Bureaucrats, oversight, Administrators
15
edits
Changes
New page: = Stage 1 = frame|When the Stage 1 bootloader (in ROM) fails, it displays a 32-bit hexadecimal number on the top screen. The first stage of the DSi's boo...
= Stage 1 =
[[Image:boot-stage1-error.jpeg|frame|When the Stage 1 bootloader (in ROM) fails, it displays a 32-bit hexadecimal number on the top screen.]]
The first stage of the DSi's bootloader lives in ROM, presumably on the CPU die. It loads further encrypted (and probably signed) stages from NAND flash, starting with a (partially unencrypted) offset table in the sector at 0x200.
Not much is known about this bootloader yet, but it presumably knows how to:
# Initialize the encryption hardware
# Read blocks (but not files) from the NAND flash
# Perform some variety of integrity check on all data it reads (signature, CRC, ?)
# Display basic hexadecimal error codes
# Possibly factory-programming the NAND flash?
# Might also do basic power-on self test of peripherals
Known error codes:
{| border="1" cellpadding="3" cellspacing="0"
! Error Code !! Description
|-
| 0000FE00 || Error communicating with NAND chip. (It's missing, CLK is shorted, etc.)
|-
| 0000FEFC || Integrity error in first block of Stage 2 (address at 0x220)
|-
| 0000FEFD || Integrity error in second block of Stage 2 (address at 0x230)
|-
| 0000FEFE || Boot sector integrity error (Sector 0x200 not valid)
|}
= Stage 2 =
[[Image:boot-stage2-error.jpeg|frame|This may have been a Stage 2 bootloader error.]]
Not much concrete information is known about the second-stage bootloader. This may be an actual bootloader, or it's possible that this stage is the DSi Menu itself. The Stage 2 loader was not modified by the [[System Menu 1.4]] update. This is still earlier in the boot process than the "Health and Safety" warning.
The first stage bootloader reads sector 0x200 in order to find a table of offsets to the Stage 2 bootloader:
00000220 00 08 00 00 10 64 02 00 00 80 7b 03 00 66 02 00 |.....d....{..f..|
00000230 00 6e 02 00 88 75 02 00 00 80 7b 03 00 76 02 00 |.n...u....{..v..|
00000240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
This appears to be describing two chunks of the stage2 loader, one 0x26410 bytes in length at address 0x800, and one 0x27588 bytes at address 0x26e00.
Note that this sector (and two similar ones at 0x400 and 0x600) appear to be the only unencrypted blocks on the NAND flash.
It is unclear why there are two pieces which are nearly but not quite the same size. Passive traces of the boot sequence confirm that the 0x26e00 chunk is slightly larger, and it's loaded first. The 0x800 chunk is read immediately after the 0x26e00 chunk.
After Stage 2 is loaded:
# The NAND flash is partially re-initialized
# Sector 0 is read from the NAND. This may be an (encrypted) partition table.
# Filesystem metadata is read from sectors starting around 0x100000. The metadata appears to be in FAT32 format with long filenames.
# A file is loaded from 0x790000 (just below 8MB). This may be the DSi Menu. If the "stage 2" loader ''is'' the DSi Menu, this may be data for the photo application that runs on the top screen.
All errors show before the health and safety screen. Known errors:
{| border="1" cellpadding="3" cellspacing="0"
! Appearance !! Description
|-
| Black screen || Error in sector 0, error in filesystem metadata, error in file at 0x7a0000.
|-
| "Error: 3-2435-8325" on both screens || XXX: I got this error once when modifying the stage2 loader, but haven't been able to reproduce it since.
|-
|}
[[Image:boot-stage1-error.jpeg|frame|When the Stage 1 bootloader (in ROM) fails, it displays a 32-bit hexadecimal number on the top screen.]]
The first stage of the DSi's bootloader lives in ROM, presumably on the CPU die. It loads further encrypted (and probably signed) stages from NAND flash, starting with a (partially unencrypted) offset table in the sector at 0x200.
Not much is known about this bootloader yet, but it presumably knows how to:
# Initialize the encryption hardware
# Read blocks (but not files) from the NAND flash
# Perform some variety of integrity check on all data it reads (signature, CRC, ?)
# Display basic hexadecimal error codes
# Possibly factory-programming the NAND flash?
# Might also do basic power-on self test of peripherals
Known error codes:
{| border="1" cellpadding="3" cellspacing="0"
! Error Code !! Description
|-
| 0000FE00 || Error communicating with NAND chip. (It's missing, CLK is shorted, etc.)
|-
| 0000FEFC || Integrity error in first block of Stage 2 (address at 0x220)
|-
| 0000FEFD || Integrity error in second block of Stage 2 (address at 0x230)
|-
| 0000FEFE || Boot sector integrity error (Sector 0x200 not valid)
|}
= Stage 2 =
[[Image:boot-stage2-error.jpeg|frame|This may have been a Stage 2 bootloader error.]]
Not much concrete information is known about the second-stage bootloader. This may be an actual bootloader, or it's possible that this stage is the DSi Menu itself. The Stage 2 loader was not modified by the [[System Menu 1.4]] update. This is still earlier in the boot process than the "Health and Safety" warning.
The first stage bootloader reads sector 0x200 in order to find a table of offsets to the Stage 2 bootloader:
00000220 00 08 00 00 10 64 02 00 00 80 7b 03 00 66 02 00 |.....d....{..f..|
00000230 00 6e 02 00 88 75 02 00 00 80 7b 03 00 76 02 00 |.n...u....{..v..|
00000240 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
This appears to be describing two chunks of the stage2 loader, one 0x26410 bytes in length at address 0x800, and one 0x27588 bytes at address 0x26e00.
Note that this sector (and two similar ones at 0x400 and 0x600) appear to be the only unencrypted blocks on the NAND flash.
It is unclear why there are two pieces which are nearly but not quite the same size. Passive traces of the boot sequence confirm that the 0x26e00 chunk is slightly larger, and it's loaded first. The 0x800 chunk is read immediately after the 0x26e00 chunk.
After Stage 2 is loaded:
# The NAND flash is partially re-initialized
# Sector 0 is read from the NAND. This may be an (encrypted) partition table.
# Filesystem metadata is read from sectors starting around 0x100000. The metadata appears to be in FAT32 format with long filenames.
# A file is loaded from 0x790000 (just below 8MB). This may be the DSi Menu. If the "stage 2" loader ''is'' the DSi Menu, this may be data for the photo application that runs on the top screen.
All errors show before the health and safety screen. Known errors:
{| border="1" cellpadding="3" cellspacing="0"
! Appearance !! Description
|-
| Black screen || Error in sector 0, error in filesystem metadata, error in file at 0x7a0000.
|-
| "Error: 3-2435-8325" on both screens || XXX: I got this error once when modifying the stage2 loader, but haven't been able to reproduce it since.
|-
|}