi board<br />
<br />
"The M45PE10 is a 1Mbit (128K x 8 bit) Serial Paged Flash Memory accessed by a high speed SPI-compatible bus."</div>Khmannhttps://dsibrew.org/w/index.php?title=Hardware&diff=4233Hardware2012-08-16T14:56:48Z<p>Khmann: /* Specifications */ local mirror Fujitsu RAM PDF from archive.org, hope that's ok...</p>
<hr />
<div>{{stub}}<br />
<br />
== Specifications ==<br />
<br />
*[[Cameras|Includes (2) 0.3 Megapixel VGA Cameras]]<br />
*240MB(+16MB probably reserved for wear leveling purposes (e.g. replacing bad blocks)) Internal Flash Memory - Samsung kmapf0000m-S998 MOVI [[NAND]] - MMC Interface<br />
*16MB RAM - NEC uPD 46128512AF1 - DDR SRAM or a Fujitsu 128-Mbit FCRAM 82DBS08164D-70L (datasheet: http://edevice.fujitsu.com/fj/DATASHEET/e-ds/e511454.pdf mirror:[[Media:E511454.pdf]]<br />
*(2) 256 x 192 3.25 Inch Displays, one of which has a resistive touch screen<br />
*Backwards compatible with Nintendo DS games but not GBA games due to the lack of a gameboy cartridge port.<br />
*Integrated ARM7/ARM9 cores clocked at 133mhz in real mode and downclocked to 66mhz for compatibility mode.<br />
*PAIC3000D Sound Chip - possibly a TI codecs: AIC3 ????<br />
*Mitsumi (MM3317A) or TI 72071B0 - Power supply and charger circuit ????<br />
*SD/SDHC Card slot<br />
*WiFi dongle with integrated 128KB SPI Flash for NVRAM, WiFi settings<br />
<br />
== Hardware Revisions ==<br />
* DSi<br />
** board C/TWL-CPU-01 (Original rev, all pictures below)<br />
** CPU: TWL. The latest date code picture I could find online was "0836 1m" as shown below, however other pictures with CPU covered show the NAND codes as late as 916, so...<br />
** Suspect this is the only board where WiFi chip is available in Hybrid games like CookingCoach<br />
** Wireless card DWM-W015<br />
<br />
* DSi RevA<br />
** board C/TWL-CPU-10 (Newer model, can someone provide a date or serial # range?)<br />
** CPU: TWL A. Mine is "0940 2m". My US Serial # is ~ TW71848???[5]. If yours is earlier, please update this.<br />
[[Image:TWL-CPU-10.png]]<br />
<br />
<br />
* DSi XL<br />
** board C/UTL-CPU-01<br />
** CPU is TWL A<br />
** Wireless card DWM-W024<br />
<br />
== Images ==<br />
<br />
=== Front ===<br />
<br />
[[Image:Twl_front.jpg]]<br />
[[Image:Twl_front_traces.jpg|600px]]<br />
<br />
The socket to the left of the ARM processor is the wifi chip socket.<br />
<br />
TWL CPU pinout map: [[File:Twl_cpu_pinout.pdf]] (WIP)<br />
<br />
=== Back ===<br />
<br />
[[Image:Twl_back.jpg]]<br />
<br />
=== NAND pinout ===<br />
[[Image:Dsi_nand.jpg|600px]]<br />
[[Image:Dsi_nanddat.png|600px]]<br />
<br />
=== PCB overlay ===<br />
[[Image:Nintendo DSi PCB Layered.jpg|600px]]<br />
=== CPU with new ram ===<br />
<br />
[[Image:CPUv2.jpg]]<br />
<br />
=== Glamor Shot ===<br />
<br />
[[Image:Nintendo-dsi-Glamor-Shot.jpg]]<br />
<br />
== References ==<br />
<br />
# http://en.wikipedia.org/wiki/Nintendo_DSi<br />
# http://insidetronics.blogspot.com/2008/11/new-nintendo-dsi-teardown.html<br />
# http://techon.nikkeibp.co.jp/english/NEWS_EN/20081111/161077/<br />
# http://games.gearlive.com/playfeed/article/q408-nintendo-dsi-announced-larger-screens-dual-cameras-dsi-shop-store/<br />
# http://www.ifixit.com/Guide/First-Look/Nintendo-DSi/714/1</div>Khmannhttps://dsibrew.org/w/index.php?title=File:E511454.pdf&diff=4232File:E511454.pdf2012-08-16T14:52:51Z<p>Khmann: FUJITSU MICROELECTRONICS DATA SHEET
DS05-11454-1E
128 M Bit (8 M word×16 bit) Mobile Phone Application Specific Memory
MB82DBS08164D-70L</p>
<hr />
<div>FUJITSU MICROELECTRONICS DATA SHEET<br />
DS05-11454-1E<br />
128 M Bit (8 M word×16 bit) Mobile Phone Application Specific Memory<br />
MB82DBS08164D-70L</div>Khmannhttps://dsibrew.org/w/index.php?title=Stage2&diff=4231Stage22012-08-16T14:46:07Z<p>Khmann: link nand</p>
<hr />
<div>== Stage 1 ==<br />
<br />
[[Image:boot-stage1-error.jpeg|frame|When the Stage 1 bootloader (in ROM) fails, it displays a 32-bit hexadecimal number on the top screen.]]<br />
<br />
The first stage of the DSi's bootloader lives in ROM, presumably on the CPU die. It loads further encrypted (and probably signed) stages from NAND flash, starting with a (partially unencrypted) offset table in the sector at 0x200.<br />
<br />
Not much is known about this bootloader yet, but it presumably knows how to:<br />
# Initialize the encryption hardware<br />
# Read the contents of [[NVRAM]]<br />
# Initialize both LCDs<br />
# Read blocks (but not files) from the [[NAND]] flash<br />
# Perform some variety of integrity check on all data it reads (signature, CRC, ?)<br />
# Display basic hexadecimal error codes<br />
# Possibly factory-programming the [[NAND]] flash?<br />
# Might also do basic power-on self test of peripherals <br />
<br />
Known error codes:<br />
<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Error Code !! Description<br />
|-<br />
| 0000FE00 || Error communicating with NAND chip. (It's missing, CLK is shorted, etc.)<br />
|-<br />
| 0000FEFC || Integrity error in first block of Stage 2 (address at 0x220)<br />
|-<br />
| 0000FEFD || Integrity error in second block of Stage 2 (address at 0x230)<br />
|-<br />
| 0000FEFE || Boot sector integrity error (Sector 0x200 not valid), or error in [[NVRAM]] contents.<br />
|}<br />
<br />
== Stage 2 ==<br />
<br />
[[Image:boot-stage2-error.jpeg|frame|This may have been a Stage 2 bootloader error.]]<br />
<br />
Unlike the stage1 bootloader, which must be small enough to fit in ROM (probably several kilobytes), the stage2 bootloader has about a megabyte of NAND flash reserved for it. The stage2 bootloader understands partitions and filesystems, and it is capable of loading the DSi menu. It also must understand the encryption used on filesystem blocks in the NAND, and it must understand how to load and validate title metadata.<br />
<br />
The Stage 2 loader was not modified by the [[System Menu 1.4]] update. This is still earlier in the boot process than the "Health and Safety" warning.<br />
<br />
The first stage bootloader reads sector 0x200 in order to find a table of offsets to the Stage 2 bootloader:<br />
<br />
00000220 00 08 00 00 10 64 02 00 00 80 7b 03 00 66 02 00 |.....d....{..f..|<br />
00000230 00 6e 02 00 88 75 02 00 00 80 7b 03 00 76 02 00 |.n...u....{..v..|<br />
00000240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|<br />
<br />
This appears to be describing two chunks of the stage2 loader, one 0x26410 bytes in length at address 0x800, and one 0x27588 bytes at address 0x26e00.<br />
<br />
Note that this sector (and two similar ones at 0x400 and 0x600) appear to be the only unencrypted blocks on the NAND flash.<br />
<br />
It is unclear why there are two pieces which are nearly but not quite the same size. Passive traces of the boot sequence confirm that the 0x26e00 chunk is slightly larger, and it's loaded first. The 0x800 chunk is read immediately after the 0x26e00 chunk.<br />
<br />
Whereas the filesystem data in NAND is encrypted using a unique key for every DSi, the stage2 bootloader is identical on every DSi tested so far. This probably means that it is encrypted using a fixed key included in stage1.<br />
<br />
After Stage 2 is loaded:<br />
# The NAND flash is partially re-initialized<br />
# Sector 0 is read from the NAND. This appears to be an (encrypted) DOS-style MBR.<br />
# The MBR signature and the type of the first partition are verified.<br />
# Filesystem metadata is read from sectors starting around 0x100000. The metadata appears to be in FAT32 format with long filenames.<br />
# Multiple files are loaded from the filesystem. The exact read addresses will vary depending on your DSi's firmware version and the state of its filesystem when you performed the last firmware update. On a brand new DSi, it appears that the DSi Menu itself is loaded from 0xb20000 after two small metadata files are read from 0xb1c000 and 0x7a0000.<br />
<br />
All errors show before the health and safety screen. It appears that stage2 errors from a cold power-on always cause the DSi to hang at a black screen, whereas stage2 errors after reset (pressing but not holding the power button) will give an error message screen. Known errors:<br />
<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Text !! Description<br />
|-<br />
| "Error: 1-2435-8325" || Invalid signature or partition type in MBR, invalid starting LBA.<br />
|-<br />
| "Error: 3-2435-8325" || DSi Menu integrity checks failed<br />
|-<br />
|}</div>Khmannhttps://dsibrew.org/w/index.php?title=Flash_Filesystem&diff=4230Flash Filesystem2012-08-16T14:45:24Z<p>Khmann: </p>
<hr />
<div>{{stub}}<br />
<br />
All files on the 256MB [[NAND]] Flash chip.<br />
<br />
* [[nand/import]]<br />
* [[nand/progress]]<br />
* [[nand/shared1]]<br />
* [[nand/shared2]]<br />
* [[nand/sys]]<br />
* [[nand/ticket]]<br />
* [[nand/title]]<br />
* [[nand/tmp]]<br />
<br />
== Some files ==<br />
<br />
* [[Icon.bin]] : icon of a title</div>Khmannhttps://dsibrew.org/w/index.php?title=NVRAM&diff=4229NVRAM2012-08-16T14:44:48Z<p>Khmann: </p>
<hr />
<div>The DSi contains a 128KB block (organized into 256-byte pages) of memory referred to as "NVRAM"; it is stored in a SPI flash chip onboard the WiFi dongle. On the DS, this was the system's firmware, plus it included writeable areas for user preferences and wifi connection settings. On the DSi, this chip is maintained for backward compatibility, but it is mostly empty.<br />
There is some new unknown data near the beginning of NVRAM which is involved in the boot process. The NVRAM is read very early in boot, before the [[NAND]] flash is initialized. An unreadable NVRAM chip will hang the boot process in an infinite retry loop, and errors in this portion of NVRAM will cause a stage1 [[Bootloader]] error.<br />
<br />
Most of the address space is blank, with the exception of the following data:<br />
<br />
Pages 0-2: Old partial NDS firmware header (for compatibility)<br />
00000: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
00010: 0000 0000 0000 0000 0000 0000 0057 ffff .............W..<br />
00020: c03f 0000 0000 0000 ffff e861 3801 000f .?.........a8...<br />
00030: ffff ffff ff00 0022 4cd8 968a fe3f ffff ......."L....?..<br />
00040: 0394 2902 0200 1700 2600 1818 4800 4048 ..).....&...H.@H<br />
00050: 5800 4200 4601 6480 e6e6 4324 0e00 0100 X.B.F.d...C$....<br />
00060: 0100 0204 0316 4000 1b6c 4880 3800 3507 ......@..lH.8.5.<br />
00070: 0000 0000 0000 0000 b000 0000 0000 00c7 ................<br />
00080: bb01 247f 5a01 3f01 3f36 1d00 7835 5512 ..$.Z.?.?6..x5U.<br />
00090: 341c 0001 0e38 0370 c52a 0a08 0401 0000 4....8.p.*......<br />
000a0: 00ff fffe fefe fefc fcfa fafa fafa f8f8 ................<br />
000b0: f600 1214 1241 2303 0470 350e 2c2c 0000 .....A#..p5.,,..<br />
000c0: 0000 0000 0000 000e 0000 1228 1c00 314c ...........(..1L<br />
000d0: 4f21 0010 b008 fa15 26e7 fe3e 0e51 0500 O!......&..>.Q..<br />
000e0: 6d12 0300 01ff 0e00 0200 0000 0205 0500 m...............<br />
000f0: 0000 1800 0200 0002 1e12 1212 1414 1414 ................<br />
<br />
00100: 1414 1414 1616 1626 2223 2324 2424 2526 .......&"##$$$%&<br />
00110: 2626 2728 2818 014b 4b4b 4b4c 4c4c 4c4c &&'((..KKKKLLLLL<br />
00120: 4c4c 4d4d 4d02 6c71 765b 4045 4a2f 3439 LLMMM.lqv[@EJ/49<br />
00130: 3e03 0814 ffff ffff ffff ffff ffff ffff >...............<br />
00140: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00150: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00160: ffff 1cff ffff ffff ffff ffff ffff ffff ................<br />
00170: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00180: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00190: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001a0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001b0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001c0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001d0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001e0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001f0: ffff ffff ffff ffff ffff ffff ff01 20ff .............. .<br />
<br />
00200: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
002e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
002f0: 0000 0000 0000 0000 0000 0000 0000 0080 ................<br />
<br />
There are 10 pages starting at 0x1f400 (page 0xFA) that describe the WiFi settings (2 pages per slot?)<br />
<br />
1f400: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
1f440: 3c65 7373 6964 3e0a 0000 0000 0000 0000 <essid>.......<br />
1f450: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
1f4d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1f4e0: 0000 0000 0000 0000 0900 7805 0000 0001 ..........x.....<br />
1f4f0: 0000 0000 0000 0000 0000 0000 0000 f80f ................<br />
1f500: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
1f5f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
<br />
The last 2 pages store 2 identical copies of user settings.<br />
1fe00: 0500 0b01 0100 6200 7500 7300 6800 6900 ......b.u.s.h.i.<br />
1fe10: 6e00 6700 0000 0000 0000 0700 0000 0000 n.g.............<br />
1fe20: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe30: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe40: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe50: 0000 0000 0000 0000 8102 1603 2020 a30d ............ ..<br />
1fe60: 970c e0a0 00fc 0900 4010 db10 0000 0000 ........@.......<br />
1fe70: 0900 84dd 0100 0300 0000 0000 0000 0000 ................<br />
1fe80: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe90: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fea0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1feb0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fec0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fed0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fee0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fef0: 0000 0000 0000 0000 0000 0000 0000 1fcf ................<br />
<br />
1ff00: 0500 0b01 0100 6200 7500 7300 6800 6900 ......b.u.s.h.i.<br />
1ff10: 6e00 6700 0000 0000 0000 0700 0000 0000 n.g.............<br />
1ff20: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff30: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff40: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff50: 0000 0000 0000 0000 8102 1603 2020 a30d ............ ..<br />
1ff60: 970c e0a0 00fc 0000 0000 0000 0000 0000 ................<br />
1ff70: 0a00 922b 0100 0300 0000 0000 0000 0000 ...+............<br />
1ff80: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff90: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffa0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffb0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffc0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffd0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffe0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fff0: 0000 0000 0000 0000 0000 0000 0000 1fcf ................</div>Khmannhttps://dsibrew.org/w/index.php?title=NVRAM&diff=4228NVRAM2012-08-16T14:41:17Z<p>Khmann: link nvram</p>
<hr />
<div>The DSi contains a 128KB block (organized into 256-byte pages) of memory referred to as "NVRAM"; it is stored in a SPI flash chip onboard the WiFi dongle. On the DS, this was the system's firmware, plus it included writeable areas for user preferences and wifi connection settings. On the DSi, this chip is maintained for backward compatibility, but it is mostly empty.<br />
There is some new unknown data near the beginning of NVRAM which is involved in the boot process. The NVRAM is read very early in boot, before the NAND flash is initialized. An unreadable NVRAM chip will hang the boot process in an infinite retry loop, and errors in this portion of NVRAM will cause a stage1 [[Bootloader]] error.<br />
<br />
Most of the address space is blank, with the exception of the following data:<br />
<br />
Pages 0-2: Old partial NDS firmware header (for compatibility)<br />
00000: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
00010: 0000 0000 0000 0000 0000 0000 0057 ffff .............W..<br />
00020: c03f 0000 0000 0000 ffff e861 3801 000f .?.........a8...<br />
00030: ffff ffff ff00 0022 4cd8 968a fe3f ffff ......."L....?..<br />
00040: 0394 2902 0200 1700 2600 1818 4800 4048 ..).....&...H.@H<br />
00050: 5800 4200 4601 6480 e6e6 4324 0e00 0100 X.B.F.d...C$....<br />
00060: 0100 0204 0316 4000 1b6c 4880 3800 3507 ......@..lH.8.5.<br />
00070: 0000 0000 0000 0000 b000 0000 0000 00c7 ................<br />
00080: bb01 247f 5a01 3f01 3f36 1d00 7835 5512 ..$.Z.?.?6..x5U.<br />
00090: 341c 0001 0e38 0370 c52a 0a08 0401 0000 4....8.p.*......<br />
000a0: 00ff fffe fefe fefc fcfa fafa fafa f8f8 ................<br />
000b0: f600 1214 1241 2303 0470 350e 2c2c 0000 .....A#..p5.,,..<br />
000c0: 0000 0000 0000 000e 0000 1228 1c00 314c ...........(..1L<br />
000d0: 4f21 0010 b008 fa15 26e7 fe3e 0e51 0500 O!......&..>.Q..<br />
000e0: 6d12 0300 01ff 0e00 0200 0000 0205 0500 m...............<br />
000f0: 0000 1800 0200 0002 1e12 1212 1414 1414 ................<br />
<br />
00100: 1414 1414 1616 1626 2223 2324 2424 2526 .......&"##$$$%&<br />
00110: 2626 2728 2818 014b 4b4b 4b4c 4c4c 4c4c &&'((..KKKKLLLLL<br />
00120: 4c4c 4d4d 4d02 6c71 765b 4045 4a2f 3439 LLMMM.lqv[@EJ/49<br />
00130: 3e03 0814 ffff ffff ffff ffff ffff ffff >...............<br />
00140: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00150: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00160: ffff 1cff ffff ffff ffff ffff ffff ffff ................<br />
00170: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00180: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00190: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001a0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001b0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001c0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001d0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001e0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001f0: ffff ffff ffff ffff ffff ffff ff01 20ff .............. .<br />
<br />
00200: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
002e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
002f0: 0000 0000 0000 0000 0000 0000 0000 0080 ................<br />
<br />
There are 10 pages starting at 0x1f400 (page 0xFA) that describe the WiFi settings (2 pages per slot?)<br />
<br />
1f400: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
1f440: 3c65 7373 6964 3e0a 0000 0000 0000 0000 <essid>.......<br />
1f450: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
1f4d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1f4e0: 0000 0000 0000 0000 0900 7805 0000 0001 ..........x.....<br />
1f4f0: 0000 0000 0000 0000 0000 0000 0000 f80f ................<br />
1f500: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
1f5f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
<br />
The last 2 pages store 2 identical copies of user settings.<br />
1fe00: 0500 0b01 0100 6200 7500 7300 6800 6900 ......b.u.s.h.i.<br />
1fe10: 6e00 6700 0000 0000 0000 0700 0000 0000 n.g.............<br />
1fe20: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe30: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe40: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe50: 0000 0000 0000 0000 8102 1603 2020 a30d ............ ..<br />
1fe60: 970c e0a0 00fc 0900 4010 db10 0000 0000 ........@.......<br />
1fe70: 0900 84dd 0100 0300 0000 0000 0000 0000 ................<br />
1fe80: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe90: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fea0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1feb0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fec0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fed0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fee0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fef0: 0000 0000 0000 0000 0000 0000 0000 1fcf ................<br />
<br />
1ff00: 0500 0b01 0100 6200 7500 7300 6800 6900 ......b.u.s.h.i.<br />
1ff10: 6e00 6700 0000 0000 0000 0700 0000 0000 n.g.............<br />
1ff20: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff30: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff40: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff50: 0000 0000 0000 0000 8102 1603 2020 a30d ............ ..<br />
1ff60: 970c e0a0 00fc 0000 0000 0000 0000 0000 ................<br />
1ff70: 0a00 922b 0100 0300 0000 0000 0000 0000 ...+............<br />
1ff80: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff90: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffa0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffb0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffc0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffd0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffe0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fff0: 0000 0000 0000 0000 0000 0000 0000 1fcf ................</div>Khmannhttps://dsibrew.org/w/index.php?title=Stage2&diff=4227Stage22012-08-16T14:40:26Z<p>Khmann: link nvram</p>
<hr />
<div>== Stage 1 ==<br />
<br />
[[Image:boot-stage1-error.jpeg|frame|When the Stage 1 bootloader (in ROM) fails, it displays a 32-bit hexadecimal number on the top screen.]]<br />
<br />
The first stage of the DSi's bootloader lives in ROM, presumably on the CPU die. It loads further encrypted (and probably signed) stages from NAND flash, starting with a (partially unencrypted) offset table in the sector at 0x200.<br />
<br />
Not much is known about this bootloader yet, but it presumably knows how to:<br />
# Initialize the encryption hardware<br />
# Read the contents of [[NVRAM]]<br />
# Initialize both LCDs<br />
# Read blocks (but not files) from the NAND flash<br />
# Perform some variety of integrity check on all data it reads (signature, CRC, ?)<br />
# Display basic hexadecimal error codes<br />
# Possibly factory-programming the NAND flash?<br />
# Might also do basic power-on self test of peripherals <br />
<br />
Known error codes:<br />
<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Error Code !! Description<br />
|-<br />
| 0000FE00 || Error communicating with NAND chip. (It's missing, CLK is shorted, etc.)<br />
|-<br />
| 0000FEFC || Integrity error in first block of Stage 2 (address at 0x220)<br />
|-<br />
| 0000FEFD || Integrity error in second block of Stage 2 (address at 0x230)<br />
|-<br />
| 0000FEFE || Boot sector integrity error (Sector 0x200 not valid), or error in [[NVRAM]] contents.<br />
|}<br />
<br />
== Stage 2 ==<br />
<br />
[[Image:boot-stage2-error.jpeg|frame|This may have been a Stage 2 bootloader error.]]<br />
<br />
Unlike the stage1 bootloader, which must be small enough to fit in ROM (probably several kilobytes), the stage2 bootloader has about a megabyte of NAND flash reserved for it. The stage2 bootloader understands partitions and filesystems, and it is capable of loading the DSi menu. It also must understand the encryption used on filesystem blocks in the NAND, and it must understand how to load and validate title metadata.<br />
<br />
The Stage 2 loader was not modified by the [[System Menu 1.4]] update. This is still earlier in the boot process than the "Health and Safety" warning.<br />
<br />
The first stage bootloader reads sector 0x200 in order to find a table of offsets to the Stage 2 bootloader:<br />
<br />
00000220 00 08 00 00 10 64 02 00 00 80 7b 03 00 66 02 00 |.....d....{..f..|<br />
00000230 00 6e 02 00 88 75 02 00 00 80 7b 03 00 76 02 00 |.n...u....{..v..|<br />
00000240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|<br />
<br />
This appears to be describing two chunks of the stage2 loader, one 0x26410 bytes in length at address 0x800, and one 0x27588 bytes at address 0x26e00.<br />
<br />
Note that this sector (and two similar ones at 0x400 and 0x600) appear to be the only unencrypted blocks on the NAND flash.<br />
<br />
It is unclear why there are two pieces which are nearly but not quite the same size. Passive traces of the boot sequence confirm that the 0x26e00 chunk is slightly larger, and it's loaded first. The 0x800 chunk is read immediately after the 0x26e00 chunk.<br />
<br />
Whereas the filesystem data in NAND is encrypted using a unique key for every DSi, the stage2 bootloader is identical on every DSi tested so far. This probably means that it is encrypted using a fixed key included in stage1.<br />
<br />
After Stage 2 is loaded:<br />
# The NAND flash is partially re-initialized<br />
# Sector 0 is read from the NAND. This appears to be an (encrypted) DOS-style MBR.<br />
# The MBR signature and the type of the first partition are verified.<br />
# Filesystem metadata is read from sectors starting around 0x100000. The metadata appears to be in FAT32 format with long filenames.<br />
# Multiple files are loaded from the filesystem. The exact read addresses will vary depending on your DSi's firmware version and the state of its filesystem when you performed the last firmware update. On a brand new DSi, it appears that the DSi Menu itself is loaded from 0xb20000 after two small metadata files are read from 0xb1c000 and 0x7a0000.<br />
<br />
All errors show before the health and safety screen. It appears that stage2 errors from a cold power-on always cause the DSi to hang at a black screen, whereas stage2 errors after reset (pressing but not holding the power button) will give an error message screen. Known errors:<br />
<br />
{| border="1" cellpadding="3" cellspacing="0"<br />
! Text !! Description<br />
|-<br />
| "Error: 1-2435-8325" || Invalid signature or partition type in MBR, invalid starting LBA.<br />
|-<br />
| "Error: 3-2435-8325" || DSi Menu integrity checks failed<br />
|-<br />
|}</div>Khmannhttps://dsibrew.org/w/index.php?title=Nvram&diff=4226Nvram2012-08-16T14:38:41Z<p>Khmann: merge, case-sensitive</p>
<hr />
<div>#REDIRECT [[NVRAM]]</div>Khmannhttps://dsibrew.org/w/index.php?title=NVRAM&diff=4225NVRAM2012-08-16T14:37:44Z<p>Khmann: merge, case-sensitive</p>
<hr />
<div>The DSi contains a 128KB block (organized into 256-byte pages) of memory referred to as "NVRAM"; it is stored in a SPI flash chip onboard the WiFi dongle. On the DS, this was the system's firmware, plus it included writeable areas for user preferences and wifi connection settings. On the DSi, this chip is maintained for backward compatibility, but it is mostly empty.<br />
There is some new unknown data near the beginning of NVRAM which is involved in the boot process. The NVRAM is read very early in boot, before the NAND flash is initialized. An unreadable NVRAM chip will hang the boot process in an infinite retry loop, and errors in this portion of NVRAM will cause a stage1 Bootloader error.<br />
<br />
Most of the address space is blank, with the exception of the following data:<br />
<br />
Pages 0-2: Old partial NDS firmware header (for compatibility)<br />
00000: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
00010: 0000 0000 0000 0000 0000 0000 0057 ffff .............W..<br />
00020: c03f 0000 0000 0000 ffff e861 3801 000f .?.........a8...<br />
00030: ffff ffff ff00 0022 4cd8 968a fe3f ffff ......."L....?..<br />
00040: 0394 2902 0200 1700 2600 1818 4800 4048 ..).....&...H.@H<br />
00050: 5800 4200 4601 6480 e6e6 4324 0e00 0100 X.B.F.d...C$....<br />
00060: 0100 0204 0316 4000 1b6c 4880 3800 3507 ......@..lH.8.5.<br />
00070: 0000 0000 0000 0000 b000 0000 0000 00c7 ................<br />
00080: bb01 247f 5a01 3f01 3f36 1d00 7835 5512 ..$.Z.?.?6..x5U.<br />
00090: 341c 0001 0e38 0370 c52a 0a08 0401 0000 4....8.p.*......<br />
000a0: 00ff fffe fefe fefc fcfa fafa fafa f8f8 ................<br />
000b0: f600 1214 1241 2303 0470 350e 2c2c 0000 .....A#..p5.,,..<br />
000c0: 0000 0000 0000 000e 0000 1228 1c00 314c ...........(..1L<br />
000d0: 4f21 0010 b008 fa15 26e7 fe3e 0e51 0500 O!......&..>.Q..<br />
000e0: 6d12 0300 01ff 0e00 0200 0000 0205 0500 m...............<br />
000f0: 0000 1800 0200 0002 1e12 1212 1414 1414 ................<br />
<br />
00100: 1414 1414 1616 1626 2223 2324 2424 2526 .......&"##$$$%&<br />
00110: 2626 2728 2818 014b 4b4b 4b4c 4c4c 4c4c &&'((..KKKKLLLLL<br />
00120: 4c4c 4d4d 4d02 6c71 765b 4045 4a2f 3439 LLMMM.lqv[@EJ/49<br />
00130: 3e03 0814 ffff ffff ffff ffff ffff ffff >...............<br />
00140: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00150: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00160: ffff 1cff ffff ffff ffff ffff ffff ffff ................<br />
00170: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00180: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00190: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001a0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001b0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001c0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001d0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001e0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001f0: ffff ffff ffff ffff ffff ffff ff01 20ff .............. .<br />
<br />
00200: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
002e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
002f0: 0000 0000 0000 0000 0000 0000 0000 0080 ................<br />
<br />
There are 10 pages starting at 0x1f400 (page 0xFA) that describe the WiFi settings (2 pages per slot?)<br />
<br />
1f400: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
1f440: 3c65 7373 6964 3e0a 0000 0000 0000 0000 <essid>.......<br />
1f450: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
1f4d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1f4e0: 0000 0000 0000 0000 0900 7805 0000 0001 ..........x.....<br />
1f4f0: 0000 0000 0000 0000 0000 0000 0000 f80f ................<br />
1f500: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
1f5f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
<br />
The last 2 pages store 2 identical copies of user settings.<br />
1fe00: 0500 0b01 0100 6200 7500 7300 6800 6900 ......b.u.s.h.i.<br />
1fe10: 6e00 6700 0000 0000 0000 0700 0000 0000 n.g.............<br />
1fe20: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe30: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe40: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe50: 0000 0000 0000 0000 8102 1603 2020 a30d ............ ..<br />
1fe60: 970c e0a0 00fc 0900 4010 db10 0000 0000 ........@.......<br />
1fe70: 0900 84dd 0100 0300 0000 0000 0000 0000 ................<br />
1fe80: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe90: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fea0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1feb0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fec0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fed0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fee0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fef0: 0000 0000 0000 0000 0000 0000 0000 1fcf ................<br />
<br />
1ff00: 0500 0b01 0100 6200 7500 7300 6800 6900 ......b.u.s.h.i.<br />
1ff10: 6e00 6700 0000 0000 0000 0700 0000 0000 n.g.............<br />
1ff20: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff30: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff40: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff50: 0000 0000 0000 0000 8102 1603 2020 a30d ............ ..<br />
1ff60: 970c e0a0 00fc 0000 0000 0000 0000 0000 ................<br />
1ff70: 0a00 922b 0100 0300 0000 0000 0000 0000 ...+............<br />
1ff80: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff90: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffa0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffb0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffc0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffd0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffe0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fff0: 0000 0000 0000 0000 0000 0000 0000 1fcf ................</div>Khmannhttps://dsibrew.org/w/index.php?title=Nvram&diff=4224Nvram2012-08-16T14:36:08Z<p>Khmann: merge; case-sensitive</p>
<hr />
<div>The DSi contains a 128KB block (organized into 256-byte pages) of memory referred to as "nvram"; it is stored in a SPI flash chip onboard the WiFi dongle. On the DS, this was the system's firmware, plus it included writeable areas for user preferences and wifi connection settings. On the DSi, this chip is maintained for backward compatibility, but it is mostly empty.<br />
There is some new unknown data near the beginning of NVRAM which is involved in the boot process. The NVRAM is read very early in boot, before the NAND flash is initialized. An unreadable NVRAM chip will hang the boot process in an infinite retry loop, and errors in this portion of NVRAM will cause a stage1 Bootloader error.<br />
<br />
Most of the address space is blank, with the exception of the following data:<br />
<br />
Pages 0-2: Old partial NDS firmware header (for compatibility)<br />
00000: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
00010: 0000 0000 0000 0000 0000 0000 0057 ffff .............W..<br />
00020: c03f 0000 0000 0000 ffff e861 3801 000f .?.........a8...<br />
00030: ffff ffff ff00 0022 4cd8 968a fe3f ffff ......."L....?..<br />
00040: 0394 2902 0200 1700 2600 1818 4800 4048 ..).....&...H.@H<br />
00050: 5800 4200 4601 6480 e6e6 4324 0e00 0100 X.B.F.d...C$....<br />
00060: 0100 0204 0316 4000 1b6c 4880 3800 3507 ......@..lH.8.5.<br />
00070: 0000 0000 0000 0000 b000 0000 0000 00c7 ................<br />
00080: bb01 247f 5a01 3f01 3f36 1d00 7835 5512 ..$.Z.?.?6..x5U.<br />
00090: 341c 0001 0e38 0370 c52a 0a08 0401 0000 4....8.p.*......<br />
000a0: 00ff fffe fefe fefc fcfa fafa fafa f8f8 ................<br />
000b0: f600 1214 1241 2303 0470 350e 2c2c 0000 .....A#..p5.,,..<br />
000c0: 0000 0000 0000 000e 0000 1228 1c00 314c ...........(..1L<br />
000d0: 4f21 0010 b008 fa15 26e7 fe3e 0e51 0500 O!......&..>.Q..<br />
000e0: 6d12 0300 01ff 0e00 0200 0000 0205 0500 m...............<br />
000f0: 0000 1800 0200 0002 1e12 1212 1414 1414 ................<br />
<br />
00100: 1414 1414 1616 1626 2223 2324 2424 2526 .......&"##$$$%&<br />
00110: 2626 2728 2818 014b 4b4b 4b4c 4c4c 4c4c &&'((..KKKKLLLLL<br />
00120: 4c4c 4d4d 4d02 6c71 765b 4045 4a2f 3439 LLMMM.lqv[@EJ/49<br />
00130: 3e03 0814 ffff ffff ffff ffff ffff ffff >...............<br />
00140: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00150: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00160: ffff 1cff ffff ffff ffff ffff ffff ffff ................<br />
00170: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00180: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
00190: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001a0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001b0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001c0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001d0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001e0: ffff ffff ffff ffff ffff ffff ffff ffff ................<br />
001f0: ffff ffff ffff ffff ffff ffff ff01 20ff .............. .<br />
<br />
00200: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
002e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
002f0: 0000 0000 0000 0000 0000 0000 0000 0080 ................<br />
<br />
There are 10 pages starting at 0x1f400 (page 0xFA) that describe the WiFi settings (2 pages per slot?)<br />
<br />
1f400: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
1f440: 3c65 7373 6964 3e0a 0000 0000 0000 0000 <essid>.......<br />
1f450: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
1f4d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1f4e0: 0000 0000 0000 0000 0900 7805 0000 0001 ..........x.....<br />
1f4f0: 0000 0000 0000 0000 0000 0000 0000 f80f ................<br />
1f500: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
**<br />
1f5f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
<br />
The last 2 pages store 2 identical copies of user settings.<br />
1fe00: 0500 0b01 0100 6200 7500 7300 6800 6900 ......b.u.s.h.i.<br />
1fe10: 6e00 6700 0000 0000 0000 0700 0000 0000 n.g.............<br />
1fe20: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe30: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe40: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe50: 0000 0000 0000 0000 8102 1603 2020 a30d ............ ..<br />
1fe60: 970c e0a0 00fc 0900 4010 db10 0000 0000 ........@.......<br />
1fe70: 0900 84dd 0100 0300 0000 0000 0000 0000 ................<br />
1fe80: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fe90: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fea0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1feb0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fec0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fed0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fee0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fef0: 0000 0000 0000 0000 0000 0000 0000 1fcf ................<br />
<br />
1ff00: 0500 0b01 0100 6200 7500 7300 6800 6900 ......b.u.s.h.i.<br />
1ff10: 6e00 6700 0000 0000 0000 0700 0000 0000 n.g.............<br />
1ff20: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff30: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff40: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff50: 0000 0000 0000 0000 8102 1603 2020 a30d ............ ..<br />
1ff60: 970c e0a0 00fc 0000 0000 0000 0000 0000 ................<br />
1ff70: 0a00 922b 0100 0300 0000 0000 0000 0000 ...+............<br />
1ff80: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ff90: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffa0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffb0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffc0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffd0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1ffe0: 0000 0000 0000 0000 0000 0000 0000 0000 ................<br />
1fff0: 0000 0000 0000 0000 0000 0000 0000 1fcf ................</div>Khmannhttps://dsibrew.org/w/index.php?title=DSi_Enhanced_Games&diff=4223DSi Enhanced Games2012-08-16T14:31:12Z<p>Khmann: clean</p>
<hr />
<div>DSi Enhanced Games are games for all versions the Nintendo DS that act normally on a DS Phat or DS Lite but when the game is run in a DSi will have access to the DSi hardware (Such as the extra RAM and most commonly cameras).<br />
<br />
So far though the DSi sections of the games have not been put into a ROM (As with the first DSi Exclusive Game, Monster Finder). So how the game uses the extra features is not known, however DSi mode is detected by checking if the first two bits value are 1 in byte hw reg 0x04004000.<br />
<br />
'''DSi Enhanced Exploits [[DSi exploits]]'''<br />
<br />
The DSi Enhanced games have been used to make the DSi run custom code in DSi mode and the first DSi homebrew. So far it has only been done on My Healthy Cooking Coach and Classic Word Games<br />
<br />
'''List of DSi Enhanced Games (As of 29th November 2009)'''<br />
{|<br />
|-<br />
!Name<br />
!Publisher<br />
|-<br />
|My Healthy Cooking Coach<br />
|Ubisoft<br />
|-<br />
|Classic Word Games<br />
|Ubisoft<br />
|-<br />
|THE iDOLM@STER: Dearly Stars<br />
|Namco<br />
|-<br />
|Imagine Journalist<br />
|Ubisoft<br />
|-<br />
|The Biggest Loser<br />
|THQ<br />
|-<br />
|Dolphin Island Underwater Adventures<br />
|Ubisoft<br />
|-<br />
|Imagine Rescue Vet<br />
|Ubisoft<br />
|-<br />
|Rabbids Go Home<br />
|Ubisoft<br />
|-<br />
|Girls Life: Fashion Addict<br />
|Ubisoft<br />
|-<br />
|Girls Life: Make Over<br />
|Ubisoft<br />
|-<br />
|Woman's Murder Club: Games of Passion<br />
|THQ<br />
|-<br />
|Assassin's Creed II: Discovery<br />
|Ubisoft<br />
|-<br />
|Style Lab: Jewelry Design<br />
|Ubisoft<br />
|}</div>Khmannhttps://dsibrew.org/w/index.php?title=Hardware&diff=4222Hardware2012-08-16T14:19:58Z<p>Khmann: </p>
<hr />
<div>{{stub}}<br />
<br />
== Specifications ==<br />
<br />
*[[Cameras|Includes (2) 0.3 Megapixel VGA Cameras]]<br />
*240MB(+16MB probably reserved for wear leveling purposes (e.g. replacing bad blocks)) Internal Flash Memory - Samsung kmapf0000m-S998 MOVI [[NAND]] - MMC Interface<br />
*16MB RAM - NEC uPD 46128512AF1 - DDR SRAM or a Fujitsu 128-Mbit FCRAM 82DBS08164D-70L (datasheet: http://edevice.fujitsu.com/fj/DATASHEET/e-ds/e511454.pdf)<br />
*(2) 256 x 192 3.25 Inch Displays, one of which has a resistive touch screen<br />
*Backwards compatible with Nintendo DS games but not GBA games due to the lack of a gameboy cartridge port.<br />
*Integrated ARM7/ARM9 cores clocked at 133mhz in real mode and downclocked to 66mhz for compatibility mode.<br />
*PAIC3000D Sound Chip - possibly a TI codecs: AIC3 ????<br />
*Mitsumi (MM3317A) or TI 72071B0 - Power supply and charger circuit ????<br />
*SD/SDHC Card slot<br />
*WiFi dongle with integrated 128KB SPI Flash for NVRAM, WiFi settings<br />
<br />
== Hardware Revisions ==<br />
* DSi<br />
** board C/TWL-CPU-01 (Original rev, all pictures below)<br />
** CPU: TWL. The latest date code picture I could find online was "0836 1m" as shown below, however other pictures with CPU covered show the NAND codes as late as 916, so...<br />
** Suspect this is the only board where WiFi chip is available in Hybrid games like CookingCoach<br />
** Wireless card DWM-W015<br />
<br />
* DSi RevA<br />
** board C/TWL-CPU-10 (Newer model, can someone provide a date or serial # range?)<br />
** CPU: TWL A. Mine is "0940 2m". My US Serial # is ~ TW71848???[5]. If yours is earlier, please update this.<br />
[[Image:TWL-CPU-10.png]]<br />
<br />
<br />
* DSi XL<br />
** board C/UTL-CPU-01<br />
** CPU is TWL A<br />
** Wireless card DWM-W024<br />
<br />
== Images ==<br />
<br />
=== Front ===<br />
<br />
[[Image:Twl_front.jpg]]<br />
[[Image:Twl_front_traces.jpg|600px]]<br />
<br />
The socket to the left of the ARM processor is the wifi chip socket.<br />
<br />
TWL CPU pinout map: [[File:Twl_cpu_pinout.pdf]] (WIP)<br />
<br />
=== Back ===<br />
<br />
[[Image:Twl_back.jpg]]<br />
<br />
=== NAND pinout ===<br />
[[Image:Dsi_nand.jpg|600px]]<br />
[[Image:Dsi_nanddat.png|600px]]<br />
<br />
=== PCB overlay ===<br />
[[Image:Nintendo DSi PCB Layered.jpg|600px]]<br />
=== CPU with new ram ===<br />
<br />
[[Image:CPUv2.jpg]]<br />
<br />
=== Glamor Shot ===<br />
<br />
[[Image:Nintendo-dsi-Glamor-Shot.jpg]]<br />
<br />
== References ==<br />
<br />
# http://en.wikipedia.org/wiki/Nintendo_DSi<br />
# http://insidetronics.blogspot.com/2008/11/new-nintendo-dsi-teardown.html<br />
# http://techon.nikkeibp.co.jp/english/NEWS_EN/20081111/161077/<br />
# http://games.gearlive.com/playfeed/article/q408-nintendo-dsi-announced-larger-screens-dual-cameras-dsi-shop-store/<br />
# http://www.ifixit.com/Guide/First-Look/Nintendo-DSi/714/1</div>Khmannhttps://dsibrew.org/w/index.php?title=Hardware&diff=4212Hardware2012-08-16T02:53:55Z<p>Khmann: There are at least 2 DSi motherboards.</p>
<hr />
<div>{{stub}}<br />
<br />
== Specifications ==<br />
<br />
*[[Cameras|Includes (2) 0.3 Megapixel VGA Cameras]]<br />
*240MB(+16MB probably reserved for wear leveling purposes (e.g. replacing bad blocks)) Internal Flash Memory - Samsung kmapf0000m-S998 MOVI [[NAND]] - MMC Interface<br />
*16MB RAM - NEC uPD 46128512AF1 - DDR SRAM or a Fujitsu 128-Mbit FCRAM 82DBS08164D-70L (datasheet: http://edevice.fujitsu.com/fj/DATASHEET/e-ds/e511454.pdf)<br />
*(2) 256 x 192 3.25 Inch Displays, one of which has a resistive touch screen<br />
*Backwards compatible with Nintendo DS games but not GBA games due to the lack of a gameboy cartridge port.<br />
*Integrated ARM7/ARM9 cores clocked at 133mhz in real mode and downclocked to 66mhz for compatibility mode.<br />
*PAIC3000D Sound Chip - possibly a TI codecs: AIC3 ????<br />
*Mitsumi (MM3317A) or TI 72071B0 - Power supply and charger circuit ????<br />
*SD/SDHC Card slot<br />
*WiFi dongle with integrated 128KB SPI Flash for NVRAM, WiFi settings<br />
<br />
== Hardware Revisions ==<br />
* DSi<br />
** board C/TWL-CPU-01 (Original rev, all pictures below)<br />
** CPU: TWL. The latest date code picture I could find online was "0827 5m"/"0832 ?m", however other pictures with CPU covered show the NAND codes as late as 916, so...<br />
** Suspect this is the only board where WiFi chip is available in Hybrid games like CookingCoach<br />
** Wireless card DWM-W015<br />
<br />
* DSi RevA<br />
** board C/TWL-CPU-10 (Newer model, can someone provide a date or serial # range?)<br />
** CPU: TWL A. Mine is "0940 2m". My US Serial # is ~ TW71848???[5]. If yours is earlier, please edit this.<br />
[[Image:TWL-CPU-10.png]]<br />
<br />
<br />
* DSi XL<br />
** board C/UTL-CPU-01<br />
** CPU is TWL A<br />
** Wireless card DWM-W024<br />
<br />
== Images ==<br />
<br />
=== Front ===<br />
<br />
[[Image:Twl_front.jpg]]<br />
[[Image:Twl_front_traces.jpg|600px]]<br />
<br />
The socket to the left of the ARM processor is the wifi chip socket.<br />
<br />
TWL CPU pinout map: [[File:Twl_cpu_pinout.pdf]] (WIP)<br />
<br />
=== Back ===<br />
<br />
[[Image:Twl_back.jpg]]<br />
<br />
=== NAND pinout ===<br />
[[Image:Dsi_nand.jpg|600px]]<br />
[[Image:Dsi_nanddat.png|600px]]<br />
<br />
=== PCB overlay ===<br />
[[Image:Nintendo DSi PCB Layered.jpg|600px]]<br />
=== CPU with new ram ===<br />
<br />
[[Image:CPUv2.jpg]]<br />
<br />
=== Glamor Shot ===<br />
<br />
[[Image:Nintendo-dsi-Glamor-Shot.jpg]]<br />
<br />
== References ==<br />
<br />
# http://en.wikipedia.org/wiki/Nintendo_DSi<br />
# http://insidetronics.blogspot.com/2008/11/new-nintendo-dsi-teardown.html<br />
# http://techon.nikkeibp.co.jp/english/NEWS_EN/20081111/161077/<br />
# http://games.gearlive.com/playfeed/article/q408-nintendo-dsi-announced-larger-screens-dual-cameras-dsi-shop-store/<br />
# http://www.ifixit.com/Guide/First-Look/Nintendo-DSi/714/1</div>Khmannhttps://dsibrew.org/w/index.php?title=File:TWL-CPU-10.png&diff=4211File:TWL-CPU-10.png2012-08-16T01:58:07Z<p>Khmann: Later revision DSi motherboard</p>
<hr />
<div>Later revision DSi motherboard</div>Khmann