Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

allow dumping of firmware from is-nitro units #3

Merged
merged 1 commit into from
May 12, 2024

Conversation

Mythra
Copy link
Contributor

@Mythra Mythra commented May 12, 2024

the is-nitro-emulator/is-nitro-debugger units are development kits for the original ds, and dslite. unfortunately, there is no readily easy way to run a flashcart on them (as they use their own debug signing keys), and even for those of us with ds development cartridges we can write too, libnds does not support writing to these expectedly. as a result before this PR it was impossible to actually get the dump from this tool. the dumping techincally succeeds we just have nowhere to write the file.

at first i tried playing with getting it to dump over a network, but the hardwired connection didn't seem to be supported by libnds, and the wifi connection i couldn't get to trigger either (not to mention wireless connections that folks can use with these consoles are greatly dwindling due to no WPA/WPA2 being allowed). so i gave up with that.

luckily though, even though we don't have a filesystem to write too, and we don't have a network connection, because this is a development kit we have the ability to dump the memory from these devices while they're running. this means we can techincally use RAM as a filesystem to dump memory from. we do have enough memory to store the dumps one at a time without issue. so instead of writing a file, we just allocate a chunk of memory, write easily searchable/findable identifiers, and wait for a human/process to dump the files out of memory onto a computer that does have a filesystem, and can continue on.

for a human to replicate this with an is-nitro-debugger you can:

  • rename the built nds to srl.
  • load it up through nitro-debugger on the pc, and continue with the dump until you see your first memory address.
  • using the debugger application, use the memory dump tools present to write the memory to disk. Cut off the beginning DE, and ending AD's, and save the file. validate the CRCs match, and press start to continue. repeat for each file til your done.

i've also written a tool that can automate the dumping, and requires no human input past the first "yes run in dev-kit mode", that uses @GerbilSoft's ortin: https://github.com/GerbilSoft/ortin , to completely automate the process. it scans memory for our identifiers automatically, and then writes an identifier back to tell the application to automatically continue.

@lifehackerhansol
Copy link
Contributor

It'd be interesting if you could write a routine to write to a dev cart. Though not that important, since as you say one can just dump the mem and call it a day.

Do you know if there is any noticeable way to check for IS-NITRO during runtime (such as deviceType in firmware_header_t)?

@Mythra
Copy link
Contributor Author

Mythra commented May 12, 2024

@lifehackerhansol I didn't think you could write to the devcart while the device was in emulation mode, but I do have a cart, I'd certainly be happy to poke around, and see if I can get it to work (I have not spent a bunch of time with my nitro unit unfortunately).

As for noticeable way to check, I don't believe so? The device type is just DEVICE_TYPE_NDSP_PROTO (aka 0). Which I think is shared with other prototypes? I will also admit I haven't spent a ton of time looking into the different firmwares though. If it's helpful, here's the screen from when I just commented out the filesystem accesses:

Screenshot of the DS running NDS B+F Dumper. JEDEC values are 0x62 0x16 0x00, FW Size is 256 KB, mac is 00:09:BF:08:20:EF, FW build date is 2006-02-20 20:59, Device type is 0x00 DS Phat (prototype), BIOS7 CRC32 is 1280F0D5, Bios9 CRC32 is 2AB23573. If it's also helpful: https://archive.org/details/is-nitro-emulator-firmware-dump is the firmware dumps I took myself following the strategy above.

@lifehackerhansol
Copy link
Contributor

You're right, so not something we can properly verify. That's fine.

As for the dev cart... maybe if you abuse the NAND saving functionality (iirc they can save to real carts)? Not 100% sure. I don't expect everybody to have one of these though, so likely not worth dealing with it here.

@Mythra
Copy link
Contributor Author

Mythra commented May 12, 2024

Yeah I didn't think nitro units could write save data normally (I know when running through the debug tooling it certainly doesn't work), looks like some sources though claim it should be possible:

If your ROM requires backup hardware (game save info), you will need to insert a dev card with the right type of save memory (EEPROM vs flash, and right size). From the PC software you can then click the toolbar button "Turning the power on/off of the DS card slot", which will turn on SLOT-1. "SYSTEM1" LED should turn on to indicate SLOT-1 is on.

The IS-NITRO-EMULATOR/IS-NITRO-DEBUGGER units are development kits for
the original DS and DS Lite. Unfortunately, there is no readily easy
way to run a flashcart on them (as they use their own debug signing
keys), and even for those of us with DS development cartridges we can
write to, `libnds` does not support writing to these expectedly. As a
result before this commit it was impossible to actually get the dump
from this tool. The dumping techincally succeeds; we just have nowhere
to write the file.

At first I tried playing with getting it to dump over a network, but
the hardwired connection didn't seem to be supported by libnds, and the
wifi connection i couldn't get to trigger either (not to mention
wireless connections that folks can use with these consoles are greatly
dwindling due to no WPA/WPA2 being allowed). So I gave up with that.

Luckily though, even though we have neither a filesystem to write to
nor a network connection, because this is a development kit, we have
the ability to dump the memory from these devices while they're
running. This means we can techincally use RAM as a filesystem to dump
memory from. We do have enough memory to store the dumps one at a time
without issue. So instead of writing a file, we just allocate a chunk
of memory, write easily searchable/findable identifiers, and wait for a
human/process to dump the files out of memory onto a computer that does
have a filesystem, and can continue on.

For a human to replicate this with an is-nitro-debugger you can:
  - rename the built nds to `srl`.
  - load it up through nitro-debugger on the pc, and continue with the
    dump until you see your first memory address.
  - using the debugger application, use the memory dump tools present
    to write the memory to disk. Cut off the beginning `DE`, and ending
    `AD`'s, and save the file. Validate the CRCs match, and press start
    to continue. Repeat for each file until you're done.
@lifehackerhansol lifehackerhansol merged commit ee13ea5 into DS-Homebrew:main May 12, 2024
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants