Bureaucrats, oversight, Administrators
143
edits
Changes
no edit summary
|0000
|0000
|3CA3BD240F4B7400
|3CA3BD240F4B7400
| KEY1
| ENTER KEY1
|-
|-
|09F8
|09F8
|400008867A9F4B74
|400008867A9F4B74
| KEY2
| ENTER KEY2
|-
|-
|0914
|0914
|20007A3BD24F4B79
|20007A3BD24F4B79
| SEC 7
| SEC 7
|}
So far, this matches up with a normal DS bootup - with minor differences such as CARDID (90) coming before HEADER (00), and the header being queried for 0x1000 bytes.
After these commands, the sequence changes. A raw all zeroes command is sent, followed by a raw command that always starts with 0x3D. The following commands are all shown in raw format, as I've been unable to decrypt them yet. However, some obvious similarities exist by simply looking at the response size of the commands.
{| class="wikitable" border="1"
|-
|-
|0200
! Size
|13B4D693787157F8
! Command
|
! Description
|-
|0200
|0000000000000000
| HEADER again?
|-
|-
|0000
|0000
|BBF4450915844589
|3DBA1F0A0E91C100
|
| ENTER KEY1 again?
|-
|-
|09F8
|09F8
|657BCE613A3EF1C7
|67DCFB8E9CC369DF
|
| ENTER KEY2 again?
|-
|-
|0914
|0914
|D308DE62B3DEE88A
|A1FF8184D5312ACD
|
| CARDID again?
|-
|-
|19B8
|19B8
|385EAA84312A5D92
|E1B09DEAABE3D960
|
| SEC again?
|-
|-
|19B8
|19B8
|317FA6BA3B133E3D
|082289FB6F52EC75
|
| SEC again?
|-
|-
|19B8
|19B8
|763669E474321812
|854F68025AAC4B6D
|
| SEC again?
|-
|-
|19B8
|19B8
|17BE3DFD9495AD31
|994FAFFDD8993548
|
| SEC again?
|-
|-
|09F8
|09F8
|165FC4982B1633ED
|049D1DB7297CCE7F
|
| ENTER MAIN ?
|-
|-
|0004
|0004
|5238BE515C53ECE2
|247D01C82FD0D964
| CARDID?
|
|-
|-
|0200
|0200
|1EFABFBB3F0D32E6
|1300E4799B395232
|
| ROM READ?
|-
|-
|0200
|0200
|806A40706E0891AD
|14C25EC1E7F63C27
|
| ROM READ?
|-
|-
|0200
|0200
|7830652AE8672056
|BA11CDA5BDB17489
|
| ROM READ?
|}
|}
More to come...
More to come...