Card hardware: Difference between revisions

(2 intermediate revisions by one other user not shown)

Line 19:

Being able to reset a card using the hardware RST line is essential for the DSi card protocol.

= Card commands =

Line 44:

Line 43:

|0000

|3C02DD38BEC62AC2

| ENTER ~~KEY1~~

| ENTER BLOWFISH MODE

|-

|0910

|475C7973528EC62A

| ~~ENTER KEY2~~

| RESEED LFSR

|-

|0914

Line 76:

Line 75:

|0910

|A75C702DD38EC631

| ENTER ~~MAIN~~

| ENTER LFSR MODE

|-

|0004

Line 91:

Line 90:

|}

Note that the ~~KEY1~~ and ~~KEY2~~ commands shown here are already decrypted.

Note that the blowfish and lfsr commands shown here are already decrypted.

Line 146:

Line 145:

So far, this matches up with a normal DS bootup - with minor differences such as CARDID (90) coming before HEADER (00), the header being queried for 0x1000 bytes, and the size of responses changed for some commands from 0x910 to 0x9F8.

After these commands, the card is reset and a new sequence starts. A raw read header command (00) is sent, followed by a raw command that always starts with 0x3D. The following commands are all shown in raw format, as ~~I've been unable~~ to decrypt them yet. However, some obvious similarities exist by simply looking at the response size of the commands.

After these commands, the card is reset and a new sequence starts. A raw read header command (00) is sent, followed by a raw command that always starts with 0x3D. The following commands are all shown in raw format, as it is impossible to decrypt them yet. However, some obvious similarities exist by simply looking at the response size of the commands.

{| class="wikitable" border="1"

Line 208:

Line 207:

The command after 0x3D can not be decrypted using the old DS blowfish keys, it is likely that new blowfish keys are used when entering DSi blowfish mode. From the response lengths and similarity to the normal DS card protocol, a good guesstimate can be made about what each command in the DSi card protocol does.

= See Also =

* [[DSi Cartridge Header]]

@@ Line 19: / Line 19: @@
 Being able to reset a card using the hardware RST line is essential for the DSi card protocol.
 = Card commands =
@@ Line 44: / Line 43: @@
 |0000
 |3C02DD38BEC62AC2
-| ENTER KEY1
+| ENTER BLOWFISH MODE
 |-
 |0910
 |475C7973528EC62A
-| ENTER KEY2
+| RESEED LFSR
 |-
 |0914
@@ Line 76: / Line 75: @@
 |0910
 |A75C702DD38EC631
-| ENTER MAIN
+| ENTER LFSR MODE
 |-
 |0004
@@ Line 91: / Line 90: @@
 |}
-Note that the KEY1 and KEY2 commands shown here are already decrypted.
+Note that the blowfish and lfsr commands shown here are already decrypted.
@@ Line 146: / Line 145: @@
 So far, this matches up with a normal DS bootup - with minor differences such as CARDID (90) coming before HEADER (00), the header being queried for 0x1000 bytes, and the size of responses changed for some commands from 0x910 to 0x9F8.
-After these commands, the card is reset and a new sequence starts. A raw read header command (00) is sent, followed by a raw command that always starts with 0x3D. The following commands are all shown in raw format, as I've been unable to decrypt them yet. However, some obvious similarities exist by simply looking at the response size of the commands.
+After these commands, the card is reset and a new sequence starts. A raw read header command (00) is sent, followed by a raw command that always starts with 0x3D. The following commands are all shown in raw format, as it is impossible to decrypt them yet. However, some obvious similarities exist by simply looking at the response size of the commands.
 {| class="wikitable" border="1"
@@ Line 208: / Line 207: @@
 The command after 0x3D can not be decrypted using the old DS blowfish keys, it is likely that new blowfish keys are used when entering DSi blowfish mode. From the response lengths and similarity to the normal DS card protocol, a good guesstimate can be made about what each command in the DSi card protocol does.
+= See Also =
+* [[DSi Cartridge Header]]